D-Link Home Routers Open to Remote Takeover Will Remain Unpatched • Hacker News Board

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#201

Post by wtallis » Tue, Oct 08, 2019, 10:12 PM UTC

m-p-3 wrote: post #179

wtallis wrote: post #47

Earlier quoted context omitted.

Really it seems like the radio ASICs themselves should be adding a little bit of embedded flash or OTP memory. But barring that, as the storage requirements of routers increase (having already moved from NOR to NAND flash) we may eventually reach the point where a router includes a BGA SSD whose controller can enforce permanent read-only permissions on a partition that stores RF parameters.

But what do you do when it's the radio firmware itself that has a security for and the vendor stopped patching their devices? It's a pain in the ass to secure a closed source binary blob. Example: https://hackaday.com/2019/09/05/esp8266-and-esp32-wifi-hacke... what if Espressif dropped support for these a while ago? You couldn't securely use these in some scenarios without reverse-engineering the binary blobs and pat…

Those Espressif blobs are running on the same processor as the application/OS and are responsible for a lot more functionality than the typical radio firmware for a Broadcom/Qualcomm/Mediatek WiFi NIC that connects over PCIe. That firmware is also entirely different from the RF regulatory data I was talking about; the regulatory data should be in a ROM somewhere but the WiFi firmware generally needs to be stored alongside and updated in lockstep with the operating system's driver for the WiFi device.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#202

Post by notyourday » Tue, Oct 08, 2019, 10:21 PM UTC

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> I'll point out the enormous opportunity to anyone who can address that problem. Can you provide an "enterprise class embedded OS" to device manufacturers and address post-deployment updates? Can you provide infrastructure device manufacturers can use to manage post-deployment updates themselves? Do you have a better approach to it? There's a burgeoning multi-billion dollar market waiting for a few leaders to take it over.

There's no market for this. The market is for $50 device. Android Phones, nearly flagship, that sell for $500-700 get at best two years updates. People want $50 router that they can throw away when it stops working.

I have a $350 router. I have had it for 3 years by now. It is a tiny passively cooled industrial PC that fits into a VESA mount with an Intel Celeron, 128Gb SSD and 2x wifi modules. Why two? Because i want a guest network to be separate from the real network and i want crap-wifi speaking devices to be isolated via VLAN etc. It is running Debian and even techies marvel at the speed, functionality and all the goodies. They want to know where they can get it... Until they hear that it was $350 at which point they go "I was thinking i would pay about $80". A dinner for two in a Puero Rican chicken shack with a couple of beers will be $35!

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#203

Post by toast0 » Tue, Oct 08, 2019, 10:27 PM UTC

chimi wrote: post #22

What is the best wifi-router out now for home hackers? I'd like to do a pi-hole type setup but without the pi-hole and I also need a stronger wifi signal than on the box my ISP gives me.

The T-Mobile Cellspot AC1900 (rebadged ASUS RT-AC68U) seem to work well enough and are often on sale. As with all wifi routers, put them into access point mode, and run an ethernet cable.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#204

Post by dredmorbius » Tue, Oct 08, 2019, 10:28 PM UTC

ralph84 wrote: post #199

dredmorbius wrote: post #145

Earlier quoted context omitted.

Until consumers are willing to spend on subscription services... You cannot shift a Gresham's Law race-to-the-bottom dynamic by insisting on consumer (or producer) willpower. You've got to enforce a floor. In other consumer (and industrial) products, this has tended to happen through the combined mechanisms of strict liability, certification, and independent inspection (in specific cases). Where manufacturers, or as…

Ma Bell was leasing telephones since the days of Alexander Graham Bell. In fact you weren't allowed to use any telephone except one leased from your telco until the breakup of the Bell System in the 80s. Not sure that is what we want to go back to.

There were definitely problems and abuses with the model.

But the hardware itself was robust and reliable.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#205

Post by aetherspawn » Tue, Oct 08, 2019, 10:37 PM UTC

We don’t have cable or a phone line, so I recently bought a D-Link router with a 4G SIM card slot and a massive yearly data plan that corresponds to the approx. amount of data I use yearly at home as a light non-streaming user (400gb at approx. $1 per gb).

I’m open to hardware suggestions that are/more open source capable or robust in the first place, but my use case was really niche and the shop(s) had nearly nothing suitable except this one model.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#206

Post by bsder » Tue, Oct 08, 2019, 10:50 PM UTC

dredmorbius wrote: post #204

ralph84 wrote: post #199

Earlier quoted context omitted.

Ma Bell was leasing telephones since the days of Alexander Graham Bell. In fact you weren't allowed to use any telephone except one leased from your telco until the breakup of the Bell System in the 80s. Not sure that is what we want to go back to.

There were definitely problems and abuses with the model. But the hardware itself was robust and reliable.

Remember: "We don’t care. We don’t have to. We’re the Phone Company"

Fake commercial on Saturday Night Season 2 Episode 1.

(It wasn't called Saturday Night Live until later.)

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#207

Post by milankragujevic » Tue, Oct 08, 2019, 10:58 PM UTC

dredmorbius wrote: post #163

The affected routers may be supported by OpenWRT, a free software wireless router project, or similar projects (dd-wrt, Tomato). Looking the OpenWRT Table of Hardware ( https://openwrt.org/toh/start?dataflt%5BBrand*~%5D=D-Link ), I find: DIR-655: OpenWRT: not listed. DIR-866L: OpenWRT: not listed. dd-wrt: https://wiki.dd-wrt.com/wiki/index.php/D-Link_DIR-868L DIR-652: not listed DHP-1565: Present: https://openwrt.org…

Most DIR-XXX routers are actually Realtek (Lexra), which developers of OpenWRT refuse to support due to the unweildy microarchitecture of the SoC.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#208

Post by milankragujevic » Tue, Oct 08, 2019, 10:59 PM UTC

theandrewbailey wrote: post #86

H1Supreme wrote: post #75

I have a D-Link DIR-655 (which is on this list) as my home router. Ironically, I was going to replace it a few months ago, but the speed is still fast enough for my network. A few posts mentioned installing a different (open source) firmware. But, both OpenWrt and DD-Wrt aren't compatible. Am I missing another option? As an aside, can anyone recommend a wifi router that runs either OpenWrt or DD-Wrt well, for $100-$1…

You aren't missing another option. The 655 is based on an exotic architecture (Ubicom32) that never had the specs released for it to develop 3rd party firmware. Its why I trashed my 655 years ago.

Revision C1 is a standard QCA chip.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#209

Post by milankragujevic » Tue, Oct 08, 2019, 11:02 PM UTC

wtallis wrote: post #201

m-p-3 wrote: post #179

Earlier quoted context omitted.

But what do you do when it's the radio firmware itself that has a security for and the vendor stopped patching their devices? It's a pain in the ass to secure a closed source binary blob. Example: https://hackaday.com/2019/09/05/esp8266-and-esp32-wifi-hacke... what if Espressif dropped support for these a while ago? You couldn't securely use these in some scenarios without reverse-engineering the binary blobs and pat…

Those Espressif blobs are running on the same processor as the application/OS and are responsible for a lot more functionality than the typical radio firmware for a Broadcom/Qualcomm/Mediatek WiFi NIC that connects over PCIe. That firmware is also entirely different from the RF regulatory data I was talking about; the regulatory data should be in a ROM somewhere but the WiFi firmware generally needs to be stored alon…

Most routers have the SoC integrating the radio chip, and running firmware and the OS on the same silicon.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#210

Post by Smithalicious » Tue, Oct 08, 2019, 11:03 PM UTC

dangus wrote: post #89

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

Until consumers are willing to spend on subscription services to keep devices up-to-date, new hardware is the de facto method of paying for software development work. Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send t…

I just fundamentally don't think a subscription service is fair here. After all, users are paying for the fixing of errors that shouldn't have been there to begin with. It's not the fixing of problems that are newly created but the fixing of defects that were there all along. Plus, the incentive here is backwards; in the most degenerate case, companies are incentivized to sell things as buggy as possible in order to sell the most bug fix subscriptions possible.