Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

threatpost.com

Post reply on HN
Print view View original

211–220 of 306 posts

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#211

Post by incompatible »

tbyehl wrote: post #191
bluGill wrote: post #71

Earlier quoted context omitted.

At one "legal training" class our lawyers said that there is the potential that we could be required to recall and fix any product we have ever made. We have machines we made in the 1950s that are still regularly used for the purpose they were bought for, but without modern safety standards. We believe we can argue in court that the modern safety devices didn't even exist back then so we shouldn't have to update thos…

> I would expect a consumer router to run without problem for not less than 10 years That's not a realistic expectation. Nobody is selling consumer devices with a 10-year support lifecycle.

How long do vehicle recalls last for, if something like an airbag turns out to be defective and dangerous?

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#212

Post by uptown »

abawany wrote: post #159
msla wrote: post #23

Earlier quoted context omitted.

I'll never use vendor firmware again. If the router doesn't support OpenWRT, it's a time bomb waiting to go off, as this article shows; plus, of course, OpenWRT has sufficient additional functionality that that alone makes it worthwhile. And once again, we're all reminded of the divide between people who know how to do things like this and people who don't, and how the people who do know have an advantage in life.

I bought a couple of Netgear AC1600 routers and installed DD-WRT/Kong firmware on them right away (clicked the PayPal contribution link and paid up - it is worth it). They work well and update quite frequently.

Can this model be used as a VPN server routing through your home ISP connection?

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#213

Post by snuxoll »

__jal wrote: post #174
eropple wrote: post #90

Earlier quoted context omitted.

They were lemons at time of sale, though, we just didn't know it yet . Between that and the ecosystem/society argument, I think it's a no-brainer. > However, how would you feel about legislation that required five years of dealer service to be included with every automobile sale? Or other products in a similar vein? This analogy doesn't work for me; software bugs are defects , they aren't something getting old and fa…

The operative difference is that intelligent adversaries are not coming up with new and better methods of making your bumper fall off. The economics of providing 5 years of defensive patching on a $100 device simply does not work.

Maybe they need to stop shipping a dozen different $100 models with wildly different specifications and come up with a common platform to reduce support costs, like most other industries.

Support costs increase as fragmentation does, it things sold at a reasonable price and without dozens of variations it would be more feasible to maintain longer supported life cycles - but these companies have no incentive to think beyond the next quarter’s earnings call.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#214

Post by abawany »

uptown wrote: post #212
abawany wrote: post #159

Earlier quoted context omitted.

I bought a couple of Netgear AC1600 routers and installed DD-WRT/Kong firmware on them right away (clicked the PayPal contribution link and paid up - it is worth it). They work well and update quite frequently.

Can this model be used as a VPN server routing through your home ISP connection?

I think this router+dd-wrt supports it though I haven't personally used vpn on it. Here is the link that implies it supports it: https://www.myopenrouter.com/articles/r6300r6300v2-guides-ho... . Some general information about the router is at: https://wiki.dd-wrt.com/wiki/index.php/Netgear_R6300v2 .

Edit: another link: https://nordvpn.com/tutorials/dd-wrt/flashrouters-privacy-ap... .

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#215

Post by kbaker »

bluGill wrote: post #71
pxeboot wrote: post #5

Until there is some legally required amount of time to provide security updates for connected devices, I would expect the "buy a new one if you want to be protected" response to continue indefinitely.

At one "legal training" class our lawyers said that there is the potential that we could be required to recall and fix any product we have ever made. We have machines we made in the 1950s that are still regularly used for the purpose they were bought for, but without modern safety standards. We believe we can argue in court that the modern safety devices didn't even exist back then so we shouldn't have to update thos…

> not less than 10 years: they should update it to work

> get dlink to pay your costs

What happens when the company is gone?

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#216

Post by dehrmann »

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> but live in our homes for three to five years

I have a wrt54g that's 10+ years old running at my grandma's house...and running dd-wrt because no one making APs 10 years ago, and even now, was that good at security and stability.

What's telling is that the hardware is the part that still works, and I bet part of it is that software fixes are easier than hardware, so you can get away with lower quality software.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#217

Post by dehrmann »

kbaker wrote: post #215
bluGill wrote: post #71

Earlier quoted context omitted.

At one "legal training" class our lawyers said that there is the potential that we could be required to recall and fix any product we have ever made. We have machines we made in the 1950s that are still regularly used for the purpose they were bought for, but without modern safety standards. We believe we can argue in court that the modern safety devices didn't even exist back then so we shouldn't have to update thos…

> not less than 10 years: they should update it to work > get dlink to pay your costs What happens when the company is gone?

For DLink, you're out $20-$100. What happens when Tesla is gone?

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#218

Post by m463 »

dehrmann wrote: post #216
jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> but live in our homes for three to five years I have a wrt54g that's 10+ years old running at my grandma's house...and running dd-wrt because no one making APs 10 years ago, and even now, was that good at security and stability. What's telling is that the hardware is the part that still works, and I bet part of it is that software fixes are easier than hardware, so you can get away with lower quality software.

I think that's a great idea (I run openwrt)

However - I have to ask - have you upgraded her dd-wrt?

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#219

Post by ryandrake »

redwall_hp wrote: post #98
eropple wrote: post #72

Earlier quoted context omitted.

> the only other real possibility is to legislate that such updates be made available for N years as part of the purchase conditions I am unclear why this is not the preferential solution here. "Don't sell lemons" is a societal good.

Laws requiring that consumer electronics not be effectively disposable is also a net good for the environment as well. I'd like my router to have active cooling (so it doesn't self destruct from heat) and run an open source firmware that will survive longer than a single manufacturer may be willing to maintain it. (They all can jointly contribute.) Phones should have some level of modularity and repairability, so the…

We would need stronger consumer protection laws and regulations around defective products. My car’s manufacturer just fixed my 10 year old airbag for free, presumably not out of the goodness of their hearts but because they are required to.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#220

Post by wmf »

ralph84 wrote: post #199
dredmorbius wrote: post #145

Earlier quoted context omitted.

Until consumers are willing to spend on subscription services... You cannot shift a Gresham's Law race-to-the-bottom dynamic by insisting on consumer (or producer) willpower. You've got to enforce a floor. In other consumer (and industrial) products, this has tended to happen through the combined mechanisms of strict liability, certification, and independent inspection (in specific cases). Where manufacturers, or as…

Ma Bell was leasing telephones since the days of Alexander Graham Bell. In fact you weren't allowed to use any telephone except one leased from your telco until the breakup of the Bell System in the 80s. Not sure that is what we want to go back to.

See also the Charter lawsuit where it was revealed that Charter was renting very old equipment to their customers for years and didn't care.
Post reply on HN