Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

threatpost.com

Post reply on HN
Print view View original

251–260 of 306 posts

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#251

Post by deogeo »

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from.

And yet my over 10 year old PC still gets the latest updates. Manufacturers have brought this on themselves, by locking and closing their devices, and insisting on proprietary solutions when open alternatives exist, or could exist.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#252

Post by [deleted] »

tbyehl wrote: post #191
bluGill wrote: post #71

Earlier quoted context omitted.

At one "legal training" class our lawyers said that there is the potential that we could be required to recall and fix any product we have ever made. We have machines we made in the 1950s that are still regularly used for the purpose they were bought for, but without modern safety standards. We believe we can argue in court that the modern safety devices didn't even exist back then so we shouldn't have to update thos…

> I would expect a consumer router to run without problem for not less than 10 years That's not a realistic expectation. Nobody is selling consumer devices with a 10-year support lifecycle.

[deleted]

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#253

Post by CamperBob2 »

dredmorbius wrote: post #204
ralph84 wrote: post #199

Earlier quoted context omitted.

Ma Bell was leasing telephones since the days of Alexander Graham Bell. In fact you weren't allowed to use any telephone except one leased from your telco until the breakup of the Bell System in the 80s. Not sure that is what we want to go back to.

There were definitely problems and abuses with the model. But the hardware itself was robust and reliable.

Because the hardware didn't do much of anything!

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#254

Post by kalleboo »

dehrmann wrote: post #221
Arnt wrote: post #106

Earlier quoted context omitted.

Mikrotik or Ubiquiti. My >10yo hardware still receives updates (latest version, not a few backported changes).

Both tend to pick pretty well-understood and supported SoCs. Large consumer brands are more cost-conscious and use cheaper chips with more custom work to support them, and the custom work ends up being buggier. IIRC, Ubiquiti started out by being based on OpenWRT. Not sure if they still are.

Ubiquiti's software is based on VyOS https://en.wikipedia.org/wiki/VyOS

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#255

Post by ekianjo »

dangus wrote: post #89
jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

Until consumers are willing to spend on subscription services to keep devices up-to-date, new hardware is the de facto method of paying for software development work. Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send t…

One solution would be to force the source code of non supported devices to be released (by law) so that third parties could be paid by individuals to update and patch them as long as there is a market.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#256

Post by ekianjo »

harikb wrote: post #231
dredmorbius wrote: post #145

Earlier quoted context omitted.

Until consumers are willing to spend on subscription services... You cannot shift a Gresham's Law race-to-the-bottom dynamic by insisting on consumer (or producer) willpower. You've got to enforce a floor. In other consumer (and industrial) products, this has tended to happen through the combined mechanisms of strict liability, certification, and independent inspection (in specific cases). Where manufacturers, or as…

As soon as warranty/support expires, the device must be free for DRM/reverse-engineering . This will incentivize manufacturers to offer longer support. Edit: Rather they should actually provide the spec, drivers etc

As support expires or EOL the manufacturer should be forced to release their firmware code to ensure older devices can be patched, if they want to keep operating and selling new devices. this requires legislation though.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#257

Post by Aloha »

TheSpiceIsLife wrote: post #235
Aloha wrote: post #224

Earlier quoted context omitted.

AT&T didn't just come out and install a newer telephone because they had a newer model. If the equipment is fit for the service why replace it?

If you rent a $100 device at $10 a month for 10 years you end up paying $1200 and still not owning it. I can see why consumers and consumer advocate groups don’t like this.

The customer should always have the option to buy their own hardware - that's to me something that was fought for (and won) with Carterphone

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#258

Post by [deleted] »

Aloha wrote: post #257
TheSpiceIsLife wrote: post #235

Earlier quoted context omitted.

If you rent a $100 device at $10 a month for 10 years you end up paying $1200 and still not owning it. I can see why consumers and consumer advocate groups don’t like this.

The customer should always have the option to buy their own hardware - that's to me something that was fought for (and won) with Carterphone

[deleted]

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#259

Post by TheSpiceIsLife »

Aloha wrote: post #257
TheSpiceIsLife wrote: post #235

Earlier quoted context omitted.

If you rent a $100 device at $10 a month for 10 years you end up paying $1200 and still not owning it. I can see why consumers and consumer advocate groups don’t like this.

The customer should always have the option to buy their own hardware - that's to me something that was fought for (and won) with Carterphone

Sorry, I managed to reply to the wrong comment.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#260

Post by mkhpalm »

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

Its been the norm for a long time now. I've always wondered why printer manufacturers could get away with universally exempting themselves from security audits. People just admitted they were bad and said: "don't even look at it wrong or it'll dump all its paper and toner on the floor"
Post reply on HN