Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

threatpost.com

Post reply on HN
Print view View original

271–280 of 306 posts

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#271

Post by zifnab06 »

bluGill wrote: post #71
pxeboot wrote: post #5

Until there is some legally required amount of time to provide security updates for connected devices, I would expect the "buy a new one if you want to be protected" response to continue indefinitely.

At one "legal training" class our lawyers said that there is the potential that we could be required to recall and fix any product we have ever made. We have machines we made in the 1950s that are still regularly used for the purpose they were bought for, but without modern safety standards. We believe we can argue in court that the modern safety devices didn't even exist back then so we shouldn't have to update thos…

10 years ago we had 802.11 a/b/g - n wasn't approved until October 2009 and not generally available until 2010.

In your case I'd imagine these are multi million dollar machines vs a $30 bottom line home router.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#272

Post by dredmorbius »

bsder wrote: post #206
dredmorbius wrote: post #204

Earlier quoted context omitted.

There were definitely problems and abuses with the model. But the hardware itself was robust and reliable.

Remember: "We don’t care. We don’t have to. We’re the Phone Company" Fake commercial on Saturday Night Season 2 Episode 1. (It wasn't called Saturday Night Live until later.)

I find the story of Walter Shaw Sr. even more instructive.

Independent inventor convicted and gaoled by AT&T for "misdemeanor attachment", the crime of attaching non-AT&T equipment to AT&T's phone network.

https://en.wikipedia.org/wiki/Walter_L._Shaw

More on this in the first bit of "The Inventor and the Thief" on Snap Judgement:

https://www.wnycstudios.org/podcasts/snapjudgment/episodes/l...

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#273

Post by dredmorbius »

wmf wrote: post #220
ralph84 wrote: post #199

Earlier quoted context omitted.

Ma Bell was leasing telephones since the days of Alexander Graham Bell. In fact you weren't allowed to use any telephone except one leased from your telco until the breakup of the Bell System in the 80s. Not sure that is what we want to go back to.

See also the Charter lawsuit where it was revealed that Charter was renting very old equipment to their customers for years and didn't care.

That's where the minimum standards aspect comes in. The problem of noncompetitive monopolies failing to innovate and actively quashing independent inventors (see: Walter Shaw, Sr., amongst many others) is a risk of this approach.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#274

Post by dredmorbius »

Aloha wrote: post #224
wmf wrote: post #220

Earlier quoted context omitted.

See also the Charter lawsuit where it was revealed that Charter was renting very old equipment to their customers for years and didn't care.

AT&T didn't just come out and install a newer telephone because they had a newer model. If the equipment is fit for the service why replace it?

AT&T later in its history, 1960s - 1970s, offered the option of uplines (touch-tone, "Streamline", "Princess", and eventually Mickey Mouse telephones) as service upgrades. So there wasn't no interest in innovation, though I'd agree with the general view that the interest was low.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#275

Post by dredmorbius »

CamperBob2 wrote: post #253
dredmorbius wrote: post #204

Earlier quoted context omitted.

There were definitely problems and abuses with the model. But the hardware itself was robust and reliable.

Because the hardware didn't do much of anything!

Contrast Minitel, a videotext online system provided by the French government phone monopoly Postes, Télégraphes et Téléphones in 1980.

https://en.wikipedia.org/wiki/Minitel

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#276

Post by milankragujevic »

wtallis wrote: post #240
milankragujevic wrote: post #209

Earlier quoted context omitted.

Most routers have the SoC integrating the radio chip, and running firmware and the OS on the same silicon.

Wireless router SoCs usually have at most one radio integrated, and the 5Ghz radio is still usually attached over PCIe. And even the integrated 2.4Ghz radio's firmware is running on entirely separate processor cores and in a different memory address space from the application processor.

I did not know that the firmware for the radio is running in a different context (memory space/processor). I assumed they would, to save cost, run everything together.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#277

Post by Aloha »

dredmorbius wrote: post #274
Aloha wrote: post #224

Earlier quoted context omitted.

AT&T didn't just come out and install a newer telephone because they had a newer model. If the equipment is fit for the service why replace it?

AT&T later in its history, 1960s - 1970s, offered the option of uplines (touch-tone, "Streamline", "Princess", and eventually Mickey Mouse telephones) as service upgrades. So there wasn't no interest in innovation, though I'd agree with the general view that the interest was low .

None of those were real technical improvements over the 500/2500 set however, they were upgrades designed to please the customer aesthetically.

Meaning, all of those sets performed more or less (in some cases less, specifically in certain special service applications) identically to a 2500/500, and at least one of those was a 2500 in a mouse shaped box.

Touch-Tone was actually a value add for the telco because it reduced register holding times in crossbar switches, and could reduce the amount of common control hardware needed, yet they still charged more for it (and the service too)

(Also, I think you mean trimline not streamline)

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#278

Post by philpem »

My last couple of WiFi routers were bought because they could run OpenWRT... I feel like stories like this support that position.

At least if there was a security issue OpenWRT couldn't patch, I have the source code to do so myself.

And I haven't bought D-Link kit in a very long time. Their record on a variety of things (reliability, support, ...) means you get better value (in the low-mid market segment at least) from the Chinese vendors e.g. TP-Link.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#279

Post by cmroanirgo »

incompatible wrote: post #211
tbyehl wrote: post #191

Earlier quoted context omitted.

> I would expect a consumer router to run without problem for not less than 10 years That's not a realistic expectation. Nobody is selling consumer devices with a 10-year support lifecycle.

How long do vehicle recalls last for, if something like an airbag turns out to be defective and dangerous?

I've a 2006 Toyota about to have it's second set of defective airbags replaced for free. In Oz.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#280

Post by namibj »

megous wrote: post #195
jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> This is the new normal, folks. Consumer technology is manufactured for six to twelve months. Not completely true. For example, just something I discovered recently is that some e-book readers have very long lifespan if you look inside and ignore the battery. There's not even an electrolytic or tantalum capacitors there. Really nothing that will expire. If you don't kill it mechanically, these will survive for 10 ye…

What model is that?
Post reply on HN