Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

threatpost.com

Post reply on HN
Print view View original

281–290 of 306 posts

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#281

Post by pbhjpbhj »

dangus wrote: post #89
jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

Until consumers are willing to spend on subscription services to keep devices up-to-date, new hardware is the de facto method of paying for software development work. Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send t…

Why can't an attacker with router access poison the DNS, redirecting a bank address to the router itself with a fake cert, and duplication of the login screen and steal credentials that way? (Or probably better, steal online MUA [ie email] credentials).

I guess 2FA might block them, but if it were a typed in code you could still get it.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#282

Post by archi42 »

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> Can you provide an "enterprise class embedded OS" to device manufacturers and address post-deployment updates?

There is already vxWorks, they don't have to start from scratch and they're already widely used in the industry. (There are others as well).

Anyway: The devices in question are running some Linux with a custom web interface on top. Patching this specific flaw is just about having one engineer add a few lines to the webif git, trigger a rebuild, flash to a qemu VM (could happen automatically) and test if the interface still works. If that's the case (which is likely), put the firmware as "unsupported"/"alpha" on the company FTP.

This assumes they have proper tooling (e.g. tagged git, automatic&deterministic build server, an efficient test environment,...). If they don't have, they probably wouldn't buy it (or, maybe they would?).

Automatic post-deployment are only the end of the chain, and for cheap embedded consumer systems there are good reasons against it: "My router didn't react, so I powercycled it" is problematic if it was just applying an update (resilience against this costs money, which is tight). And then your 1st level support has to explain your grandma how to use tftp to flash the firmware via the bootloader (this is bad for 1st level support suicide rates). Did I mention all the crap should be cheap? What good is a well maintained IoShit device if it costs 4$ more than the poorly maintained competition? Chances are high you won't sell enough to sustain your company - unless you go into a premium segment and just charge twice as much as the competition, which might still be problematic (consumer expectations change a lot with price - cheap and vs. expensive and nice).

Also, at the other end of the embedded spectrum: Industrial embedded systems should probably only be updated if really necessary, e.g. if something is broken due to bad firmware. Downtime is really expensive for huge manufacturing plants, especially if unscheduled (in addition to the machine[s] not producing value, your 500 workers a fiddling their thumbs), so you want to reduce the number of opportunities for this to happen.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#283

Post by ncmncm »

jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

> Can you provide an "enterprise class embedded OS" to device manufacturers and address post-deployment updates?

Yes. At least for routers, the topic of the article, OpenWRT is that OS. Any manufacturer can make it work on their router very cheaply. Any customer can install and upgrade it indefinitely.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#285

Post by hackbinary »

dclusin wrote: post #20
hackbinary wrote: post #13

Earlier quoted context omitted.

What do you expect from companies that sell kit at $50/£50/€50? You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Then again, I buy stuff that can be flashed with OpenWRT ...

If a car spontaneously combusts we hold the auto manufacturable liable for correcting that defect. It doesn't matter if it's a Prius or a Ferrari. These vendors are selling defective devices and it is fixable via software patch. Just because they stopped selling them doesn't mean they shouldn't have to fix it.

>> If a car spontaneously

This is false equivalence. A car is not $/£/E/50 piece of hardware.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#286

Post by eecc »

kazen44 wrote: post #85
eecc wrote: post #16

I'm aware of the "but what if the router is connected to an ICU bed? A patient's life depends on it!" straw man but let's be honest, it would only be the ICU's admin fault. Having sorted this out, let me clearly state that the only ethical solution is to brick these devices offline.

i hope an intensive care unit doesn't really on a bottom of the barrel consumer device for their network reliability.

I wasn’t arguing that someone might or should, I was just expecting someone to make the argument.

And there you go: https://news.ycombinator.com/item?id=21195759

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#287

Post by PeterStuer »

somehnguy wrote: post #30
redblacktree wrote: post #14

Earlier quoted context omitted.

How high-touch is this kind of setup? I have a separate access point and I am using a consumer-grade "wireless router" for DHCP. (and other things?) I'm more of an app developer that does DevOps stuff when I have to. Is this something I can get done in a day or so? Is a Raspberry Pi enough, or do I need something more powerful?

If you want a less touchy solution (not completely plug and play though!) I can't recommend Ubiquiti products enough. I run an EdgeRouter X and Unifi AP at home. Not big enterprise gear but way more enterprisey than whatever you'll find on the shelf at Best Buy. Updates are released regularly and once you get your initial configuration done they just chug along, no random 'internet is down, need to reboot something'…

What WAN throughput can you get on an Edgerouter X with moderate Firewall and some basic QoS rules enabled?

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#288

Post by MikusR »

iagovar wrote: post #29
chimi wrote: post #22

What is the best wifi-router out now for home hackers? I'd like to do a pi-hole type setup but without the pi-hole and I also need a stronger wifi signal than on the box my ISP gives me.

Probably some low tier mikrotik. It's not for dummies though, it requires to know a bit of networking.

It really doesn't. The quickset (essentially basic configuration like most home routers) has been a feature for like 7 years.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#289

Post by TheSpiceIsLife »

lotsofpulp wrote: post #242
TheSpiceIsLife wrote: post #234

Earlier quoted context omitted.

> Until consumers are willing to spend on subscription services... Ok, I’m willing. Where do I sign up? Which manufactures are offering this service for residential grade equipment?

There is none. Everyone should have a Meraki security appliance in their home.

Dear lord.

Re: D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

#290

Post by syshum »

dangus wrote: post #89
jjguy wrote: post #43

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, therm…

Until consumers are willing to spend on subscription services to keep devices up-to-date, new hardware is the de facto method of paying for software development work. Of course, in reality, this CVE seems almost un-exploitable in the wild, anyway. How will an exploiter get to the login page in the first place? They'd have to know your network password and be in your physical vicinity, or your ISP would have to send t…

Until manufacturers are liable for the damage they cause to security, and data loss events for consumers manufactures will continue to have unrealistic planned obsolesce model (12 months should never be the expected life span of a router) to force consumers to continually buy new hardware
Post reply on HN