Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netgear 0-day vulnerability analysis and exploit

blog.grimm-co.com

Post reply on HN
Print view View original

21–30 of 102 posts

Re: Netgear 0-day vulnerability analysis and exploit

#21

Post by zantana »

wycy wrote: post #9
mobilio wrote: post #2

It's another reason once you bought a router to reflash it with alternative firmwares as OpenWRT or DD-WRT

The last time I looked into OpenWRT/DD-WRT (years ago), it seemed disadvantageous to switch to them because they would be slower than stock firmware due to missing some kind of hardware support. Is this still the case these days? EDIT: It sounds like the situation for my router (R7000) is quite the opposite now, apparently being almost twice as fast due to new hardware acceleration features.

DD-WRT is has access to some proprietary (Broadcom?) code which enables NAT acceleration on some models which, at least in my case, greatly improved performance over OpenWRT.

Re: Netgear 0-day vulnerability analysis and exploit

#22

Post by colechristensen »

moepstar wrote: post #12
Sodman wrote: post #6

The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade. About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed "new update" for router firmware would involve some critical security updates, and maybe some stability f…

Another brand i vouch for is AVM, their routers are all over Germany and they're reliable workhorses for years... Maybe, just maybe, someone should start a list with vendors that put out shitty software on their devices, never deliver firmware updates and have stupid exploits...

>Maybe, just maybe, someone should start a list with vendors that put out shitty software on their devices, never deliver firmware updates and have stupid exploits...

You might as well just list every vendor, the exceptions are rare and don't always last.

Re: Netgear 0-day vulnerability analysis and exploit

#23

Post by jeffbee »

Sodman wrote: post #6

The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade. About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed "new update" for router firmware would involve some critical security updates, and maybe some stability f…

The best thing about setting up Google wifi routers for your relatives is you can set yourself up as the manager of them, and manage them with the Google Wifi app from anywhere. So before Uncle Bob calls you about the wifi you'd already have got the notification that his cable service is down again.

Re: Netgear 0-day vulnerability analysis and exploit

#24

Post by [deleted] »

Sodman wrote: post #6

The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade. About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed "new update" for router firmware would involve some critical security updates, and maybe some stability f…

[deleted]

Re: Netgear 0-day vulnerability analysis and exploit

#25

Post by mizzack »

Sodman wrote: post #6

The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade. About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed "new update" for router firmware would involve some critical security updates, and maybe some stability f…

One of the redeeming features of the R7000 is that it can run AdvancedTomato, DD-WRT, etc.

Re: Netgear 0-day vulnerability analysis and exploit

#27

Post by devy » 

   In SOHO devices like the R7000, the web server must parse user input 
   from the network and run complex CGI functions that use that input. 
   Furthermore, the web server is written in C and has had very little testing, 
   and thus it is often vulnerable to trivial memory corruption bugs.
I wonder why these network equipment manufacturers are still using CGIs in their firmware?! Is it because the MCUs they use in their hardwares are too weak to run modern version of the linux with reasonable choices to build a custom compiled version of the web server in Rust not C?

Re: Netgear 0-day vulnerability analysis and exploit

#28

Post by mobilio »

zantana wrote: post #21
wycy wrote: post #9

Earlier quoted context omitted.

The last time I looked into OpenWRT/DD-WRT (years ago), it seemed disadvantageous to switch to them because they would be slower than stock firmware due to missing some kind of hardware support. Is this still the case these days? EDIT: It sounds like the situation for my router (R7000) is quite the opposite now, apparently being almost twice as fast due to new hardware acceleration features.

DD-WRT is has access to some proprietary (Broadcom?) code which enables NAT acceleration on some models which, at least in my case, greatly improved performance over OpenWRT.

Exactly. They have signed an NDA with Broadcom: https://openwrt.org/meta/infobox/broadcom_wifi

"DD-WRT has a license agreement and NDA in place with Broadcom that allow usage of better, proprietary, closed source wireless drivers (binary blobs) which they are not allowed to redistribute freely."

Re: Netgear 0-day vulnerability analysis and exploit

#30

Post by Meekro »

I've used Apple routers for many years, but since they've been discontinued I wonder what I'll do when I need to replace them. All the major alternatives seem to have crap software that requires frequent reboots and has security issues.

Can anyone recommend an awesome wireless router that works great off the shelf? I don't want to have to learn how to flash it with DD-WRT.

Post reply on HN