Netgear 0-day vulnerability analysis and exploit • Hacker News Board

Re: Netgear 0-day vulnerability analysis and exploit

#41

Post by theincredulousk » Tue, Jun 16, 2020, 4:15 PM UTC

0fcf8d3559a64c wrote: post #31

I am sick of having to assume my network hardware is trivially compromised. What will it take for me to be able to purchase a microkernel driven router/access-point with audited drivers (or Rust based)? I would settle for mediocre performance (ie no gigabit) if I could have some strong security guarantees. Can I setup Redox or seL4 as home network hardware at this point? Or would the pain threshold still be quite hig…

Get an enterprise router/firewall.

Also most of these vulnerabilities (as the article points out) are in the web server. If the web server isn't exposed,it isn't of much practical security concern.

I've also run DD-WRT for years with excellent results. Per the usual benefits of open source and active maintainers, it is generally going to (a) have the trivial stuff already addressed (b) keep up to a reasonable extent with security patches.

Re: Netgear 0-day vulnerability analysis and exploit

#42

Post by RNCTX » Tue, Jun 16, 2020, 4:25 PM UTC

Sodman wrote: post #6

The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade. About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed "new update" for router firmware would involve some critical security updates, and maybe some stability f…

DD-WRT on the R7000 is flawless.

I even run nginx as a name-based proxy on mine, with load balancing! Works like a champ.

Re: Netgear 0-day vulnerability analysis and exploit

#43

Post by rubatuga » Tue, Jun 16, 2020, 4:39 PM UTC

Namidairo wrote: post #7

stragies wrote: post #5

Treat these devices like PCs: See the installed system as "example installation to demonstrate functioning". Like HP with the bundled Crapware on PCs. Just install OpenWrt as soon as you did a basic function test. And only buy hardware you know to be compatible.

The problem with than plan however, is that many of these devices tend to depend on arcane network hardware acceleration features in order to reach decent switching throughput. Which rules out OpenWrt on some of the lower-spec pieces if you have a faster WAN connection (Ie. 1gbit), as I don't believe they have support for these on many platforms. (MT7621 is referenced as supported, and Qualcomm's "SFE" being supporte…

Openwrt on Mt7621 is phasing out hardware accelerated NAT

Re: Netgear 0-day vulnerability analysis and exploit

#44

Post by theincredulousk » Tue, Jun 16, 2020, 4:44 PM UTC

Predictably, the web servers are an afterthought for branding so that users don't have to edit configuration files and operate at a command line.

(a) 99%+ of people buying these things do not know or care about security, aside from someone stealing their WiFi bandwidth (b) the manufacturer does not care because of (a).

As follows, all they care about (WRT to the web server) is that they are easy enough for non-technical people to setup such that they don't end up on a tech support call or returning the device for a refund. That is it.

If you are the 1% that cares about security on your home network, it is far less stressful to simply conclude these products are not for you and move on with your life. You should be looking at enterprise hardware, open source router firmware, or rolling your own.

In any case, what surprises me is that over time the router manufacturers haven't simply built up a single, relatively patched-up, web server implementation that they re-use. Even without aligned incentives, you would think over years and years of development they'd have something at least as good as what you can clone out from from github for free.

Re: Netgear 0-day vulnerability analysis and exploit

#45

Post by alyandon » Tue, Jun 16, 2020, 5:04 PM UTC

jasondclinton wrote: post #40

alyandon wrote: post #10

Reading stuff like this makes me glad I ditched consumer grade all-in-one stuff and went with a $REAL (feel free to substitute appropriate brand) router and stand alone AP.

That's not a workable solution for the vast majority of the population.

Sadly not. You generally have to be very technically inclined to use something like Mikrotik (which is what I'm using) and even the Ubiquiti stuff isn't as easy to use as it could be.

Re: Netgear 0-day vulnerability analysis and exploit

#46

Post by esaym » Tue, Jun 16, 2020, 5:17 PM UTC

I gave up on netgear long ago for access points. Been running stuff from https://mikrotik.com/ since 2016. They are a bit dated in some areas, but they are cheap and I've never had any issues.

Re: Netgear 0-day vulnerability analysis and exploit

#47

Post by user5994461 » Tue, Jun 16, 2020, 5:21 PM UTC

theincredulousk wrote: post #41

0fcf8d3559a64c wrote: post #31

I am sick of having to assume my network hardware is trivially compromised. What will it take for me to be able to purchase a microkernel driven router/access-point with audited drivers (or Rust based)? I would settle for mediocre performance (ie no gigabit) if I could have some strong security guarantees. Can I setup Redox or seL4 as home network hardware at this point? Or would the pain threshold still be quite hig…

Get an enterprise router/firewall. Also most of these vulnerabilities (as the article points out) are in the web server. If the web server isn't exposed,it isn't of much practical security concern. I've also run DD-WRT for years with excellent results. Per the usual benefits of open source and active maintainers, it is generally going to (a) have the trivial stuff already addressed (b) keep up to a reasonable extent…

>>> Get an enterprise router/firewall.

I would have said the same some time ago, working in networking in a world largely made up of Cisco.

But then a few major vulnerabilities later and blog posts disclosing vulnerabilities that they refused to acknowledge when contacted. Then I'm not sure paying for enterprise equipment is a solution anymore.

Re: Netgear 0-day vulnerability analysis and exploit

#48

Post by londons_explore » Tue, Jun 16, 2020, 5:21 PM UTC

jeffbee wrote: post #23

Sodman wrote: post #6

The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade. About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed "new update" for router firmware would involve some critical security updates, and maybe some stability f…

The best thing about setting up Google wifi routers for your relatives is you can set yourself up as the manager of them, and manage them with the Google Wifi app from anywhere. So before Uncle Bob calls you about the wifi you'd already have got the notification that his cable service is down again.

I've had a pretty disappointing run with those Google Wifi routers...

It started with the lack of ability to have an open guest wifi... Like - it's for my guests, I want anyone to be able to connect, and I don't want to be faffing with passwords or guests having to ask me... I have to name my network "My House - Password Is password"

Then every month it seemed to do some kind of update and disconnect wifi devices... Sure - it's only for 30 seconds, but a disconnection is a disconnection. Thats going to boot you off whatever game you are playing...

And now I've got the trouble that as you have a bunch of mesh points, you can't walk between them without glitches in a video call... Like seriously - I should be able to start facetime and walk round my house without random freezes for 5 seconds while it reconnects to a different mesh point.

Google Wifi has been out for years now, and not a single one of these bugs is any better than it was at launch. Not really acceptable for a $400 router setup!

Re: Netgear 0-day vulnerability analysis and exploit

#49

Post by DiabloD3 » Tue, Jun 16, 2020, 5:25 PM UTC

Im surprised no one has made the semi-obligitory "buy Ubiquiti Edgerouter X/Lite and throw in a NanoHD" comment.

Re: Netgear 0-day vulnerability analysis and exploit

#50

Post by user5994461 » Tue, Jun 16, 2020, 5:26 PM UTC

devy wrote: post #27

In SOHO devices like the R7000, the web server must parse user input from the network and run complex CGI functions that use that input. Furthermore, the web server is written in C and has had very little testing, and thus it is often vulnerable to trivial memory corruption bugs. I wonder why these network equipment manufacturers are still using CGIs in their firmware?! Is it because the MCUs they use in their hardwa…

They're running CGI and writing homemade web servers in C because they haven't maintained or upgraded their software in decades.

I don't think they are low power devices. My bet would be they're relatively normal hardware running a light linux. It takes quite a bit of power to route gigabit ethernet or ac wifi.