Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netgear 0-day vulnerability analysis and exploit

blog.grimm-co.com

Post reply on HN
Print view View original

71–80 of 102 posts

Re: Netgear 0-day vulnerability analysis and exploit

#71

Post by cptskippy »

Sodman wrote: post #6

The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade. About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed "new update" for router firmware would involve some critical security updates, and maybe some stability f…

> I found this fix months after it had been posted, and there had still been no new patch released to fix the issue.

D-Link isn't any better, many of their firmwares to fix KRACK were in Beta for 4 years and many are still in Beta.

Re: Netgear 0-day vulnerability analysis and exploit

#72

Post by antsar »

jeffbee wrote: post #65
antsar wrote: post #63

Earlier quoted context omitted.

Sorry to be "that guy", but how about not giving an advertisement company access to all your network traffic (while paying them for the privilege)... Almost every router supports some form of remote management (or just put TeamViewer on their machine). Most also support dynamic DNS so you can set up a ping check for the "its down" notification.

Sorry to say that you are "that guy" and your comment, in addition to adding nothing to this conversation, also detracts from HN generally and contributes to the perception that it is an unserious place haunted by the deranged and irrational. "Google Wifi and Nest Wifi devices do not track the websites you visit or collect the content of any traffic on your network."

Disagree about "adding nothing". We're talking about hardware for nontechnical family/friends, who might not understand the conflict of interest. It's not nice to project your apathy/disbelief that Google would abuse the access onto those people.

The name-calling is really not necessary. Why not make your point on its own merits?

The doc[0] you're quoting continues to list a bunch of things they do collect, including some with no opt-out. Way to cherry-pick.

Even the part you quoted does not exclude traffic metadata.

[0] https://support.google.com/wifi/answer/6246642?hl=en

Re: Netgear 0-day vulnerability analysis and exploit

#73

Post by ndesaulniers »

londons_explore wrote: post #48
jeffbee wrote: post #23

Earlier quoted context omitted.

The best thing about setting up Google wifi routers for your relatives is you can set yourself up as the manager of them, and manage them with the Google Wifi app from anywhere. So before Uncle Bob calls you about the wifi you'd already have got the notification that his cable service is down again.

I've had a pretty disappointing run with those Google Wifi routers... It started with the lack of ability to have an open guest wifi... Like - it's for my guests, I want anyone to be able to connect, and I don't want to be faffing with passwords or guests having to ask me... I have to name my network "My House - Password Is password" Then every month it seemed to do some kind of update and disconnect wifi devices...…

If it means the software is up to date, then I can live with an interruption. It might be nice to have power controls, but I think they do a fair job keeping the UI simple. That's not to say a power user UI couldn't be added, but it certainly increases the testing burden to add new features that need to be tested for regression.

Re: Netgear 0-day vulnerability analysis and exploit

#74

Post by cptskippy »

0fcf8d3559a64c wrote: post #31

I am sick of having to assume my network hardware is trivially compromised. What will it take for me to be able to purchase a microkernel driven router/access-point with audited drivers (or Rust based)? I would settle for mediocre performance (ie no gigabit) if I could have some strong security guarantees. Can I setup Redox or seL4 as home network hardware at this point? Or would the pain threshold still be quite hig…

You seem to imply that by virtue of being a microkernel, an OS will be imbued with magical powers preventing it from being compromised.

Re: Netgear 0-day vulnerability analysis and exploit

#75

Post by antsar »

Sodman wrote: post #69
antsar wrote: post #63

Earlier quoted context omitted.

Sorry to be "that guy", but how about not giving an advertisement company access to all your network traffic (while paying them for the privilege)... Almost every router supports some form of remote management (or just put TeamViewer on their machine). Most also support dynamic DNS so you can set up a ping check for the "its down" notification.

The fact that I've paid them for the hardware gives me more confidence that I'm not the product. Ironically, the fact that I can get TeamViewer for free and use it to get remote access others' computers makes it feel like a higher threat attack vector for me. Before I bought the Google mesh wifi, I already had android, chrome, project Fi, and Google's DNS (router level) at various levels of my request stack. That's n…

> the fact that I can get TeamViewer for free and use it to get remote access others' computers makes it feel like a higher threat attack vector for me.

I agree. I gave that example because I personally use it, but would prefer to move to a self-hosted or inexpensive paid solution. I've always assumed the free version has sufficient business value as a lead-generator for the enterprise version, but there's no reason to assume they don't also monetize usage data.

> I already had android, chrome, project Fi, and Google's DNS ... whatever marginal gain they get from having software on my router is negligible.

That's a totally fair way of looking at it, and I'd probably use Google Wifi with little hesitation if I were you. But this isn't the case for everyone. IMHO tech folks need to be mindful of privacy implications when recommending tech to non-tech folks, because we have the benefit of understanding those implications. FWIW, my immediate family would be displeased if I installed a Google router for them and they later figured out Google's conflict of interest for themselves.

Re: Netgear 0-day vulnerability analysis and exploit

#76

Post by coronadisaster »

Sodman wrote: post #6

The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade. About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed "new update" for router firmware would involve some critical security updates, and maybe some stability f…

For all software, we need 2 branches... one with feature updates and security fixes and one with only security fixes (Maybe AI will figure out a way to make this happen). That would reduce the number of bugs in one of the branches.

Re: Netgear 0-day vulnerability analysis and exploit

#77

Post by yjftsjthsd-h »

beamatronic wrote: post #37
Meekro wrote: post #30

I've used Apple routers for many years, but since they've been discontinued I wonder what I'll do when I need to replace them. All the major alternatives seem to have crap software that requires frequent reboots and has security issues. Can anyone recommend an awesome wireless router that works great off the shelf? I don't want to have to learn how to flash it with DD-WRT.

Eero

My only concern with eero is that they're owned by Amazon. It might be fine, but it's the kind of thing that makes me nervous, particularly with "smart" systems.

Re: Netgear 0-day vulnerability analysis and exploit

#78

Post by yjftsjthsd-h »

user5994461 wrote: post #50
devy wrote: post #27

In SOHO devices like the R7000, the web server must parse user input from the network and run complex CGI functions that use that input. Furthermore, the web server is written in C and has had very little testing, and thus it is often vulnerable to trivial memory corruption bugs. I wonder why these network equipment manufacturers are still using CGIs in their firmware?! Is it because the MCUs they use in their hardwa…

They're running CGI and writing homemade web servers in C because they haven't maintained or upgraded their software in decades. I don't think they are low power devices. My bet would be they're relatively normal hardware running a light linux. It takes quite a bit of power to route gigabit ethernet or ac wifi.

> They're running CGI and writing homemade web servers in C because they haven't maintained or upgraded their software in decades.

Sometimes, certainly:) However...

> I don't think they are low power devices. My bet would be they're relatively normal hardware running a light linux. It takes quite a bit of power to route gigabit ethernet or ac wifi.

It doesn't take much compute to handle high-end eth/wifi if you offload it to hardware, and even doing it on-CPU (which I don't think is actually common) probably wouldn't impact RAM/storage, so you could still manage with a stronger CPU and comically tiny memory.

Re: Netgear 0-day vulnerability analysis and exploit

#79

Post by yjftsjthsd-h »

rmrfstar wrote: post #26
mobilio wrote: post #2

It's another reason once you bought a router to reflash it with alternative firmwares as OpenWRT or DD-WRT

What's the deal with no signatures on OpenWRT firmware images.

? https://openwrt.org/docs/guide-user/security/release_signatu...

Re: Netgear 0-day vulnerability analysis and exploit

#80

Post by yjftsjthsd-h »

mmm_grayons wrote: post #4
jaboutboul wrote: post #3

Wow. This is gonna be bad.

Routers have been full of stupidly bad bugs for years; nothing really new here. I recall analyzing one a while back and finding that it used session tokens to determine whether one was logged into the interface. These were derived from the uptime with triple des, but the nonce was a constant string of text and the key was based off of interface mac addresses. One has to wonder, at that point, why do anything at all?

> One has to wonder, at that point, why do anything at all?

Still prevents the most casual attacks; obscurity is sorta technically better than nothing. (Or worse, of course, if it gives the incorrect appearance of actual security...)

Post reply on HN