Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netgear 0-day vulnerability analysis and exploit

blog.grimm-co.com

Post reply on HN
Print view View original

91–100 of 102 posts

Re: Netgear 0-day vulnerability analysis and exploit

#91

Post by alyandon »

WorldMaker wrote: post #59
alyandon wrote: post #45

Earlier quoted context omitted.

Sadly not. You generally have to be very technically inclined to use something like Mikrotik (which is what I'm using) and even the Ubiquiti stuff isn't as easy to use as it could be.

Ubiquiti has a consumer/prosumer brand now called Amplifi. I set it up at my parents' and it was a breeze. It's adapted well to some strange network situations they had. (A long story but they moved in to a place with an ancient audio LAN wired through the home and we explored various configurations of detaching portions of the audio LAN for WiFi backhaul.)

That's good to know and I'll definitely check that out when it comes time to recommend something for some of my less technically inclined friends and family.

Re: Netgear 0-day vulnerability analysis and exploit

#92

Post by philjohn »

Namidairo wrote: post #7
stragies wrote: post #5

Treat these devices like PCs: See the installed system as "example installation to demonstrate functioning". Like HP with the bundled Crapware on PCs. Just install OpenWrt as soon as you did a basic function test. And only buy hardware you know to be compatible.

The problem with than plan however, is that many of these devices tend to depend on arcane network hardware acceleration features in order to reach decent switching throughput. Which rules out OpenWrt on some of the lower-spec pieces if you have a faster WAN connection (Ie. 1gbit), as I don't believe they have support for these on many platforms. (MT7621 is referenced as supported, and Qualcomm's "SFE" being supporte…

Qualcomm SFE has been replaced in OpenWRT with the more generic "flow offload", on an R7800 you can get gigabit speeds lan to wan.

Wireless is still lagging as the IPQ8064 has two NSS packet processing cores which, amongst other things, also accelerate crypto, including WPA.

I've got an R7800 running router duties on OpenWRT and then a Netgear Orbi RBK50 set running in AP mode which works well for my needs.

There IS a community effort to port the NSS acceleration (which accelerates qdisc and therefore traffic shaping with SQM) from the QSDK sources, but it's slow going.

Re: Netgear 0-day vulnerability analysis and exploit

#93

Post by g-b-r »

mobilio wrote: post #90
g-b-r wrote: post #85

Earlier quoted context omitted.

They are made in china, at least the last I bought (at least the company and the software are not chinese, of course)

Yes, but OS (firmware) is built in EU. Technically someone somewhere make a electronic plate and sold some elements on it. But difference is who is wrote a software on top.

?

Who wrote a software (and designed and sold the whole thing) is some difference, much better than nothing, but the "electronic plate" can still be filled with backdoors and other gimmicks...

Re: Netgear 0-day vulnerability analysis and exploit

#94

Post by JeremyNT »

Namidairo wrote: post #7
stragies wrote: post #5

Treat these devices like PCs: See the installed system as "example installation to demonstrate functioning". Like HP with the bundled Crapware on PCs. Just install OpenWrt as soon as you did a basic function test. And only buy hardware you know to be compatible.

The problem with than plan however, is that many of these devices tend to depend on arcane network hardware acceleration features in order to reach decent switching throughput. Which rules out OpenWrt on some of the lower-spec pieces if you have a faster WAN connection (Ie. 1gbit), as I don't believe they have support for these on many platforms. (MT7621 is referenced as supported, and Qualcomm's "SFE" being supporte…

You have to be careful when purchasing a device intended for use with OpenWRT. Not all low end devices are appropriate (specifically Broadcom based devices, which require proprietary software only available from the vendor or somebody signing their NDA like DD-WRT).

The IPQ40xx devices tend to be well supported, though. Be sure to refer to the hardware list to see if a device is really supported before buying it.

https://openwrt.org/toh/views/toh_available_16128

Re: Netgear 0-day vulnerability analysis and exploit

#95

Post by WorldMaker »

alblue wrote: post #89
WorldMaker wrote: post #59

Earlier quoted context omitted.

Ubiquiti has a consumer/prosumer brand now called Amplifi. I set it up at my parents' and it was a breeze. It's adapted well to some strange network situations they had. (A long story but they moved in to a place with an ancient audio LAN wired through the home and we explored various configurations of detaching portions of the audio LAN for WiFi backhaul.)

Does Amplifi require some cloud login before you can use it? One of my annoyances recently is that the WiFi providers have an iOS app but require you to log into their servers to configure the thing on your local network.

It's been a couple months since I set it up, but as I recall Amplifi did not require an account to set up your mesh.

It offered an optional "cloud" account system for remote administration (such as giving guest access when you are away or rebooting your mesh from your phone when your guest complains about the network not working, and so forth), but did not require it.

Re: Netgear 0-day vulnerability analysis and exploit

#96

Post by devy »

icedchai wrote: post #35
devy wrote: post #27

In SOHO devices like the R7000, the web server must parse user input from the network and run complex CGI functions that use that input. Furthermore, the web server is written in C and has had very little testing, and thus it is often vulnerable to trivial memory corruption bugs. I wonder why these network equipment manufacturers are still using CGIs in their firmware?! Is it because the MCUs they use in their hardwa…

Rust isn't magic. And you can write CGIs in any language. Shouldn't we also ask why are they using their own web server? or why a company with millions of devices deployed has done little testing?

> Rust isn't magic.

Let's not going to that debate. It's a good start to improve security postures, regardless how you spin it.

But more importantly, my point is why are they doing CGI at all?

Re: Netgear 0-day vulnerability analysis and exploit

#97

Post by icedchai »

devy wrote: post #96
icedchai wrote: post #35

Earlier quoted context omitted.

Rust isn't magic. And you can write CGIs in any language. Shouldn't we also ask why are they using their own web server? or why a company with millions of devices deployed has done little testing?

> Rust isn't magic. Let's not going to that debate. It's a good start to improve security postures, regardless how you spin it. But more importantly, my point is why are they doing CGI at all?

There is nothing wrong with CGI. It's simply a standard to forward a request from a web server to another application using environment variables and stdio. Generally, you want your router routing, not wasting CPU and memory running admin applications that are used less than once a month.

Re: Netgear 0-day vulnerability analysis and exploit

#98

Post by clairegraham »

tw04 wrote: post #8
Sodman wrote: post #6

The worst part is this isn't even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade. About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed "new update" for router firmware would involve some critical security updates, and maybe some stability f…

Highly recommend the synology line of routers. I've deployed a few of them for neighbors and have gotten exactly 0 calls. They mesh over wired or wireless, and for all of their faults Synology does a pretty good job of releasing software updates for their products for WAY longer than any other vendor I've worked with. Just make sure you use the 2600AC as the primary router, the 2200s can technically function in that…

Does the 2600 allow you to set a static DFS channel? It looks like it might support an auto-switch mode but I can’t find anything specific.

Re: Netgear 0-day vulnerability analysis and exploit

#99

Post by fomine3 »

devy wrote: post #96
icedchai wrote: post #35

Earlier quoted context omitted.

Rust isn't magic. And you can write CGIs in any language. Shouldn't we also ask why are they using their own web server? or why a company with millions of devices deployed has done little testing?

> Rust isn't magic. Let's not going to that debate. It's a good start to improve security postures, regardless how you spin it. But more importantly, my point is why are they doing CGI at all?

CGI is still great environment for simple webapp on embedded device. Using Rust is normally overkill and increases complexity. Python/PHP should be enough.

BTW quality of embedded webappa is mostly sucks.

Re: Netgear 0-day vulnerability analysis and exploit

#100

Post by ThePowerOfFuet »

clairegraham wrote: post #98
tw04 wrote: post #8

Earlier quoted context omitted.

Highly recommend the synology line of routers. I've deployed a few of them for neighbors and have gotten exactly 0 calls. They mesh over wired or wireless, and for all of their faults Synology does a pretty good job of releasing software updates for their products for WAY longer than any other vendor I've worked with. Just make sure you use the 2600AC as the primary router, the 2200s can technically function in that…

Does the 2600 allow you to set a static DFS channel? It looks like it might support an auto-switch mode but I can’t find anything specific.

>static DFS channel

This is a contradiction. The whole point of DFS is "if you detect radar on this frequency you must stop transmitting on it". This is typically followed by a change of channel to avoid an outage of the Wi-Fi, hence "dynamic frequency selection".

Post reply on HN