Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NetUSB Impacts the Security of Millions of Devices Worldwide

blog.sec-consult.com

Post reply on HN
Print view View original

11–20 of 43 posts

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#11

Post by cnvogel »

userbinator wrote: post #5

The client can specify the length of the computer name. By specifying a name longer than 64 characters What sort of programmer writes code to handle a protocol with a length field and yet uses a fixed-size buffer without ever considering the possibility of what would happen if it could be larger than the buffer...? I've seen plenty of source code out there, written for educational/example purposes, where arrays to ho…

> What sort of programmer writes code to

The sort of programmer who's not passionate about how the code looks, or works, as long as it passes the (very rudimentary) tests which don't cover protocol violations or borderline cases.

The sort of programmer that didn't have any experience and directly went from Sandbox-Java to bare-metal kernel-code in his first project?

I don't want to disillusion you, but I know plenty of people with (at least part-time) programming jobs who don't care at all about all the new programming paradigms, programming languages, libraries, frameworks... boasted often here on HN. I'd say that a huge majority is pretty pleased with what they know, as long as it's enough to do the job.

And, frankly, economically it makes sense: How many plastic-routers are chosen based on their track-record regarding security? And how many "Security-Incident-Handling Stars" does any of the devices mentioned in the article have on Amazon.com? No one cares. The company and their programmers can just continue writing "almost working" code, and patch the security-incident-of-the-month when it surfaces.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#12

Post by nine_k »

[deleted] wrote: post #8
userbinator wrote: post #5

The client can specify the length of the computer name. By specifying a name longer than 64 characters What sort of programmer writes code to handle a protocol with a length field and yet uses a fixed-size buffer without ever considering the possibility of what would happen if it could be larger than the buffer...? I've seen plenty of source code out there, written for educational/example purposes, where arrays to ho…

[deleted]

We do that because existing more expressive tools (like Haskell and ML) are not very well suited for low-level work, and Rust has just released a first stable version. I suppose that C++ could be expressive enough to rule out such things, and even C can successfully avoid these pitfalls, but both require much more discipline and time to achieve this.

What would you use for that kind of code 5 years ago? The code in question likely took some time to write, get from proof-of-concept to beta to production to widespread use, before it could start to be a threat for many people.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#13

Post by caf »

[deleted] wrote: post #8
userbinator wrote: post #5

The client can specify the length of the computer name. By specifying a name longer than 64 characters What sort of programmer writes code to handle a protocol with a length field and yet uses a fixed-size buffer without ever considering the possibility of what would happen if it could be larger than the buffer...? I've seen plenty of source code out there, written for educational/example purposes, where arrays to ho…

[deleted]

They probably could have developed this in userspace using libusb, which even has Python bindings.

Of course, the other mentioned vulnerability - that some of these devices are exporting your USB devices to the whole internet - was language-neutral.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#15

Post by sveiss »

caf wrote: post #13
[deleted] wrote: post #8

Earlier quoted context omitted.

[deleted]

They probably could have developed this in userspace using libusb, which even has Python bindings. Of course, the other mentioned vulnerability - that some of these devices are exporting your USB devices to the whole internet - was language-neutral.

Shipping libusb and Python would probably mean spending an extra 50¢ on flash or RAM per unit.

From the point of view of a race-to-the-bottom consumer hardware manufacturer, the choice is obvious.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#16

Post by sdalfakj »

> Workaround:

> -----------

> Sometimes NetUSB can be disabled via the web interface, but at least on NETGEAR devices this does not mitigate the vulnerability. NETGEAR told us, that there is no workaround available, the TCP port can't be firewalled nor is there a way to disable the service on their devices.

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advi...

Eeesh

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#17

Post by pavel_lishin »

ansible wrote: post #14

Sigh.... I should probably replace my commercial-grade WiFi router with some custom box that can run OpenBSD or something. When I first got it, I tried to go through and lock down everything I could find. But I suspect that may not be enough.

I wonder how much it would cost to build a reasonable wifi router out of a raspberry pi, or something similar.

If you could keep performance and consumer costs comparable, you could probably sell quite a few.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#18

Post by sdalfakj »

cnvogel wrote: post #11
userbinator wrote: post #5

The client can specify the length of the computer name. By specifying a name longer than 64 characters What sort of programmer writes code to handle a protocol with a length field and yet uses a fixed-size buffer without ever considering the possibility of what would happen if it could be larger than the buffer...? I've seen plenty of source code out there, written for educational/example purposes, where arrays to ho…

> What sort of programmer writes code to The sort of programmer who's not passionate about how the code looks, or works, as long as it passes the (very rudimentary) tests which don't cover protocol violations or borderline cases. The sort of programmer that didn't have any experience and directly went from Sandbox-Java to bare-metal kernel-code in his first project? I don't want to disillusion you, but I know plenty…

> I'd say that a huge majority is pretty pleased with what they know, as long as it's enough to do the job.

> And, frankly, economically it makes sense

because they are treated as disposables by their companies, as far as I understand from all the comments from sysadmins and programmers here and at other forums.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#19

Post by seiji »

userbinator wrote: post #5

The client can specify the length of the computer name. By specifying a name longer than 64 characters What sort of programmer writes code to handle a protocol with a length field and yet uses a fixed-size buffer without ever considering the possibility of what would happen if it could be larger than the buffer...? I've seen plenty of source code out there, written for educational/example purposes, where arrays to ho…

> What sort of programmer

I know we like to think all programmers are the best and brightest and most talented citizens of the entire world, but the truth is: most programmers have the dedication of fast food workers and as long as "it works for me," they'll ship it.

The projects people here are used to (modular, decomposed, open source, documented) are rare. The world is full of multi-million line code bases with little usable documentation (either no documentation, outdated documentation, or 8,000 pages of documentation) and comments not describing actual behavior. Plus, everything gets compiled using 300 recursive Makefiles written across 15 years in 8 different countries by people who only keep their job for 8 months at a time.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#20

Post by jAcKyL_8643 »

pavel_lishin wrote: post #17
ansible wrote: post #14

Sigh.... I should probably replace my commercial-grade WiFi router with some custom box that can run OpenBSD or something. When I first got it, I tried to go through and lock down everything I could find. But I suspect that may not be enough.

I wonder how much it would cost to build a reasonable wifi router out of a raspberry pi, or something similar. If you could keep performance and consumer costs comparable, you could probably sell quite a few.

Mikrotik does this. Though their OS is not open source.
Post reply on HN