NetUSB Impacts the Security of Millions of Devices Worldwide • Hacker News Board

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#21

Post by DEinspanjer » Wed, May 20, 2015, 3:23 PM UTC

pavel_lishin wrote: post #17

ansible wrote: post #14

Sigh.... I should probably replace my commercial-grade WiFi router with some custom box that can run OpenBSD or something. When I first got it, I tried to go through and lock down everything I could find. But I suspect that may not be enough.

I wonder how much it would cost to build a reasonable wifi router out of a raspberry pi, or something similar. If you could keep performance and consumer costs comparable, you could probably sell quite a few.

It isn't hard to put together low power hardware with two or more NICs, and you can then toss something like pfSense or similar on it.

The biggest challenge is whether this will impact your internet speed. If you have a faster broadband connection, you can quickly exhaust the throughput capabilities of such a limited platform. Things get significantly worse if you are relying on the router for your LAN traffic as well (i.e. you don't have a switch to offload the LAN only traffic).

With the more commercial solutions, whether for SOHO or SMB, the biggest advantage they bring to the table is the ability to utilize hardware optimizations such as offloading for checksum, TCP segmentation, and large receive.

pfSense actually has code to perform the offloading, but you have to ensure the hardware you're using is capable of performing the work.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#22

Post by kpcyrd » Wed, May 20, 2015, 3:50 PM UTC

_jomo wrote: post #2

tl;dr: You can cause a remote kernel exploit when your device name is longer than 64 bytes. > Easy as a pie, the ‘90s are calling and want their vulns back

s/kernel exploit/kernel panic/

exploits actually exploit things

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#23

Post by redwards510 » Wed, May 20, 2015, 3:59 PM UTC

listic wrote: post #9

Looks like most home router manufacturers are mindlessly plugging modules from various vendors to their devices' firmware, to add features. Are there manufacturers or product lines that are safe(r) from such approach? Are alternative firmware such as OperWRT or independent open-source firmwares (m0n0wall, pfSense, OPNsense) better in this regard?

pFSense and OpenWRT (I have no experience in the others) are safer in that a) when issues are discovered, patches are made quickly and upgrading is simple and b) you can select only the services you want running, thereby reducing your attack surface.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#24

Post by cbhl » Wed, May 20, 2015, 4:00 PM UTC

I wonder if OpenWRT is also vulnerable or if it's just the stock firmware.

I used to use one of the affected devices (TP-LINK Archer C2), but primarily bought it to run OpenWRT on it. Eventually I got tired of tinkering with it and replaced it with something else, though.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#25

Post by mzs » Wed, May 20, 2015, 4:03 PM UTC

listic wrote: post #9

Looks like most home router manufacturers are mindlessly plugging modules from various vendors to their devices' firmware, to add features. Are there manufacturers or product lines that are safe(r) from such approach? Are alternative firmware such as OperWRT or independent open-source firmwares (m0n0wall, pfSense, OPNsense) better in this regard?

Linksys has been mostly pretty good and yes the openwrt and dd-wrt software is better.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#26

Post by railsisfails » Wed, May 20, 2015, 4:11 PM UTC

seiji wrote: post #19

userbinator wrote: post #5

The client can specify the length of the computer name. By specifying a name longer than 64 characters What sort of programmer writes code to handle a protocol with a length field and yet uses a fixed-size buffer without ever considering the possibility of what would happen if it could be larger than the buffer...? I've seen plenty of source code out there, written for educational/example purposes, where arrays to ho…

> What sort of programmer I know we like to think all programmers are the best and brightest and most talented citizens of the entire world, but the truth is: most programmers have the dedication of fast food workers and as long as "it works for me," they'll ship it. The projects people here are used to (modular, decomposed, open source, documented) are rare . The world is full of multi-million line code bases with l…

At least they stick with one tech longer than five minutes. The ADD-riddled folk that sometimes post on here, changing their tech stack based on the newness in milliseconds of the latest craptastic JS framework is astounding.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#27

Post by seiji » Wed, May 20, 2015, 4:17 PM UTC

railsisfails wrote: post #26

seiji wrote: post #19

Earlier quoted context omitted.

> What sort of programmer I know we like to think all programmers are the best and brightest and most talented citizens of the entire world, but the truth is: most programmers have the dedication of fast food workers and as long as "it works for me," they'll ship it. The projects people here are used to (modular, decomposed, open source, documented) are rare . The world is full of multi-million line code bases with l…

At least they stick with one tech longer than five minutes. The ADD-riddled folk that sometimes post on here, changing their tech stack based on the newness in milliseconds of the latest craptastic JS framework is astounding.

The kids have no cost of switching to something new because they probably don't know much already. As you get older, re-learning everything 6 months feels weird since any random 14 year old can know as much (or more) than you do about the new system. Your API-level experience gets invalidated rapidly, so it's almost better to start from scratch, which only the unknowing youths can do.

Then there's a whole "stake you claim" mentality. Want to be the best C person in the world? You can't. It's too wide spread. What to be the best Go person? Sure, fight that battle for your own glory since it's new and you can take part in everything.

Lack of education/experience also creates a great breeding ground for new, duplicate, half-implemented versions of things that already exist. The older a developer gets, the more they see things they already know re-implemented as completely new but with unfamiliar interfaces they'll have to re-learn again every 6 months. It's a huge waste of human capacity to always be "new new new" instead of creating a stable and reasonably extensible base to work from. But, at the same time, we don't want to be stuck on Perl 4 and CORBA forever.

There's a tradeoff between building new things for advancing the future versus building new things just because you think you're better than all the previous research/experience that has come before you. See the case of Cathedral v. Bazaar.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#28

Post by redwards510 » Wed, May 20, 2015, 4:24 PM UTC

pavel_lishin wrote: post #17

ansible wrote: post #14

Sigh.... I should probably replace my commercial-grade WiFi router with some custom box that can run OpenBSD or something. When I first got it, I tried to go through and lock down everything I could find. But I suspect that may not be enough.

I wonder how much it would cost to build a reasonable wifi router out of a raspberry pi, or something similar. If you could keep performance and consumer costs comparable, you could probably sell quite a few.

For $200 you can get something like this [1]. Low power Atom CPU, RAM, and two NICs included so you can throw pFSense + Snort on it easily. You can add a USB wifi dongle and make it an AP.

[1] http://www.amazon.com/dp/B008KB5YCK/ref=wl_it_dp_o_pC_nS_ttl...

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#29

Post by ISL » Wed, May 20, 2015, 5:04 PM UTC

seiji wrote: post #19

userbinator wrote: post #5

The client can specify the length of the computer name. By specifying a name longer than 64 characters What sort of programmer writes code to handle a protocol with a length field and yet uses a fixed-size buffer without ever considering the possibility of what would happen if it could be larger than the buffer...? I've seen plenty of source code out there, written for educational/example purposes, where arrays to ho…

> What sort of programmer I know we like to think all programmers are the best and brightest and most talented citizens of the entire world, but the truth is: most programmers have the dedication of fast food workers and as long as "it works for me," they'll ship it. The projects people here are used to (modular, decomposed, open source, documented) are rare . The world is full of multi-million line code bases with l…

"Works for me" isn't the only reason to ship imperfect code. Time-to-market really matters in some applications. "Move fast and break things" is a motto for a reason.

The router companies shipping NetUSB routers are meeting a market need; people want to plug printers into routers and print from anywhere on their network. For many users and applications, low-quality code will work.

It's in the long term that high-quality work differentiates itself.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#30

Post by snowwrestler » Wed, May 20, 2015, 5:12 PM UTC

> While NetUSB was not accessible from the internet on the devices we own, there is some indication that a few devices expose TCP port 20005 to the internet.

This is a very important caveat that seems to be a bit buried in the article. If this service is not exposed to the Internet, an attacker would have to be on your local network to exploit the vulnerability--either authenticated into your WiFi, or already resident on one of your devices (through a previous exploit). Both are fairly high hurdles if you encrypt your WiFi.

Coffee shops etc. that run open consumer-grade WiFi access points could be vulnerable to this. Exploiting that router would provide bad guys with a platform to harvest or attack traffic from all the computers that connect to that router.

If your device does expose this service to the Internet, then any script traversing known consumer ISP netblocks could try to hit it. So that is worth nailing down.