Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NetUSB Impacts the Security of Millions of Devices Worldwide

blog.sec-consult.com

Post reply on HN
Print view View original

31–40 of 43 posts

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#31

Post by seiji »

ISL wrote: post #29
seiji wrote: post #19

Earlier quoted context omitted.

> What sort of programmer I know we like to think all programmers are the best and brightest and most talented citizens of the entire world, but the truth is: most programmers have the dedication of fast food workers and as long as "it works for me," they'll ship it. The projects people here are used to (modular, decomposed, open source, documented) are rare . The world is full of multi-million line code bases with l…

"Works for me" isn't the only reason to ship imperfect code. Time-to-market really matters in some applications. "Move fast and break things" is a motto for a reason. The router companies shipping NetUSB routers are meeting a market need; people want to plug printers into routers and print from anywhere on their network. For many users and applications, low-quality code will work. It's in the long term that high-qual…

> For many users and applications, low-quality code will work.

Oh, don't pretend "quality" is just a proxy for "has pretty animations and makes the user feel warm and fuzzy."

The failure to ensure "quality" of this embedded router component has put millions of never-going-to-be-updated hardware devices in the wild at risk of 3rd party takeover, personal information leakage, installing proxies on them to send user details to hostile actors (monetary losses, blackmail), ....

Programming errors shouldn't be excused just because we always say "whoops! we'll do better next time!" But, since humans are objectively bad at something as complex as programming, we can't hold people accountable (who wrote it? an intern from 8 years ago? punishing them does no good). We can't hold organizations accountable (recall all the consumer routers!) because public policy doesn't think that way.

We're in a weird period of history where companies can get away with great computational damage with no repercussions at all. The market currently _does_ favor "just do whatever and try to fix it later (or not, whatever)," but that doesn't make it right.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#32

Post by timtadh »

ansible wrote: post #14

Sigh.... I should probably replace my commercial-grade WiFi router with some custom box that can run OpenBSD or something. When I first got it, I tried to go through and lock down everything I could find. But I suspect that may not be enough.

I had a great experience putting something together using an ALIX 6f2 (http://www.pcengines.ch/alix6f2.htm) which I bought via a Netgate kit with enclosure (http://store.netgate.com/Network-Computers-C2.aspx). Netgate isn't selling that one but is selling other boards which you can put together something similar. The APU line looks really interesting.

The cool thing about the ALIX and APU boards is they often support buying things like 3g modem cards which you can use to multi-home your connections with pfSense. You could also create an SMS gateway or similar service.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#33

Post by codygman »

nine_k wrote: post #12
[deleted] wrote: post #8

Earlier quoted context omitted.

[deleted]

We do that because existing more expressive tools (like Haskell and ML) are not very well suited for low-level work, and Rust has just released a first stable version. I suppose that C++ could be expressive enough to rule out such things, and even C can successfully avoid these pitfalls, but both require much more discipline and time to achieve this. What would you use for that kind of code 5 years ago? The code in q…

I personally wish ATS[0] would gain more mindshare.

0: http://www.ats-lang.org/

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#34

Post by MichaelGG »

rednovae wrote: post #7
DEinspanjer wrote: post #6

I can't tell if the response from NETGEAR is just sensationalized and they are actually working on firmware updates that will fix the flaw or at least allow firewalling or disabling the feature. I would hope they don't think that "it can't be fixed" is actually an acceptable long term answer.

I have reported vulns to NetGear before. They don't have any sort of security department, nor a method to handle vulnerability reports. I have no idea what the truth actually is, but my experience would lead me to believe worst case.

I know it's illegal, but it'd be eye opening to worm these machines, then have them inject a banner sometimes, to alert the user. I suppose that's an ethics question overall. I know many exploits that can and are being used for financial gain. [1] The vendors respond very poorly (lying or getting angry at me). Companies and customers are at risk. But no one cares. Unless a major incident occurred...

1: One expensive (8 digit) system that was targeted at multi tenant setups used Java for the UI. Annoying but OK. But, how did the Java app determine your login privileges? Oh, easy! The app would download the root credentials for the system, use them to login to MySQL over the Internet, then "SELECT Permissions from user where...".

I met the developers and their response was " yes that's a known issue in the current version ". Ignoring that many users were stuck on that version for a long time. For bonus points, this system logged the root credentials to debug log, in the user's home directory. I'll let you guess if their updated version was vulnerable as all hell, too.

Edit: This was a major VoIP switch vendor (NexTone, now killed/bought by Genband IIRC), so exploits were easily turned into money. (Just route traffic on someone else's trunk for a bit.) Though I've dealt with other VoIP providers, ones that keep much more info (full end user info, CALEA module available) that had SQL injection-> root takeover on the login page. That puts end users at risk, too. Their response? " Our programmers are top notch C/C++ guys, they just aren't perfectly familiar with PHP... "

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#35

Post by cmavr8 »

ansible wrote: post #14

Sigh.... I should probably replace my commercial-grade WiFi router with some custom box that can run OpenBSD or something. When I first got it, I tried to go through and lock down everything I could find. But I suspect that may not be enough.

Why not run DD-WRT? It is frequently buggy (performance wise) but should be fixable.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#37

Post by userbinator »

cnvogel wrote: post #11
userbinator wrote: post #5

The client can specify the length of the computer name. By specifying a name longer than 64 characters What sort of programmer writes code to handle a protocol with a length field and yet uses a fixed-size buffer without ever considering the possibility of what would happen if it could be larger than the buffer...? I've seen plenty of source code out there, written for educational/example purposes, where arrays to ho…

> What sort of programmer writes code to The sort of programmer who's not passionate about how the code looks, or works, as long as it passes the (very rudimentary) tests which don't cover protocol violations or borderline cases. The sort of programmer that didn't have any experience and directly went from Sandbox-Java to bare-metal kernel-code in his first project? I don't want to disillusion you, but I know plenty…

I don't want to disillusion you, but I know plenty of people with (at least part-time) programming jobs who don't care at all about all the new programming paradigms, programming languages, libraries, frameworks... boasted often here on HN. I'd say that a huge majority is pretty pleased with what they know, as long as it's enough to do the job.

Actually I'd consider myself in that group; most of my work is in Asm and C, with some C++, sometimes Java, and very occasionally do I do anything with Web technologies.

The difference, however, is that I do consider all possible inputs, think about how much space things take up, and generally try to cover the problem space. If there is a variable-length field, there will be a statement in the documentation/requirements which states any length restrictions, and what happens if that length is exceeded.

The sort of programmer that didn't have any experience and directly went from Sandbox-Java to bare-metal kernel-code in his first project?

I think this has much to do with it - those starting with HLLs that cover them with a safety net, letting them do stupid things without all that much consequence, may not develop the same type of thinking; but, even if this was written in something like Java, a Nullpo or IOOBE is unacceptable, and perhaps they would just patch in code to catch the exception and ignore it, not giving this case the proper thought it deserves.

To put it a bit more bluntly: when you're writing in Asm on a machine running DOS, and any bug is probably going to make you reboot, you quickly tire of hitting the reset button and learn to think more carefully about what you write. Although I've migrated from such an environment a long time ago, the habit has stuck.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#38

Post by tracker1 »

Well, just put a 1* review and reference to the article for every Netgear router with a USB port on amazon that I could find... Since they "can't" fix it... afaik they refuse to fix it. It isn't like it's impossible to limit access to internal ports. Difficult, maybe, costly, maybe... just limiting to currently/recently shipping devices would be better than nothing.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#39

Post by tracker1 »

ansible wrote: post #14

Sigh.... I should probably replace my commercial-grade WiFi router with some custom box that can run OpenBSD or something. When I first got it, I tried to go through and lock down everything I could find. But I suspect that may not be enough.

I really liked my older RouterStation Pro box... I even have a backup one new in the box... though I didn't add any wifi to the router itself.

Re: NetUSB Impacts the Security of Millions of Devices Worldwide

#40

Post by userbinator »

seiji wrote: post #31
ISL wrote: post #29

Earlier quoted context omitted.

"Works for me" isn't the only reason to ship imperfect code. Time-to-market really matters in some applications. "Move fast and break things" is a motto for a reason. The router companies shipping NetUSB routers are meeting a market need; people want to plug printers into routers and print from anywhere on their network. For many users and applications, low-quality code will work. It's in the long term that high-qual…

> For many users and applications, low-quality code will work. Oh, don't pretend "quality" is just a proxy for "has pretty animations and makes the user feel warm and fuzzy." The failure to ensure "quality" of this embedded router component has put millions of never-going-to-be-updated hardware devices in the wild at risk of 3rd party takeover, personal information leakage, installing proxies on them to send user det…

we can't hold people accountable (who wrote it? an intern from 8 years ago? punishing them does no good). We can't hold organizations accountable (recall all the consumer routers!) because public policy doesn't think that way.

Contrast that with the completely different approach taken by the aerospace industry, where people and organisations are held accountable; and it has resulted in great reliability overall --- interesting discussion about that here:

https://news.ycombinator.com/item?id=9569077

We're in a weird period of history where companies can get away with great computational damage with no repercussions at all

In critical software for a plane it is literally a matter of life or death, and people are willing to pay much more for that level of quality; but if a consumer router gets exploited, what's the worse that could happen?

I think it is important to put the risk into perspective: this is bad, but it's not really a people could get killed sort of thing.

Post reply on HN