Routers Pose Biggest Security Threat To Home Networks 264
Nerval's Lobster writes "The remote-access management flaw that allowed TheMoon worm to thrive on Linksys routers is far from the only vulnerability in that particular brand of hardware, though it might be simpler to call all home-based wireless routers gaping holes of insecurity than to list all the flaws in those of just one vendor. An even longer list of Linksys (and Cisco and Netgear) routers were identified in January as having a backdoor built into the original versions of their firmware in 2005 and never taken out. Serious as those flaws are, they don't compare to the list of vulnerabilities resulting from an impossibly complex mesh of sophisticated network services that make nearly every router aimed at homes or small offices an easy target for attack, according to network-security penetration- and testing services. For example, wireless routers (especially home routers owned by technically challenged consumers) are riddled with security holes stemming from design goals that emphasize usability over security, which often puts consumers at risk from malware or attacks on devices they don't know how to monitor, but through which flow all their personal and financial information via links to online banking, entertainment, credit cards and even direct connections to their work networks, according to a condemnation of the Home Network Administration Protocol from Tenable Network Security. Meanwhile, a January 2013 study from Rapid7 found 40 million to 50 million network-enabled devices, including nearly all home routers, were vulnerable to exploits using UPnP. Is there any way to fix this target-rich environment?"
If only there were an easily upgradeable open source router operating system to which vendors could add support for their hardware leaving long term maintenance to a larger community.
dd-wrt?? (Score:5, Informative)
Re:dd-wrt?? (Score:5, Informative)
DD-WRT is based on the open source OpenWRT, but DD-WRT itself is proprietary.
Re:dd-wrt?? (Score:5, Informative)
Re: (Score:2)
If you have a home router, is it protected if it is behind the router built into many DSL or Cable modems? Your ISP may be protecting your firewall router by placing it behind another firewall router in your modem.
A quick test to see if this may apply to you. view your router's status page and look at the IP address of the WAN connection. If the WAN connection is a 196.168.x.x number then your modem has a router too. Has anyone pen tested your modem router?
Re: (Score:3)
Also, you most certainly meant "192.168...". 196.168.x.x are public IP addresses. If a carrier were to use private IP space, they'd be much more likely to use 10. addresses.
Re:dd-wrt?? (Score:5, Insightful)
Re: (Score:3)
Re:dd-wrt?? (Score:5, Interesting)
First you have to find the right build of DD-WRT. This involves totally ignoring the router database, which, as one person's website put it, is either massively out of date at best, and *WRONG* at worst, liable to brick your router.
And if you join the support forum, you discover people talking about their "favorite" builds, something in over 30 years in the field I've *NEVER* heard of. And they don't have formal releases, and regression tests seem to be mostly dependent upon the lead developers.
Two months of fighting this, and debricking my router 2? 3? times, and I found one that did what I needed (that was to actually serve as a print server for a USB printer, as well as routing).. I have no idea how, or if, I'll be able to upgrade.....
mark, sr. sysadmin, Linux/Unix
Re: (Score:2)
Two months of fighting this, and debricking my router 2? 3? times, and I found one that did what I needed (that was to actually serve as a print server for a USB printer, as well as routing).. I have no idea how, or if, I'll be able to upgrade.....
mark, sr. sysadmin, Linux/Unix
Just FYI. If you can "debrick" something, than it's not bricked.
Re:dd-wrt?? (Score:4, Interesting)
DD WRT has a history of GPL violations, so anyone who's cool doesn't use it!
Is it really any better? (Score:4, Interesting)
This is an honest question.
Is there any penetration testing or statistics that suggests that dd-wrt and the likes are more secure, or is this an it-runs-Linux-so-it-must-be-good knee-jerk assumption?
I used to run dd-wrt on a router some years ago and liked it feature-wise and performance-wise. However, my confidence in its security took a pretty big hit when I read about this gaping security hole [cxsecurity.com] in 2009. It's the kind of issue that makes you doubt that some of the developers really know what they are doing.
Has any work been done on.. (Score:5, Interesting)
Pentesting the custom firmwares from projects like OpenWRT/DD-WRT/Tomato etc?
PFsense (Score:5, Informative)
I have PFSense running on a virtual server, which I recommend to anyone. Perhaps not on the virtual server... it kind of adds a layer of complication that most people probably wouldn't care for, but it works well enough.
http://www.pfsense.org/ [pfsense.org]
Hopefully no huge flaw comes out on that without me noticing. That would be embarrassing.
Re:PFsense (Score:4, Interesting)
I really liked pfSense but when I used it long ago it was very buggy. It may be time for me to give it another try. However, if you're familiar with the Cisco IOS CLI, Vyatta is another solution. I plan to set up a small low power box to be my router and only use my Linksys Router/AP combo (flashed with DD-WRT) as an access point. It gives you far more options in terms of management, and if you happen to seed a lot of Linux ISOs you don't have to worry about filling up the memory with the routing table.
Re: (Score:3)
I highly recommend the Ubiquiti EdgeMax Router lite. It's 99 bucks and runs a variant of Vyatta. Great little product.
Re: (Score:2)
Thanks, I may look into this. It'll be cheaper less expensive than the one I had originally spec'd out on Newegg.
Re: (Score:3)
If I remember correctly, I tried Vyatta, and because I don't know IOS, I flamed out trying to configure it.
PFSense was only marginally more difficult than OpenWRT, so it kind of suited my level of expertise.
With it being on a VM, it means that I have one box that is my router, file server, media server, and experimentation box all in one, which is convenient for me.
It does mean that the hypervisor is - in theory - exposed to the net, but since it never communicates externally except through the router softw
Re: (Score:2)
There's a learning curve with Vyatta but once you catch on it's pretty easy. There's also plenty of guides online that'll get you started and a very friendly community.
I didn't like the web interface of pfSense, and at the time of using it I was still pretty green with the Linux CLI so using that wasn't as much of an option. From what I can see there have been improvements, plus it's also been 7~ years since I used it, so I might give it a shot in a VM.
Re:PFsense (Score:4, Interesting)
Yeah, I've been running that stuff for years after getting frustrated with commercial routers. Has been extremely stable.
Of course, being lazy I got it in appliance form from this place:
http://www.applianceshop.eu/in... [applianceshop.eu]
"Hopefully no huge flaw comes out on that without me noticing. That would be embarrassing."
Ultimately it's a matter of (perhaps misguided) trust...
Re:PFsense (Score:5, Informative)
I second that. PFSense is rock solid and comes with a lot of features. Dual wan, vpn, you name it.
Just as lazy... also got mine from applianceshop.eu.
opensource firmwares not perfect either (Score:2, Interesting)
I bet everyone is busy writing smug comments about closed source firmwares, but let's not forget that DD-WRT have had a similar bug. http://www.xtremesystems.org/forums/showthread.php?230880-Massive-DD-WRT-Security-Hole-%28Unauthenticated-Root-Control-Possible%29
Re:opensource firmwares not perfect either (Score:5, Insightful)
The important difference being that bug was fixed, as opposed to being left wide open forevermore.
Re:opensource firmwares not perfect either (Score:5, Insightful)
In fact, it was even fixed for devices which are no longer in production with no need for the original vendor to even still be in business. Open source is funny that way.
Why I buy apple airports (Score:5, Interesting)
I don't actually know if it matters or not but I prefer Apple over other wireless routers because it's so damn braindead easy to keep them patched. Apple just pushes out firmware updates (rarely). Every other router I've owned it was a struggle to figure out if it needed a patch, how to do it. Moreover it was a source of worry even when there wasn't a problem which alone was worth any relatively small cost differential.
Re:Why I buy apple airports (Score:4, Funny)
[NO CARRIER]
Re:Why I buy apple airports (Score:5, Insightful)
Re: (Score:2)
It's a terrible strategy for any technical person. New bugs can be introduced. For a techie type, being able to test out new updates prior to rolling them into production is a must.
Re: (Score:2)
Re: (Score:2)
You realize, of course, that you don't have to update. It just notifies you. I like that little feature of the Apple routers (and OS X and iOS). Given that Apple, like every other vendor on this planet at least, pushes out updates that occasionally break things (Hi Microsoft!), I don't upgrade the moment the patch is available. I wait a week or so unless there is some overwhelming reason like some nasty exploit.
Yes, it's not perfect. No, nobody is perfect. As has been mentioned on this thread and coun
Sigh - what the heck ... (Score:3, Informative)
I feel that all those links to WRT/PFSense/M0N0Wall/Tomato/etc are kind of redundant.
Sufficient to understand, that the underlying concept of UPnP is an abomination; a sick and distorted concept that deserves nothing less than an immediate death sentence, and to be buried along with The Funniest Joke In The World; never to be resurrected again.
Re:Sigh - what the heck ... (Score:4, Insightful)
Sufficient to understand, that the underlying concept of UPnP is an abomination; a sick and distorted concept that deserves nothing less than an immediate death sentence, and to be buried along with The Funniest Joke In The World; never to be resurrected again.
So how do you propose that my game on a machine on NAT arranges to receive UDP through the firewall? I'm supposed to manually configure firewall rules for each game? And then change them all if my IP changes?
Re:Sigh - what the heck ... (Score:4, Informative)
Re:Sigh - what the heck ... (Score:4, Funny)
Re:Sigh - what the heck ... (Score:5, Insightful)
Incentive to pressure your ISP to support a well over a decade old technology, going on two decades.
I have no viable alternatives. The ISP I'm using now is the best of three shitty options. I live in the USA, did you think I lived in the first world or something?
Re: (Score:2)
Re:Sigh - what the heck ... (Score:4, Informative)
Got to love competition mandated by law.
In my area, 15 minutes from the closest city which has about 60.000 inhabitants, I have about 20 providers competing on fiber, cable and copper. You can also toss in a few 4g providers that sell broadband you can carry around. :) /62 ipv6 prefix.
I settled for fiber 100/100 with tv and phone for $100 a month. It's not the cheapest, but I'm hooked on the speed
They also provide ipv6 and "bridge mode routers" with a fixed ipv4 address for my own router and a
We used to have a public telephone company called Telenor, but after it became private it came with the catch that all competitors can buy capacity from them at cost + investment write-offs. It's been working wonders.
Re: (Score:3, Funny)
Re: (Score:3)
Then you won't have to worry because you won't have time to play your game...
Nah. You've just changed the game you're playing.
XD
I'm not sure how you win "iptables", but I'm not real sure how you win a lot of the games out there, so it's probably similar.
Re:Sigh - what the heck ... (Score:4, Informative)
So how do you propose that my game on a machine on NAT arranges to receive UDP through the firewall?
So go for convenience over security. But don't then complain when you install VNC on your PC and it automatically opens a port allowing everyone on the Internet to access it, and you didn't bother to set a password so your PC is now pwned by the first script kiddy who scans your router.
UPnP is simply insane from a security standpoint. Random applications should not be opening random ports without explicit permission.
Re:Sigh - what the heck ... (Score:5, Insightful)
Mod parent up. UPnP is insecure by design. It's very purpose is to take security and control out of the hands of the user, and put it squarely in the hands of whatever happens to be running on your network.
It's too bad that most people don't understand enough about network security to configure their own router, and a double shame that the kludge we call NAT has further broken network applications, but convenient "workarounds" like UPnP could only ever lead to problems like the summary lays out.
Re: (Score:2)
So go for convenience over security. But don't then complain when you install VNC on your PC and it automatically opens a port allowing everyone on the Internet to access it, and you didn't bother to set a password so your PC is now pwned by the first script kiddy who scans your router.
You don't know me very well. If I am to remote into Windows I use RDP, and if I permit it at all it's only to the local network. And for all my statements that network transparency is irrelevant to most X users, if I want to remote Unix, I'll use an ssh tunnel. Sure, uPnP is a minefield for novices. But for me, it's immensely useful. Also, on Windows XP or later, VNC won't just magically open up your machine. Windows will ask you if you want to permit network connections to VNC, and it's up to you to decide
Re: (Score:2)
While your logic looks okay at a first glance, it doesn't at a second.
When a government has thousands of enraged citizens running towards the government building to set those on fire and loot them, some machine guns might be the means of choice. Though it ought to have been considered by the government du jour, what the reaction of the public will be, with the introduction of strict austerity measures, as well as jus primae noctis?
There is no fundamental reason, really, to have 1000 games opening 1000 diffe
Re: (Score:2)
There is no fundamental reason, really, to have 1000 games opening 1000 different ports for endless protocols on a home router.
In a perfect world, all of those games would communicate using the best possible protocol, and all communications would be cleared through a central facility. Problem is, "best" can be defined in many ways. Thus, we have all games using the same underlying protocol, but then building protocol on top of protocol in order to carry out their communications in the way that makes the most sense to the developers (or whoever drew up the architecture at the time, which might have been a schizophrenic hive-mind of
Re: (Score:2)
Suffice it to say, most games don't need UP
Re: (Score:2)
NAT should allow the packets, if you send packets (Score:2)
NAT should setup a rule to allow your machine to get packets as long as you send some packets there first. Unless your game machine is acting as a game server and getting packets from many host, it should just work. Otherwise, you could/should setup a port forward to your internal machine.
How does application programming fit in? (Score:3)
I think that programmers are going to assume they can talk to the remote host, and then timeout/fallback when that communication fails to take place correctly. If you are going to connect to a server either with tcp or udp, you are going to do a gethostbyname and then send a packet. The NAT appliance is going to see the packets and set up its translation table so that outgoing packets get re-written with the correct source address/port. And the incoming packets from the dest/port are going to get re-w
Re: (Score:3)
Configuring port forwarding is trivial on virtually any firewall, so yes, that's what you need to do if you want security.
Re: (Score:2)
Some games can do NAT hole punching.
Re: (Score:3)
Use static DHCP on your DHCP server and a UDP port forward. Your IP won't change (due to static DHCP which always gives the same IP address to a given Ethernet address) so it should never need to be updated. This is pretty straight forward with Tomato firmware.
Re: (Score:2)
What is the problem with UPnp??? From what I understand, UPnP works like this:
1) All devices inside the local network are considered "trusted"
2) Trusted devices can poke holes in the firewall pointing only back to themselves.
Assuming that UPnP is implemented properly, and assuming that an attacker is on the outside of the local network, there is nothing for an attacker to grab on to. Now, if an attacker is on the INSIDE of your LAN, then you are already boned.
What am I missing?
Re:Sigh - what the heck ... (Score:5, Informative)
What am I missing?
Again, used to be that the most common way for a Ubuntu machine to get pwned was for the user to install VNC with UPnP enabled. They only wanted to connect over their LAN, but VNC went and opened a UPnP port, and... oops.
Every new port opened on the router is a potential new security hole.
Re: (Score:2)
Ahhhhh. That make sense. Thanks.
Re:Sigh - what the heck ... (Score:5, Insightful)
What is the problem with UPnp??
All devices inside the local network are considered "trusted"
I really think you just answered your own question there.
Re: (Score:2)
Re: (Score:2)
if an attacker is on the INSIDE of your LAN, then you are already boned.
What am I missing?
There are varying degrees of boned. UPnP lets the black hat turn a small exploit into a big one.
Assuming that UPnP is implemented properly
Well yes, there's that too. [grc.com]
What it's not about (Score:5, Insightful)
Yes, this is /. We can upgrade our router firmware or install other firmware. Joe Sixpack cannot.
The blame for this should be laid squarely at the feet of the router manufacturers. IMHO, here's what Linksys/Cisco/Netgear/etc/etc/etc/ should do, at the very least:
1. Be open and forthcoming about bugs found in their router software
2. By default, routers should ship with automatic firmware updates enabled. This should be difficult to disable and robust enough that it'll *just work* with no user intervention.
3. Tell this to their customers in plain English or $localLanguage on the product packaging. And NOT in fine print. Make it very obviously noticeable to the purchaser. This can and should be a signifiant selling point, really. If I'm at BestBuy/WalMart/etc. and see one router boldly telling me "We care about your security! To protect you and your data, this router will check weekly with $manufacturer and update itself to give you the most secure Internet experience possible." And it's sitting next to another router that says no such thing, I'd buy the one that will keep me safe.
Re:What it's not about (Score:5, Insightful)
By default, routers should ship with automatic firmware updates enabled. This should be difficult to disable and robust enough that it'll *just work* with no user intervention.
The problem is that this kind of automatic update process can be a security hole in and of itself. If there is a way for a remote system to send updates to the router's firmware, then there is the potential for a malicious user to spoof the update and send their own custom-crafted exploit code.
Re:What it's not about (Score:4, Insightful)
The problem is that this kind of automatic update process can be a security hole in and of itself. If there is a way for a remote system to send updates to the router's firmware, then there is the potential for a malicious user to spoof the update and send their own custom-crafted exploit code.
Sure, that's why you sign your updates with decent (open source!) cryptography and embed your public key into the router's firmware.
Re: (Score:2)
Sure, that's why you sign your updates with decent (open source!) cryptography and embed your public key into the router's firmware.
Yes, but if the people writing the factory firmware were that competent, routers wouldn't need updates every week to remain secure.
How many show-stopper bugs are found in the open source firmwares? How many in firewalls like m0n0wall [m0n0.ch]?
The underlying problem is that 99% of electronics firmware is crap. This isn't limited to routers – the hardware design is usually the pri
Re: (Score:2)
The blame for this should be laid squarely at the feet of the router manufacturers.
Ok, what good is that going to do? So a bunch of people get their home routers hacked, and you point the finger at the router mfgrs. Why should they care? What are you going to do about it? Declare that you're not going to buy from them any more? Haha, like they care; their customer base isn't Slashdot users, it's regular Joe Schmoes who don't read Slashdot or tech news, and just buy whatever the Best Buy salesman or Com
Re: (Score:3)
Let us know how that works out. [slashdot.org]
Re: (Score:2)
That's right. Installing an OpenWRT release made for a D-Link DIR 825 on a Linksys E3200 would be a bad thing. So would installing the official D-Link firmware.
If both manufacturers were to produce updates their own hardware, instead of kicking a device to the curb and then never releasing an update again until they receive a court order requiring them to, then this wouldn't be a problem.
Re: (Score:3)
If both manufacturers were to produce updates their own hardware, instead of kicking a device to the curb and then never releasing an update again until they receive a court order requiring them to, then this wouldn't be a problem.
And if ethereal unicorns would shit gold bricks in my back yard, I'd be able to buy a new car.
But out here in the real world, routers are commodity appliances with a support lifetime measured in months, and you certainly can't sanely expect vendors to kneecap their cashflows by
Re: (Score:2)
The other things manufacturers need to do is quit releasing "FooRouter 300N-xpyvbei83qr-100.1-a" and "FooRouter 300N-xpyvbei83qr-100.2-a" with completely different and incompatible hardware.
I read the headline as: (Score:2)
"Reuters Pose Biggest Security Threat To Home Networks"
Re: (Score:2)
I did my time in end-user support. I've been the one that's has to explain to Granny that she doesn't need to panic every time sees a new horror story on the news.
Reuters may not be the biggest security threat, but they're certainly one of the biggest threats to sanity.
Re: (Score:2)
"Reuters Pose Biggest Security Threat To Home Networks"
Problem is that they also are the biggest boon to computer security since the network was invented. I look back with less than fond memories of having my mother's windows box connected directly to the internet w/o any kind of firewall or even a NAT between her and the wild west. Oh those where the days!
I'd much rather have even a flawed router between her machine and the bad guys. Even if they can compromise the router, that's at least one more step they have to go though, making her lowly Windows' box
Re: (Score:3)
That's why I resisted as long as I could... (Score:2)
Re: (Score:2)
Which is one of the reasons that I treat wireless networks as hostile in my home, and you have to log in via VPN even if you're connected to my wireless.
It's not hard. If you don't trust wireless, and you don't trust the Internet, treat them as the same thing.
I've gamed and accessed my home network using OpenVPN on every client (over wireless and remote) for as long as I've had wireless. No extra ping on any half-decent hardware, utter security and who cares if - as in my case - WEP is flawed and then rep
Re: (Score:2)
You sound totally paranoid. If you want to be quite reasonably secure and have WiFi, all you have to do is make sure you're using WPA2 encryption. Better yet, make sure you're using an alternative firmware like OpenWRT or DD-WRT, and keep WPS and uPnP off no matter what you use.
I don't think I've even heard of someone getting their WiFi hacked when WPA or WPA2 was being used; people only get their home WiFi "hacked" when they either use no security whatsoever, or WEP (WEP is trivial to hack). And even th
Re: (Score:2)
Paranoid much? (Score:2)
Don't forget to hard disable the microphone on the laptop if it has one. There is a malware that can communicate using high frequency sound, from a networked machine to un-networked one.
I think that is about as likely as getting molested by a unicorn.
Seriously folks, I'm all for reasonable amounts of security but this sort of thing is just hide under the bed paranoia.
Re: (Score:3)
Meanwhile 70 million credit card numbers were stolen from Target.
design goals that emphasize usability over securit (Score:2)
design goals that emphasize usability over security
I wonder why usability was able to sell more than security? Hmm. Let's think about that.
Meanwhile, a January 2013 study from Rapid7 found 40 million to 50 million network-enabled devices, including nearly all home routers, were vulnerable to exploits using UPnP.
Man, and I can't get my home router to do UPnP. It's bad that UPnP allows for the configuration of the router to come from a machine outside of the network, but that should get fixed and UPnP should be able to start behaving like it is designed to.
Re: (Score:2)
Man, and I can't get my home router to do UPnP. It's bad that UPnP allows for the configuration of the router to come from a machine outside of the network, but that should get fixed and UPnP should be able to start behaving like it is designed to.
Considering UPnP is broken by design, that's not really an improvement. Replacing a security hole in the router by a hundred apps that want their own ports to expose their own security holes to the Internet doesn't help much.
Sadly, no . . . (Score:2)
Custom Router (Score:5, Interesting)
I have replaced it with a small Debian box with dual NICS, and bought a 24port switch from TPLINK. It was the best decision I have ever made. Perfect reliability, complete control, via IPTABLES. I've got auto blocking of malicious ips trying to hit my ssh or port scanning me via DenyHosts and PSAD.
A couple other custom scripts and DNSMASQ, dhclient, snort, and python, and I have all the other services and features I want, and ONLY the services and features I want.
OpenWrt? (Score:2)
Forgive me if I'm wrong, but wasn't OpenWrt based on this same firmware? Or is this bug with the VxWorks-based firmware that Linksys later switched to?
Re: (Score:2)
Forgive me if I'm wrong, but wasn't OpenWrt based on this same firmware? Or is this bug with the VxWorks-based firmware that Linksys later switched to?
OpenWRT is a Linux distribution designed for routers. It often uses kernel modules provided by manufacturers such as Linksys, but is not a clone of the entire system.
You could also follow the first link in the summary [sans.edu], which describes the bug and has this to say:
"Only routers running stock firmware are vulnerable. OpenWRT is not vulnerable to this issue."
A big hole is the default password (Score:3)
The default password, when it is the same default password across all units of the same model or even the same manufacturer, is easy to exploit. Any website can send the user's browser some code that instructs it to attempt to log in via the user's router's web interface with the default password. It works because the user's browser is behind the firewall and therefore "trusted". Once logged in, it's trivial to reconfigure the router to open up all kinds of holes. Harder but still doable is getting the router to host and run malware itself.
The admin password is the first thing I change on a new router. Manufacturers who still don't individualize the factory set password are responsible for a lot of these problems.
Re: (Score:2)
Re: (Score:2)
Isn't that all of them? I'd love to know which manufacturers (if any) actually individualize the passwords.
Re: (Score:2)
Re: (Score:2)
Even better, print it in one location, then hot-stamp it into the plastic of the router's case, filling the indentation left by the letters with an self-curing epoxy (so the stamped password doesn't wear away over time). It won't be 100%, but at least if the sticker wears off, the password is still present. Another way is to have a sticker, then a metal tag that gets stamped by a press, and is attached securely in a recessed place on the case (so if the glue fails over time, the tag doesn't fall off.)
Even
Re: (Score:2)
Print the default password on the router's bottom side, or make it the serial number of the device (which then has to be different than the WAN MAC address).
Which is exactly what our router manufacturer did. Don't remember who makes it, I think it's rebranded with the ISP's logo anyway.
If only... (Score:2)
If only there were an easily upgradeable open source router operating system to which vendors could add support for their hardware leaving long term maintenance to a larger community.
If only it supported routers with built-in ADSL (which was the dealbreaker last time I looked at DD-WRT - and it took me some digging to discover that was why none of the routers I wanted to use it on).
If that's since been fixed - and supports a router I can actually buy somewhere - then mod me happy.
Personally, I could put together a low-power Linux box, get an ADSL modem, an ethernet switch, wireless access point (sounds like Belinksysco crap would be just as big a liability in WAP-only or modem-only mo
But Routers are good things! (Score:5, Insightful)
So this article is saying that routers are *bad* things for security right? Not so fast...
In my view, having a router, even an imperfect one, between you and the internet is a *GOOD* thing for security. Yes, routers might be security risks, but NOT having them is even WORSE of a risk.
Does *anybody* out there remember what it used to be like? It wasn't that long ago that the standard internet connection was for ONE machine and used a PPP connection that pretty much put your Windows (mostly) box directly on the internet. When all this got started, we didn't even have software firewalls. Imagine having a windows 95 box with all the standard services on a routeable IP address. It WAS extremely risky. I remember having unsolicited popups coming up all the time and bothering me with all manner of advertisements. It was a mess and security was extremely lacking.
But then we have the dawn of consumer's using routers and doing all the same exploits became harder because of the NAT. Then routers added stateless firewalls, then state-full firewalls and closed many of the avenues used by the "bad guys" to gain control of your system.
Consumer grade routers have been a HUGE boon to network security in the consumer world. Do they have flaws? Many do, but their contribution to overall security is worth more to me than the risks they may pose. Give me a router, even a flawed one, over nothing. Making the bad guys work harder is a good thing for security, and a flawed router does that.
It's not that we shouldn't be discussing how routers should be made more secure. Obviously we want them to improve. It's just that we cannot loose sight of how far we've come BECAUSE of these things.
Re: (Score:2)
Re: (Score:2)
this is just wrong (Score:2)
the biggest security threat to computers is the user. users improperly configure things, wont take security precautions (like using weak passwords) and will outright download viruses/malware. far too many users are not competent enough to tell the difference of a real popup window and a website claiming they have a virus and they need to install their trojan horse immediately.
So, will a 2005-era routers get a firmware update? (Score:5, Insightful)
This is what scares me about the Internet of Things when it comes to long-life appliances that you could own/use for decades... How long will manufacturers (many of whom have 0 experience so far with connecting their products to anything but a power cable) continue to support these devices? Ultimately, government regulation may be required in this space. God knows I wouldn't want my IoT refrigerator to get "bricked" (a really heavy, big brick!) after 20 years because the manufacturer went under & the fridge couldn't phone home... Or worse, because someone found a backdoor that had been in place for all models in use for 9 years before my model was developed...
Re: (Score:2)
Re: (Score:2)
This sort of issue is why the Free Software Foundation was created. It wasn't because Stallman had some kind of political agenda, it's because he wanted to fix the driver for his printer, but couldn't because it was proprietary. The "Internet of Things" has the exact same problem, and the exact same solution.
My router (Score:2)
The fault of the device makers... (Score:4, Insightful)
there are options for more secure but they fight the hardware hackers instead of embracing them. If they would reach out to the communities and work with them or PAY these groups like OpenWRT to write their firmware they would end up with a better product.
Re:Wow... misconfigured devices are insecure? (Score:5, Insightful)
Re:Wow... misconfigured devices are insecure? (Score:5, Insightful)
Re: (Score:3)
Not only that, but the device primarily in charge of transporting data is the most likely point of entry for malicious data.
Who'da'thunk