Slashdot Mirror
D-Link DIR-655 Firmware 1.21 Hijacks Your Internet Connection
chronopunk writes "Normally when you think of firmware updates for a router you would expect security updates and bug fixes. Would you ever expect the company that makes the product to try and sell you a subscription for security software using its firmware as a salesperson? I recently ran into this myself when trying to troubleshoot my router. I noticed when trying to go to Google that my router was hijacking DNS and sent me to a website trying to sell me a software subscription. After upgrading your D-link DIR-655 router to the latest firmware you'll see that D-link does this, and calls the hijacking a 'feature.'"
Is this even legal? This is my device; if it does something I don't like, and can't disable it, that seems like an attack on my rights; to do it to sell ads... that's just low, D-Link!
Well, I for one welcome our new SUBSCRIPTION REQUIRED overlords!
Please click here to renew subscription!
Moved to http://soylentnews.org/. You are invited to join us too!
I've been using rev1.21 for a few weeks now and I haven't seen this behavior at all.
Wednesday, November 05, 2008 5:51:22 PM
Firmware Version : 1.21, 2008/09/11
*shrug*
Before installing the new firmware, are you asked if this is Okay? If not, do they make it clear how it can be disabled?
I am now reluctant to upgrade my DLink firmware. Is it's easy and clear that one can opt out.
Thank you so much for the warning! I'll stay on 1.20 then and my next router certainly won't be a D-link.
My other account has a 3-digit UID.
I helped my father-in-law purchase a wireless router for his home and set it up for him recently. I was rather surprised when I updated the firmware and was then greeted by spam upon opening a web browser. I have to say that I'm really disappointed by d-link on this one. Here's to hoping that the backlash is enough to make them reconsider doing this type of stuff again.
Generally speaking, I'm a fan of their networking equipment (own a dgl-4300 that I'm very happy with myself), but if this is the direction that they are going in, I won't be buying or recommending their stuff anymore. I plan on e-mailing them and telling them I am unhappy with their practices.
...as advertising an orange and switching it for a pair.
If you sell a router, that's all it should be. a router that rewrites DNS and routes wrong is...a paperweight.
Won't be buying any more Dell hardware for a while!
Check out my sci-fi book "Lacuna" at http://goo.gl/MVxX8
I haven't upgraded to 1.21; however, the reason was when 1.21 first dropped it had SecureSpot. Now I found this out by reading the information on 1.21 so I didn't download and install it. They now (and have for some time) offer 1.21 without SecureSpot; perhaps you should download and install that.
>You can disable this feature by logging into the router and clicking the Advanced Tab and Secure Spot on the left side.
>D-Link Customer Service
Unethical to enable it by default and not tell the customer about it *until* it hijacks the connection (if you ask me) but easily disabled apparently.
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
Hi Brandon, What you experienced was not an Attempt to "Hijack" your connection. In fact what it is an added feature called "Secure Spot", It is software that is built into the router, which is used to replace or work along with your firewall/Antivirus/Antispam software. It also provides more parental controls. This feature does require a subscription if you want to use it but it is entirely optional. This feature replaces a hardware device that we had that did the same tasks. The DSD-150. You can disable this feature by logging into the router and clicking the Advanced Tab and Secure Spot on the left side. D-Link Customer Service
So, you can turn it off. Not only that, but as of 9/30 there's a separate link at their firmware download page for the DIR-655 that says (in plain view, in a sensible spot): Click here for Firmware 1.21 WITHOUT SecureSpot 2.0
Should they have included that in a readme/changelog for the firmware? Maybe, but since they were all too happy to tell you how to turn it off, this really doesn't seem like a huge offense to me.
Conclusion? Non-story.
Plus, upgrading your firmware "just because". Why?
If you look under the revision history of the 1.21 firmware - there is a link to download the new firmware without Secure Spot 2.0. Just look for: "Click here for Firmware 1.21 WITHOUT SecureSpot 2.0" and click on that...
Great, now I'm going to have to clean all the crapware off my new computers AND my new routers. Maybe they'll make us pay extra for a spam-free router in the future.
SJW: Someone who has run out of real oppression, and has to fake it.
I have DIR-655 with fireware 1.21, and used it for several weeks, but I don't you the problem you described, I think you enabled this feature when you clicking around after you upgraded the firmware :)
Back in 2003 Belkin introduced a router that periodically redirected HTTP connections to advertise its own software:
Help! my Belkin router is spamming me
Some commentary:
Ease-of-use or marketing-driven sabotage: Does your hardware's software do only what you expect of it?
Here's an old article about Belkin doing a very similar thing:
Belkin, the consumer networking and connectivity firm, has promised customers a firmware upgrade to disable a controversial 'spamming' feature built into its routers.
As first reported on The Reg last week, the feature hijacks random HTTP requests every eight hours and redirects users to a page advertising Belkin's parental control software. There is an opt-out link but that failed to appease Net users who accused Belkin of creating a new mechanism for spam.
all your base station are belong to us.
I think we're all agreeing that the submitter is an idiot for not reading before downloading and the editors should not have posted this "story" in the first place.
Thread closed.
I've owned several D-Link routers, either through no fault of my own or pressed for time and had to buy it. In all of the years I've had to deal with them, I've learned this:
D-Link is Shit. Buy Linksys.
Maybe, just maybe, you shouldn't be using a shit D-Link product in the first place.
I don't care if it's your cat's net connection - their garbage isn't worth 2 minutes. Guess how much time I spend troubleshooting my Sonicwall router. Guess how many times it's locked up on me in the past 4 years. Guess how many times my Cisco switch ($70 on eBay) has caused me problems.
Protip: if you use shit equipment made by shit companies, prepare to deal with a mountain of shit because of it. You bought that stupid thing, so don't bitch no matter what happens. If you don't know any better, then you deserve what you got. If you do, then you deserve what you got.
One word: OpenBSD, who needs anything else. It's been said before by them and this is just the begining - same goes with binary Linux drivers and the NDA's they sign...
After massive amounts of pain with consumer/prosumer-grade (many of the D-Link) routers in the past two years, I finally dropped real money for a real broadband router earlier this year. So far, I've had months and months of trouble-free service.
Now I start hearing crap like this. Makes me even MORE thankful I bit the bullet.
Also "you can turn it off!" apologists? WHY IT IS ON BY DEFAULT? Moreover, tell that to some luddite who barely understands how to boot his computer.
Chas - The one, the only.
THANK GOD!!!
Even if there's an option to disable this, the fact that it seems to be enabled by default is enough for me. D-Link from this point on will never be on my list of vendors when looking for networking gear.
Apparently they didn't learn from the shitstorm that hit belkin when they did the exact same thing years ago.
Another vendor goes down the tubes...
Only buy home routers that can run opensource firmwares. I'm quite happy with my WRT54GL, although the hardware is a bit antiquated at this point.
I'm surprised it took this long for someone to point out what you did. Good job though.
However,there is the tendency though to want to include something that looks like a free feature. The uninformed could easily mistake SecureSpot for being a new free security addon.
Plenty of people will be dling the version with this new form of adware.
This cannot be allowed to go unpunished. Google should sue since it was their domain name that was hijacked and a clear attack on their business.
Google should sue because they have lots of high-priced lawyers and can really make DLink regret this.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
If true, that's the end of D-Link. We would never buy from them again.
Why are marketing people allowed to destroy companies? Then they go to a new company and do it again.
Are you saying that there are two different versions of the firmware that both identify as 1.21? That's outrageous in and of itself! How do you even know which one you have?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
D-link: now with built in dns spoofing.
I'm so sick and tired of these companies doing dumb, fucking shit like this. FUCK THEM! Don't buy any of their products again. FUCK THEM! FUCJ!
So let's see, Linksys makes generic crap. I'm not completely impressed with my NETGEAR device so I don't think they're that great either. Don't even get me started on how bad Belkin's stuff was. D-Link sounded good, but now this?
NOW what do we go with?
I do agree it's not a HUGE issue since it's able to be disabled, but it's still not good that it's an opt in thing. I'd be buying a piece of hardware to connect to the Internet. NOT a subscription service. It may be good for those not comfortable with computers, but still, not so comfortable with those that DO understand them.
Pancakes. Oh I blew it.
I've been rocking a Linksys WRT54GS ( with the 32MB ram, the early ones ) with DD-WRT with an uptime of over a year now.
A lot of people have had poor stability with the WRT54G series, but from reading online most of it comes from the shoddy power supplies linksys uses, making it sensitive to voltage fluctuations. I've had mine hooked up to an APC and haven't had a single problem since then. A few friends have followed suit and also experienced a lot more stability.
Blog
This is still slashdot, right?
Why not have a few thousand people call their tech support, and when you get a human on the phone, try and sell them something?
FLR
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Well you know which one your downloading as the links are as clear as can be (unless you're illiterate in which case you're screwed either way) My guess would be the one without securespot just disables it by default instead of having to manually do it. But I agree, they should have changed the revision (something like 1.21.1). As I said I haven't installed it so I don't know the actual differences.
And just what is wrong with welcome datacomp ads built into consumer devices?
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
because they are supposed to provide products that act blindly on my network/with my other devices.
Now they have proved they cannot be trusted to do so.
So...do I have to read every line of every changelog to make sure this crap isn't built-in and turned on?
What if they provide no way to disable it?
What if the updated firmware has a necessary fix (like the recent DNS hijacks), and I have to choose between being hijacked by retards on another continent, or retards at the company where I bought the device?
Do I get money for looking at their ads? What happens when it breaks apps? Where do they draw the line? Which other products will be self-infected?
The problem with stuff like this is that it gets ignored by most people that buy these things, so the company can easily say "WELLL! We get less than 1% complaint rate for this service, so it can't be that unwanted". Furthermore, since they don't see a 'real' backlash, they start infecting other stuff.
I would say this is unbelievable, but actually, it's quite believable. I wonder just how much advertising one person can be subjected to on a daily basis?
Get off my lawn.
Linksys isn't so bad if you replace the firmware. Try dd-wrt if you want quick and easy, or OpenWRT if you want to customize. I guarantee you'll like 'em. (Get a WRT-54GL to try it on; they're cheap nowadays.)
Its clearly listed on their website.. http://support.dlink.com/products/view.asp?productid=DIR-655
A conservative is a man with two perfectly good legs who, however, has never learned to walk forward. -- FDR
I'm using an old D-Link, but I noticed it fails occasionally, so maybe it's about to die for good. If I have to get a new one, what brands should I consider or avoid?
Circumcision is child abuse.
dd-wrt is pretty solid for me.
/. -- the Free Republic of technology.
it's a feature
You could view it like antilock brakes. People didn't used to like those, because how they react when you skid and mash the brakes. (or try to pump them) Just another case of something getting changed without much notice. Doesn't affect the overall product, just changes one aspect. So probably legal. Especially if they go out of their way to tell you about it. (which they DID for antilock brakes, but evidently not for this linksys snafu)
Now obviously this is all to try to directly benefit Linksys (Cisco now isn't it?) so that pushes it more to the moral left, but still probably legal.
I work for the Department of Redundancy Department.
Sounds like a prime example of what happens when salespeople get too much of a say in the development process. Wonder if they made them back-burner fixing actual bugs and security holes in favor of adding adware like this?
the same thing happened to me, I got the silly site trying to sell me silly things. I closed the window, got on with life. hasn't bothered me since, but it was mildly irritating.
This is the original poster. I did a firmware upgrade from withing the router setup page not by downloading it from their website.
If you have to put up with consumer-level crap, put up with someone else's consumer level crap. Last night I was helping someone configure their WBR-1310. After I set an ESSID, configured WPA2, set an admin password, and added a port forwarding rule, the router decided not to include a router option on its DHCP offers. Meaning none of the computers on their network got a default gateway IP. Resetting to factory defaults didn't fix it. Upgrading the firmware didn't fix it. Tech support couldn't fix it. Replacing the router with a different brand DID fix it.
Also, the DES-3226L rev Bs (kinda like the rev As in that they are both made by D-Link and both have 26 ports - but that's it) are an atrocity. The command line seems like it was put there to fulfill a checkbox requirement. The documentation for it (even the command completion help) doesn't match the actual commands at all, half the commands you'll never get to work, spanning tree is a total writeoff, and they tend to lose their config entirely a few times a year.
D-Link seriously needs to work on their quality control.
It hickjacks the first website you try and visit, showing an add saying "would you like to subscribe for $30/mo.?" You click "no", and never see it again.
sha1sum?
This author takes full ownership and responsibility for the unpopular opinions outlined above.
So after you get your car back from the garage, you would be prepared for it to lock the breaks once you reach 50 mph?
:-). I would not have expected it, but then again I did not expect the spanish inquisition either.
Don't answer, I know you would have read all about it in the manual that you downloaded from the garages website.
My point (besides from wanting to make a stretched car analogy) is that for a home user, an update usually only tightens security, with other changes being rare. During all the time I've used IP networks I have never even heard of this crappy type of behaviour (in a router that is
She made the willows dance
Ah, I found one. The Risks Digest, Volume 16: Issue 55, Weds 9 November 1994. The relevant section is reprinted below for preservation's sake, edited only for spelling ("entirity"), converting asterisk-marked text to strong text, formatting, block quoting, and adding links.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
I've been on the latest firmware upgrade of my D-link now for several days and I haven't seen an...
*NOTICE*
YOUR IP ADDRESS IS VULNERABLE, TRY OUR NEW IP-SECURE-FOR-SURE TODAY...
NO CARRIER
It's true no man is an island, but if you take a bunch of dead guys and tie 'em together, they make a good raft.
This firmware has been in beta for almost 2 years. It adds the SecureSpot feature which allows for web filtering. The idea with the splash page is to allow the users to immediately decide whether they want the feature enabled or not. So, I install a new DIR-655 router, my kids are immediately blocked from all internet access. If I decide to disable it, suddenly everyone can get to their favorite porn website. If I turn it on, I now have parental controls and the kids can only get to the sites/categories I approve. Is it really that bad they they are forcing you to "choose whether you want the feature on or off?" Maybe they could have disabled it by default, but those that want the feature, may never realize its there.
What tactic is new that did that to your ass?
I do not agree with that. DNS hijacking should be considered illegal criminal activity, regardless of what the reason was. We have enough problems with DNS attacks, the last thing we need is for a company like D-Link to try and legitimize it.
If I buy a router, I wanted the router. I would not buy a router if I wanted a security stack; I would buy security software.
Palm trees and 8
The fact that they even considered doing this, let alone the fact that they actually did it, is just stark raving nutso.
... only out of box 5 minutes...
If it were anything else...
The idea that a router should even include a mechanism to hijack connections is just wrong. No excuses. That shouldn't have even been considered in the first place. That they went ahead and shipped it is batshit crazy.
I like my BSD box with two nic's and a switch for my router. for wireless I just use a access point, no routing involved there
no matter how good it is, it is human nature always wants to make things better
Belkin tried this a few years ago. As I recall, it didn't work out too well for them.
Either way, it asks you if you want to try it twice, and then leaves you alone.
The fact that it redirects your connection even once is completely indefensible, no matter what the download is called. I can't believe anyone's defending this kind of slimeball tactic.
I have the DIR-625 and have tested out the Secure-Spot (3.06) firmware and even when its disabled it still phones-home and uses an SSL connection. Naturally you can not issue it a fake certificate to see what its really sending back. Test setup: 2 Routers, Favorite ARP spoofing program and a Network Protocol Analyzer (I use Wireshark) and watch the fun when you power on your D-Link router.
My own recommendation is the Netcomm NB9W MyNetGateway, an all-in-one DSL2+ modem/router/WAP/VOIP machine. I've had one for a couple of years (I think) without ever needing to reset it, and I've set up other people with the same machine and had no calls or complaints.
@ JustinOpinion (1246824) you made excellent point. I actually never owned any of the D(own)-link products but now I've found one more reason to stay away from their products. A router should be doing just what its supposed to do... nothing more and that's it.
I have this router and it's worked really well - has been very stable and has a whole lot of really nice features - I do a lot of remote stuff both ways too and from work - not to mentioned bittorrent and binaries, webcams. Never have a problem, never have to reboot it.
Additionally the router has a feature that can email you when a new update comes out, the download page had a link for 1.21 with securespot and 1.21 without - I checked out what it was and decided against it. As others have mentioned. Below is the link I used:
ftp://ftp.dlink.com/Gateway/dir655/Firmware/dir655_firmware_121_no_securespot.zip
I agree with how most people feel, that they need to be a little more upfront - a lot of the people here aren't going to want that feature - however, there are some people who may - among other things I think it has parental controls, it's like websense for the home user.
When you're updating the firmware on any device and not paying attention to the changes and what they actually do you're going to end up getting fucked, - especially when it comes to consumer home devices like these.
This router requires a 4chan GOLD account.
You will not be able to use a internet unless you have a gold account.
This being Slashdot, I'll point out that a Cisco 851w, which runs IOS 12.4 with an appropriate feature set for most ADSL users, can be had on Newegg for around $350.
Added bonus... You get to learn IOS.
Note to self, never, ever buy dlink, it isn't worth the hassle.
Comment removed based on user account deletion
What annoys be about my D-Link DSL-504T router is that although it runs some sort of customised GNU/Linux (I did "ssh admin@10.1.1.1" and had a look inside), their documentation and website make not the slightest mention of this, let alone make the source code available.
Comment removed based on user account deletion
Why doesn't everybody in the /. crowd buy a router that run OpenWRT (or similar)?
"it's not a bug. It's a security feature."
Knowing Google's lust for data collection, the Soviet Union is still alive and well inside the psyche of Sergey Brin....
My ISP has taken the liberty of doing this to me. Instead of getting a DNS error I get 'ask jeeves' with all kinds of super helpful links to shit I did not ask about.
Now I get to add DLink to the same list. Unless and until DLink issues a public apology and shows contrition for this, there they shall stay, alongside Belkin.
Schwab
Editor, A1-AAA AmeriCaptions
It may be a cop thing, but I recall it from "The Fugitive". The search for "hinky" brings up the movie on the first page. Tommy Lee Jones' character ordered his marshalls to stop saying "hinky" because he didn't want them using words that didn't mean anything.
Isn't this trademark infringement? Hijacking Google's domain to sell their own products?
The "spam" you just have to click no thanks to twice and it goes away, how is this a big deal? There are a lot of other applications and hardware that give an initial-launch page that you have to click out of and never see again.
Are you serious?
Many vendors do this.
Show me the single version of Cisco IOS 12.3 for example. Even if you drill down to the actual firmware version, it comes in about 15 different flavours.
Netscreen FW for my home firewall, I can get the "Normal" AV or the "Trend Micro" AV version.
Hell, even Vista/XP came in different versions.
I'm guessing maybe you were joking?
I switched from a Linksys WRT54G v2.0 running OEM then Sveasoft firmware to a DIR-655 after analyzing the data provided on SmallNetBuilder's Router Performance Charts. My maximum WAN performance increased from approximately 384kB/s down & 48kB/s up, to 1MB/s down & 128kB/s up. Further, the DIR-655's feature set exceeds that of the WRT54G's running either firmware, especially for security configuration.
Although D-Link has fucked up, and my admiration for Linksys' FOSS firmware, I'm compelled to excuse D-Link given their SOHO router performance and feature set. (This is my only experience with D-Link; I'll continue to stick with Intel for NICs and Linksys for switches, either of which have yet to disappoint.)
Thank you, Edward Snowden.
"Arguments from authority are worthless." —Carl Sagan
Regardless of whether or not you can disable it, unless it was an *advertised* feature -- if it redirected you to a fake, substitute website that was other than the website you _thought_ you were going to, isn't that evidence of an unauthorized invasion and hack of the device to introduce a 3rd-party, fraudulent, redirection mechanism that can potentially be used not only by D-Link, but also by a cracker attempting a phishing exploit?
In the US, the unauthorized addition of redirection software to a hardware device (which itself would probably qualify as a small computer), with the right lawyer or prosecutor, could result in jail time for the perp, or, if it's a corporation, probably a bonus for the project manger. ;^/
These are the same bunch of wankers that:
1) hardcoded stratum1 time servers into their consumer routers,
http://yro.slashdot.org/article.pl?sid=06/04/07/130209
2) opined that "we do not consider the GPL as legally binding"
http://gpl-violations.org/news/20060922-dlink-judgement_frankfurt.html
If you want cheap, go Linksys or LevelOne
What D-Link should have done was to advertise the "Secure Spot" feature on the "firmware" download page, be up-front about it and actually explain what it does. At least you can make an informed decision.
A router is a commodity item and should behave as expected - there should not be any "surprises" during it's operation. It should work as "clockwork" *quietly* performing the function is was *designed* for, if you don't notice it - then it's doing it's job.
On the other hand, if it does something to draw your attention to it and does something *unexpected* then you are going to question it's reliability then "fix" the problem.
The expectation of this equipment *should* be mundane, day-to-day predictability and "un-glamourous" functionality.
The last thing you should be thinking is what is this router going to do next or be apprehensive in installing it. It should just be a matter of; buy router, install it then forget about it.
If anything, D-Link have further damaged thier reputation as an IT company, especially when people read about it on Slashdot (D-Link's potential customers!). As a company this is a *dreadful* mistake to make.
Personally speaking, if I need to buy any networking tech I'll be *very* suspicious of D-Link equipment and be more inclined to look at a competitor's product it's a natural reaction.
Well done D-Link, your current management team have managed to alienate your core customers. The person/people who actually gave this "feature" the go-ahead to be installed should be fired.
What a *stupid* way to advertise a product! It just shows you how out of touch with thier customers they are - they don't even understand their own product!
Yet another IT company that has lost it's way.
It is a scummy thing to do, but hardly illegal
It would depend on the judge understanding the issue in the first place, but this is hijacking an electronic comunication between two parties who did not agree to it. If it's not illegal, then the law should be fixed.
www.pfsense.org
the average slashdotter should be able to build a router. attaching lasers and memes to it may be a cowboyneal level feat however...
Good people go to bed earlier.
Belkin did this in their routers a few years ago; hijacked HTTP connections and took you to pages they hosted. That earned them a "never buy Belkin even if the alternative is dialup" rating for me personally.
DLink has been at "these people can't build anything more complicated than a hub without screwing it up" rating for me, but this takes them down to the "never buy" category.
That rating doesn't apply just to routers either. Once a company has done things like this, they've proven that they're willing to use the money they collect from me to actively cause me harm. I won't even buy a USB cable from Belkin, and now not from DLink either.
In Canada it would be theft of computer and telecommunications service, for the purpose of delivering an unasked-for ad.
--dave
davecb@spamcop.net
This is why rather than buying new consumer hardware, I get decommissioned commercial and enterprise grade hardware for myself. Why? It "just works."
I bought a Sun E6500 and E4500 used, and when I looked at the log files for them, they were turned on once when they were originally purchased, and then shutdown once when three of the eight PPSs on the 6500 croaked several years later. The company that had it before me didn't even notice that they were running the system with two blown power supplies until the third blew.
Switches? I use 3Com superstack 100Mb switches pulled from a company that upgraded to gigabit.
GPS? While not exactly commercial or enterprise, I try to track down used or overhauled Garmin GPSMAP aviation units. They are nearly indestructible and I've never seen one fail. I own a 195 and 496. The case of the 195 is pressurized and filled with nitrogen to protect the internal components.
If it looks like a trojan, smells like a trojan and acts like a trojan... it's a trojan!
Perhaps someone could point D-Link at http://tools.ietf.org/id/draft-bellis-dnsext-dnsproxy-00.txt ?
Comment removed based on user account deletion
I have this router. I ended up dodging the secure spot "feature" by going to: ftp://ftp.dlink.com/Gateway/dir655/Firmware/ and downloading the non securespot version of the 1.21 firmware I've been running that for a while and I haven't seen any DNS weirdness as of yet... Get it before D-link pulls it. :)
Perhaps you could forward your findings to the Software Freedom Law Center?
In my professional opinion (as a software guy), I'm certain that this unequiocally contravenes critimal statutes about interfering with other people's computing systems. Have the managers at Linksys serious considered the possibility of being held criminally responsible and spending time in jail?
Can *anyone* place a personal monetary value on the damage caused by this to you or your organization personally? Normally police agencies will not pursue this without a minimum of $5,000 damages.
I know! I bet GOOGLE or Yahoo can! Anyone reading this from Google? How many such routers are out there and how often do they do the redirect? You can clearly state to law enforcement that this is costing you X dollars of lost ad revenue due to hijacked DNS requests.
One serious inquiry from a real law enforcement investigator would cause them to rethink their "feature".
I understand that people would be mad, I for one would throw my device away and go to their competitor, but can Google sue them? This is basically theft of services or some other fancy legal term.
--
My parents went to Slashdot and all I got was this lousy sig.
"A number of years ago in Canada"
A thousand years? Was it after Rome fell? Zero is a number, too. Did it happen this morning?
I'm not a grammar nazi by habit, but "a number of" is a useless expression.
Oh well,
We've been warning you for years, but ahh..we are just a bunch of "free software fascists".
Just hope these pratices does not get widespread just quite yet.
-><- no
At first I thought it was someone at the factory uploading malware, until I found out it was supposed to be a demonstration of "a mini-html" page, and found it showing up on other switches and routers when disconnected from the internet. Still, the included banner ad WAS for setting up an adult personals site.
http://log0.wordpress.com/2008/06/23/url-redirection-attack-with-examples/
URL redirects can be used for phishing attacks. Therefore, URL redirects without authorization can be considered a malicious attempt to exploit a vulnerability and compromise your security.
Sounds like something a court might have interest in.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Same AudiTuner from the DLink forums. After posting a response on the DLink forums I noticed that my wireless connection suddenly cut out. This is odd because I always have great reception in the room where I lost connectivity. When I tried to reconnect, Windows' troubleshooting claimed the problem was "low signal strength". Even if this is correct, I have never had any problems with signal in this room and it seems odd that after days of up-time I would just looses my connection. I looked at the log on my router and there are a few things I'm not sure about in the beginning of the log. Specifically, how settings were saved when I was browsing the web and typing a response on their forums. The computer the the log claims made the changes (192.168.1.100 on my network) was not being used at the time and no one here except myself even knows the IP address of the router, let alone what to do in the configuration pages. I've added an entry to my journal on this site with of all activity logged on my router. Could someone more knowledgeable than myself please have a look at it to see if some malicious DLink employee accessed my router or if it just an "odd" coincidence? I'm unhappy with this company either way, but I would like to know if one of their employees thought they were being clever and illegally accessed my router.
OK, thanks. I have now.
Looking again, I can see that the system used is BusyBox. I notice that BusyBox have already successfully prosecuted corporations for stealing their code.
I doubt that this is the only D-Link product using BusyBox. The website-hijacking firmware in the article is probably running infringing code too.
david@chameleon:~$ ssh admin@router
admin@router's password:
BusyBox v0.61.pre (2008.08.02-02:38+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
# ls
bin etc proc usr var.tar
dev lib sbin var
# ls */*linu*
etc/linux-igd
Here is the page where you can download the firmware. The release notes mention a series of modifications made by D-Link, after an "initial release" that makes no mention of where it came from.
I've done some more research, and this FTP site makes the source code available, but only for the version that they market in the UK. I would need the Australian version if I wanted to hack my router (which I would like to do, because there are several stupid things about it).
I bought the DIR-655 because I WANTED this behaviour - the SecureSpot not the redirection - NOW I discover the Europe version of the firmware does not support SecureSpot. Anyone know what happens if you put V1.21 on a European '655?