Slashdot Mirror
D-Link DIR-655 Firmware 1.21 Hijacks Your Internet Connection
chronopunk writes "Normally when you think of firmware updates for a router you would expect security updates and bug fixes. Would you ever expect the company that makes the product to try and sell you a subscription for security software using its firmware as a salesperson? I recently ran into this myself when trying to troubleshoot my router. I noticed when trying to go to Google that my router was hijacking DNS and sent me to a website trying to sell me a software subscription. After upgrading your D-link DIR-655 router to the latest firmware you'll see that D-link does this, and calls the hijacking a 'feature.'"
You have to manually upgrade the firmware and going back to plan old 1.20 is exactly the same process. It's not exactly hard to "disable". I have this router and also recently updated my firmware but I have not encountered this yet...
If you RTFA, you'll see that you CAN disable it.
Still pretty hinky, though.
Probably not. But what are you going to do about it? After enough stink, there will likely be a class action suit. No one that has been wronged will get real resolution (maybe a coupon for a new D-link model router for their trouble!). The amount paid out by D-Link will be less than the profit they get from these things. Business as usual.
The only solution is to burn the place down or kill a few key people, then let them all know why. But no one is going to throw their life away on a bad router purchase.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
I haven't upgraded to 1.21; however, the reason was when 1.21 first dropped it had SecureSpot. Now I found this out by reading the information on 1.21 so I didn't download and install it. They now (and have for some time) offer 1.21 without SecureSpot; perhaps you should download and install that.
there's a separate link at their firmware download page for the DIR-655 that says (in plain view, in a sensible spot): Click here for Firmware 1.21 WITHOUT SecureSpot 2.0
Well, I highly doubt that most customers know what "SecureSpot" is. So how are they supposed to know to download the non-annoying firmware update? Of course, you may say that this is the customer's problem: they should read up on all the features that are being installed in the firmware update, and be sure that this is really what they want, etc.
And, yes, in principle everyone should read every line of each and every EULA.
The fact is that any reasonable person would expect a firmware update to only fix bugs and security flaws. It would not be normal to expect entirely new features to be installed, and it is certainly abnormal for the new "feature" to actually include nagware that prompts you to pay for some new service.
The point here is that what they are doing is sleazy. The default configuration should have that redirect turned off. The link for a "without SecureSpot" firmware is nice, but the fact is that 99.9% of users will only notice that after they have already installed, and been annoyed by, the default update.
It's an annoying thing to do with a firmware update. And in that sense, it's a reason to not do business with them.
Back in 2003 Belkin introduced a router that periodically redirected HTTP connections to advertise its own software:
Help! my Belkin router is spamming me
Some commentary:
Ease-of-use or marketing-driven sabotage: Does your hardware's software do only what you expect of it?
Here's an old article about Belkin doing a very similar thing:
Belkin, the consumer networking and connectivity firm, has promised customers a firmware upgrade to disable a controversial 'spamming' feature built into its routers.
As first reported on The Reg last week, the feature hijacks random HTTP requests every eight hours and redirects users to a page advertising Belkin's parental control software. There is an opt-out link but that failed to appease Net users who accused Belkin of creating a new mechanism for spam.
"The only solution is to burn the place down or kill a few key people, then let them all know why."
If only revolution was not such an outdated ideal.
DSLIP Web Design and Content Management Australia.
After massive amounts of pain with consumer/prosumer-grade (many of the D-Link) routers in the past two years, I finally dropped real money for a real broadband router earlier this year. So far, I've had months and months of trouble-free service.
Now I start hearing crap like this. Makes me even MORE thankful I bit the bullet.
Also "you can turn it off!" apologists? WHY IT IS ON BY DEFAULT? Moreover, tell that to some luddite who barely understands how to boot his computer.
Chas - The one, the only.
THANK GOD!!!
If true, that's the end of D-Link. We would never buy from them again.
Why are marketing people allowed to destroy companies? Then they go to a new company and do it again.
The only solution is to burn the place down or kill a few key people, then let them all know why. But no one is going to throw their life away on a bad router purchase.
that's the problem with the youth today, no commitment to principles.
--
"It is now safe to switch off your computer."
What's annoying with things like this (and others) is that it just gets in the way and obstructs your work.
I choose things based on their lack of snarkiness. I don't want a Windows PC full of crapware. I'd rather just pay the manufacturer a few extra bucks to cover the loss of crapware kickbacks. I used to run an AV, but occassionally, it would bring up a message telling me I wasn't fully protected because I wasn't running their antispam (despite running Thunderbird). When my renewal came up, I chose another company, and I told them that this was one of the reasons.
Linksys isn't so bad if you replace the firmware. Try dd-wrt if you want quick and easy, or OpenWRT if you want to customize. I guarantee you'll like 'em. (Get a WRT-54GL to try it on; they're cheap nowadays.)
Hell NO. They're absolute garbage! I've seen more fried D-Link routers than every other brand combined. I'd sooner buy any other no-name brand for *more* money. Plus, they've been doing "evil" stuff like that for ages -- not long ago they were hammering a tier-1 NTP server with their firmware (and the poor guy was footing the bill for them on his own). Their garbage is best avoided.
You want a good router? Get a Linksys WRT54GL (that is NOT the G or GS). Then put tomato on it or DD-WRT (they're Linux distros). Then setup opendns and all that in it too. Best router you can get under $500 perhaps (short of a specialized/fancy cisco router that runs IOS and is easy to mis-configure, an expensive specialized routerboard, or power-hungry computer with moving parts...)
This is the original poster. I did a firmware upgrade from withing the router setup page not by downloading it from their website.
From the goddamn article:
So, you can turn it off. Not only that, but as of 9/30 there's a separate link at their firmware download page for the DIR-655 that says (in plain view, in a sensible spot): Click here for Firmware 1.21 WITHOUT SecureSpot 2.0
Plus, upgrading your firmware "just because". Why?
Double flame to you buddy.
1) I wouldn't call "WITHOUT SecureSpot 2.0" in plain view. It's not like SecureSpot means anything to me. It has the name Secure so it sounds like something I would want. Now if they named it KickInTheBalls 2.0 or maybe SlapInTheFace 3.2 I would know to avoid it. SecureSpot means nothing to me.
2) Upgrading firmware on a firewall/router why? Are you kidding me? You're going to be-little people who pro-actively secure their main entry point to the outside world. From now on you should lose your Slashdot posting privs.
If you RTFA, you'll see that you CAN disable it.
What are we becoming? Now every sleazy behaviour is ok as long as you can opt-out? That hasn't worked for spam for the past 20 years, has everyone suddenly got a learning disorder?
The default behaviour of absolutely everything that's not a requested feature has to be opt-in.
Opt-out is not good enough. I thought we'd learnt that by now.
Assorted stuff I do sometimes: Lemuria.org
I do not agree with that. DNS hijacking should be considered illegal criminal activity, regardless of what the reason was. We have enough problems with DNS attacks, the last thing we need is for a company like D-Link to try and legitimize it.
If I buy a router, I wanted the router. I would not buy a router if I wanted a security stack; I would buy security software.
Palm trees and 8
What annoys be about my D-Link DSL-504T router is that although it runs some sort of customised GNU/Linux (I did "ssh admin@10.1.1.1" and had a look inside), their documentation and website make not the slightest mention of this, let alone make the source code available.