Slashdot Mirror
Ask Slashdot: Can Commercial Hardware Routers Be Trusted?
First time accepted submitter monkaru writes "Given reports that various vendors and encryption algorithms have been compromised. Is it still possible to trust any commercial hardware routers or is 'roll your own' the only reasonable path going forward?" What do you do nowadays, if anything, to maintain your online privacy upstream of your own computer?
'nuff said.
You still have to rely on the trustworthiness of the NICs. Anything contacted to the Internet can not be trusted.
Sig: I stole this sig.
The answer depends on what you mean. As far as I'm concerned, a hardware router can probably be trusted to be a basic firewall/router. It's pretty unlikely that anyone will come up with a useful attack on a device that's just doing port blocking, NAT, and basic routing. At worst, somebody might DOS it or turn it into a well-connected zombie to aid in DDOSing somebody's server, but neither of those is compromising your data.
Now if you're passing unencrypted data across that router, you might have a problem, but then again, passing unencrypted data across any router outside your own intranet is a bad idea, so nothing new there. And if you're expecting the commercial router to provide a VPN, then the answer to whether it is trustworthy becomes "no", because its crypto implementation cannot readily be audited and verified to be trustworthy.
Check out my sci-fi/humor trilogy at PatriotsBooks.
You shouldn't have to trust your upstream routers. Instead you should assume they're compromised and use end-to-end encryption. HTTPS and SSH, for example, specifically protect against active attackers such as malicious routers.
Like RSA or Microsoft?
See, that's the theory, but it can not work in practice the way things are today..
Today, you will notice that an increasing number of business models reject the notion of "I'm the seller and you're the buyer". Most of the corporations with whom you do business don't really see you as the customer any more. For example. If you use Google, are you the customer or are the advertisers? If your data is compromised, that doesn't change anything about the relationship between the seller and the buyer. Same goes for banks, and for Microsoft, Apple, and most of the big tech corporations. While they may sell products to you, they have significant income streams that are deals with the government. In the next six years, Apple computers could have almost a trillion dollars in cash-on-hand. Are they a tech company or a bank? The money they make from their intellectual property doesn't come from you. The money they make from their "strategic partnerships" doesn't come from you.
You're going to buy their products regardless, so it's a lot more important to Apple that they have a good relationship with the government than with you. Because their beneficial sweetheart tax deals could bring in as much as the profit from selling consumer electronics.
Same goes for the telecommunications industry. When you've got telecoms involved in creating content, you're no longer the customer. You're not the consumer, you are the consumable.
This new relationship circumvents every aspect of the notion of "free market", at least any "free market" that involves you. And make no mistake: this new relationship where there is a third party that inserts itself between you and the company from whom you purchase an item is the model of the future. Video gaming, food, intellectual property (of course), transportation, right on down the line. You are being cut out of the equation. There is more profit in making the government happy than there is in making you happy.
You are welcome on my lawn.
Bottom line is this: there is no longer a division between the corporate world and government. They are one in the same. They rely on each other and have no reason to take you into consideration.
This makes dealing with the problem as citizens ten times harder. Because if you attack one of the heads of this snake, the head at the other end comes around to bite you. And the current setup is sweet for both corporations and government so they've got no reason to want to change it.
You are welcome on my lawn.
This is a big (and, I personally fear, unfixable) problem for the IETF and associated Internet bodies. Of course, router security is only a tiny piece of it. Given that RSA has been revealed as taking money from the NSA to weaken security protocols, who knows how deep the rot goes.
One big fight right now is in over the removal of NSA employed Chair of the Crypto Forum Research Group. There will be more.
For ensuring the safety of your outgoing traffic, it doesn't matter at all whether you can trust your router or not. It's just one step away from a router at your ISP, which you can't trust, and which can be assumed to be malicious.
It's a bit different for ensuring the safety of your internal network, though. If you think there might be any reason why the NSA, government or whoever might want to reach inside your personal network, then you certainly should avoid any closed solutions and keep it under as much control as possible. That router might well hiddenly allow people that know how to access your network without permission.
Router manufacturers also have been caught rewriting pages to insert ads. Here is one example of such a thing.
One solution is to simply not communicate outside of a domain you trust. Go offline. I the extreme, use pen and paper to store information you don't want others to see, and if you need to share that information with others, memorize it and tell it to them in person. As a compromise, use a trusted courier. But even that requires trusting someone.
Basically, adopt the same "off the communications grid" techniques that Osama bin Laden was thought to use.
As I said, you give up a lot, and for 99+% of us, that's not going to be the best option out there. But for a few, it is.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Trust No One!
And I should believe you why?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If you're worried about a router and if you can trust it, you've already done it wrong.
Your data should have been encrypted before it let the original application if its something you care about.
It shouldn't MATTER if you can trust the router, if it does, you've already failed.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Modern laptops and desktops come with remote administration tools built into the chips on the board. (The vendors tout this as a feature, simplifying administration of a large company's workstations. It's easier and cheaper to build it into everything than to be selective, so it's in the machines sold to individuals, too.)
One example: Intel Active Management Technology (AMT) and its standard Intelligent Platform Management Interface (IPMI), the latter standardized in 1998 and supported by "over 200 hardware vendors". This is built into the northbridge (or, in early models, the Ethernet) chip).
Just TRY to get a "modern laptop" (or desktop), using an Intel chipset, without this feature. (I suspect the old Thinkpad is how far back they had to go to avoid it.)
You can't disable it: Dumping the credentials or reverting to factory settings just makes it think it hasn't been configured yet and accept the first connection (ethernet or WiFi, whether powered up or down) claiming to be the new owner's sysadmins.
If the NSA doesn't know how to use this to spy on, or take over, a target computer, they aren't doing their jobs.
Some of the things this can do (from the Wikipedia articles - see them for the footnotes):
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
If you wish to skirt the NSA, get your router from Huawei, and let the Chinese spy on you instead. If you don't want the Chinese to spy, get something from the usual NSA contributors. Or see if there's anything made in Russia or any country that's totally independent of the US.
How easy is it to get a standard router from Cisco or Juniper, and replace IOS or JunOS w/ something like pFsense, m0n0wall or OpenWRT?
While at it, switch to IPv6, and within a group of people, share a /64 subnet so that even if the NSA spies, they'll find it impossible to source the original source/destination, particularly if dynamic IPs are used.