Slashdot Mirror
Routers Pose Biggest Security Threat To Home Networks
Nerval's Lobster writes "The remote-access management flaw that allowed TheMoon worm to thrive on Linksys routers is far from the only vulnerability in that particular brand of hardware, though it might be simpler to call all home-based wireless routers gaping holes of insecurity than to list all the flaws in those of just one vendor. An even longer list of Linksys (and Cisco and Netgear) routers were identified in January as having a backdoor built into the original versions of their firmware in 2005 and never taken out. Serious as those flaws are, they don't compare to the list of vulnerabilities resulting from an impossibly complex mesh of sophisticated network services that make nearly every router aimed at homes or small offices an easy target for attack, according to network-security penetration- and testing services. For example, wireless routers (especially home routers owned by technically challenged consumers) are riddled with security holes stemming from design goals that emphasize usability over security, which often puts consumers at risk from malware or attacks on devices they don't know how to monitor, but through which flow all their personal and financial information via links to online banking, entertainment, credit cards and even direct connections to their work networks, according to a condemnation of the Home Network Administration Protocol from Tenable Network Security. Meanwhile, a January 2013 study from Rapid7 found 40 million to 50 million network-enabled devices, including nearly all home routers, were vulnerable to exploits using UPnP. Is there any way to fix this target-rich environment?"
If only there were an easily upgradeable open source router operating system to which vendors could add support for their hardware leaving long term maintenance to a larger community.
http://www.dd-wrt.com/site/ind... Why not right?
Pentesting the custom firmwares from projects like OpenWRT/DD-WRT/Tomato etc?
I have PFSense running on a virtual server, which I recommend to anyone. Perhaps not on the virtual server... it kind of adds a layer of complication that most people probably wouldn't care for, but it works well enough.
http://www.pfsense.org/
Hopefully no huge flaw comes out on that without me noticing. That would be embarrassing.
- ------- There are ten kinds of people in the world. Those who understand binary, and those who... Huh?
I don't actually know if it matters or not but I prefer Apple over other wireless routers because it's so damn braindead easy to keep them patched. Apple just pushes out firmware updates (rarely). Every other router I've owned it was a struggle to figure out if it needed a patch, how to do it. Moreover it was a source of worry even when there wasn't a problem which alone was worth any relatively small cost differential.
Some drink at the fountain of knowledge. Others just gargle.
Yes, this is /. We can upgrade our router firmware or install other firmware. Joe Sixpack cannot.
The blame for this should be laid squarely at the feet of the router manufacturers. IMHO, here's what Linksys/Cisco/Netgear/etc/etc/etc/ should do, at the very least:
1. Be open and forthcoming about bugs found in their router software
2. By default, routers should ship with automatic firmware updates enabled. This should be difficult to disable and robust enough that it'll *just work* with no user intervention.
3. Tell this to their customers in plain English or $localLanguage on the product packaging. And NOT in fine print. Make it very obviously noticeable to the purchaser. This can and should be a signifiant selling point, really. If I'm at BestBuy/WalMart/etc. and see one router boldly telling me "We care about your security! To protect you and your data, this router will check weekly with $manufacturer and update itself to give you the most secure Internet experience possible." And it's sitting next to another router that says no such thing, I'd buy the one that will keep me safe.
The important difference being that bug was fixed, as opposed to being left wide open forevermore.
upon the advice of my lawyer, i have no sig at this time
After I found that my ASUS RT-15U was running telnet with a default password, open to the world which I couldn't kill or change the password on, I swore of embedded device routers.
I have replaced it with a small Debian box with dual NICS, and bought a 24port switch from TPLINK. It was the best decision I have ever made. Perfect reliability, complete control, via IPTABLES. I've got auto blocking of malicious ips trying to hit my ssh or port scanning me via DenyHosts and PSAD.
A couple other custom scripts and DNSMASQ, dhclient, snort, and python, and I have all the other services and features I want, and ONLY the services and features I want.
Incentive to pressure your ISP to support a well over a decade old technology, going on two decades.
I have no viable alternatives. The ISP I'm using now is the best of three shitty options. I live in the USA, did you think I lived in the first world or something?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
What am I missing?
Again, used to be that the most common way for a Ubuntu machine to get pwned was for the user to install VNC with UPnP enabled. They only wanted to connect over their LAN, but VNC went and opened a UPnP port, and... oops.
Every new port opened on the router is a potential new security hole.
In fact, it was even fixed for devices which are no longer in production with no need for the original vendor to even still be in business. Open source is funny that way.
If your product can not be reasonably or safely configured by its target market, then while it is tempting to blame the individuals, it is the manufacturer who has failed.
A home router that is not by default secure on it's WAN side is defective.
I read the internet for the articles.
What is the problem with UPnp??
All devices inside the local network are considered "trusted"
I really think you just answered your own question there.
So this article is saying that routers are *bad* things for security right? Not so fast...
In my view, having a router, even an imperfect one, between you and the internet is a *GOOD* thing for security. Yes, routers might be security risks, but NOT having them is even WORSE of a risk.
Does *anybody* out there remember what it used to be like? It wasn't that long ago that the standard internet connection was for ONE machine and used a PPP connection that pretty much put your Windows (mostly) box directly on the internet. When all this got started, we didn't even have software firewalls. Imagine having a windows 95 box with all the standard services on a routeable IP address. It WAS extremely risky. I remember having unsolicited popups coming up all the time and bothering me with all manner of advertisements. It was a mess and security was extremely lacking.
But then we have the dawn of consumer's using routers and doing all the same exploits became harder because of the NAT. Then routers added stateless firewalls, then state-full firewalls and closed many of the avenues used by the "bad guys" to gain control of your system.
Consumer grade routers have been a HUGE boon to network security in the consumer world. Do they have flaws? Many do, but their contribution to overall security is worth more to me than the risks they may pose. Give me a router, even a flawed one, over nothing. Making the bad guys work harder is a good thing for security, and a flawed router does that.
It's not that we shouldn't be discussing how routers should be made more secure. Obviously we want them to improve. It's just that we cannot loose sight of how far we've come BECAUSE of these things.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
I seriously doubt that Belkin will put out firmware updates for all the old $50 Linksys router models they inherited support for--instead opting to push users to buy replacement models they otherwise wouldn't need. The likely answer is NO--even with a class-action lawsuit. (In all actuality, a 2006-era 2.4GHz 802.11G WPA2 router is still more than plenty for the crappy broadband speeds available in North America...)
This is what scares me about the Internet of Things when it comes to long-life appliances that you could own/use for decades... How long will manufacturers (many of whom have 0 experience so far with connecting their products to anything but a power cable) continue to support these devices? Ultimately, government regulation may be required in this space. God knows I wouldn't want my IoT refrigerator to get "bricked" (a really heavy, big brick!) after 20 years because the manufacturer went under & the fridge couldn't phone home... Or worse, because someone found a backdoor that had been in place for all models in use for 9 years before my model was developed...
Windows 3.1x calc: 3.11 - 3.10 = 0.00
Mod parent up. UPnP is insecure by design. It's very purpose is to take security and control out of the hands of the user, and put it squarely in the hands of whatever happens to be running on your network.
It's too bad that most people don't understand enough about network security to configure their own router, and a double shame that the kludge we call NAT has further broken network applications, but convenient "workarounds" like UPnP could only ever lead to problems like the summary lays out.
I am literally 3000 tokens away from the chaotic crossbow --Stephen