D-Link Apologizes For Router Security

Mark Wilson writes D-Link has issued an apology to its customers for an on-going security issue with many of its routers. A problem with the Home Network Administration Protocol (HNAP) means that it is possible to bypass authorization and run commands with escalated privileges. The list of routers affected by the issue is fairly lengthy, and D-Link has already issued one patch. But rather than fixing the problem, last week's update left routers wide open to exactly the same problem. As it stands at the moment, a firmware patch is still being produced for a total of 17 routers. In the meantime, all D-Link has to offer is an apology. While unhelpful patches have already been issued, D-Link is currently working away on replacement firmware updates. The release dates for these patches is not yet set in stone, but some are due today (20 April), some tomorrow (21 April) and the remainder on 24 April.

Comments

Words without actions are meaningless

[TWX]

An apology doesn't really mean anything in this case, does it?

Re:Words without actions are meaningless

[gstoddart]

Depends on how we define "mean anything".

"We're sorry we have sold you shitty products but won't fix it" is just PR.

"We're sorry we've solve you shitty products but will replace it at our expense" is actually doing something.

I suspect this is one of those corporate apologies designed to say "fuck you, but thanks for playing, hopefully we've minimized the fallout of writing shitty products by issuing a half-assed apology".

I'm hoping the absence of my DIR-615 isn't "we're sorry to tell you we made a shitty product and forgot to check if it was vulnerable".

I keep saying, corporations should have some liability for implementing terrible security. Especially for a product whose job it is to be a firewall.

Re:Words without actions are meaningless

[ron_ivi]

"We're sorry we've solve you shitty products but will replace it at our expense" is actually doing something.

The ideal response in my mind would be: "We're sorry - so here's how to unlock the boot-loader and here are third-party open source firmware providers that we tested for you."

Re:Words without actions are meaningless

[Anonymous Coward]

I keep saying, corporations should have some liability for implementing terrible security. Especially for a product whose job it is to be a firewall.

It's not a firewall. It's a router.

I'm not defending D-Link in any way. But it is extremely important to know the difference. These devices do not offer much in the way of security.. NAT is not a security measure.

Re:Words without actions are meaningless

[Stewie241]

http://www.devttys0.com/wp-con...

I don't know if that is the same issue or ont.

Re:Words without actions are meaningless

[ruir]

Firewall and linksys does not compute.

Re:Words without actions are meaningless

[epyT-R]

Well, if it's running linux, it's probably using netfilter so it probably does have a firewall..at least a drop policy with dynamically opened ports for established/related connections. NAT's security is from the fact that the rfc1918 hosts' addresses are not directly routable, but that's about it. It does not replace a firewall.

Re:Words without actions are meaningless

[LordLimecat]

NAT provides implicit security, even if it is not explicit. Being on an unroutable subnet means theres really nothing an intruder can do to get to your PC short of static port mappings.

Re:Words without actions are meaningless

[Ravaldy]

I worked for D-Link for over 7 years. The major issue have always been software, same as most low cost product. The competitors were also plagued with some of these issues because they used the same H/W and software with a different plastic case and different looking web interface. So chances are that not just D-Link has these issues but possibly Retail+, SOHO, and many of the other off brands you see at Wal-Mart, Best Buy and Staples.

When I worked there, the biggest issue was competitor launching products before standards were ratified. This almost always resulted in rushed firmware and hardware which was a big issue for both D-Link and it's competitors. Around 2003 a smart individual convinced the company to create a north American QC team. This team was comprised of people that had worked in technical support as well as technology experts. The results were much better products released in the US and Canada. Regardless, these types of security issues would not have been caught in QC due to it's complex nature and the limited amount of resources available to the QC team.

Nobody can ever tell me a PR apology is sincere since it's all about saving face but what do I really care about an apology? What matters is that the company issues a fix for the current issue and makes internal changes to avoid future issues.

Re:Words without actions are meaningless

[LordLimecat]

I understand these things quite well, as I wouldnt be in the field if I didnt. NAT provides some degree of security in the sense that if you are on an IPv4 network (99% of home users) on an RFC 1918 network (99% of home users) with NAT enabled, it is impossible for anyone to send an unsolicited datagram to your computer behind the NAT.

There are technologies which punch holes in this (like uPnP), but that does not change the implicit security.

NAT in a typical Linux based router does not prevent someone on the external interface from talking to any port and any host on the internal network

Then you have a static port mapping. Generally to get through the NAT you need to know the public IP and port (out of 65536) you want to connect to, which is dynamically assigned. Then you need to deal with the fact that anything you send is going to be pinned to a specific client port not of your choosing, and you will not know the correct source port to get the client to accept your unsolicited datagram (whch will thence be dropped).

I never said it was perfect security, but it prevents folks from accessing listening ports (like 135-139) as a listener port wont have a dynamic mapping-- only outbound traffic gets those.

But you seem to think Im wrong, so educate me. Lets set up a scenario.

Gateway Public: 1.2.1.1
Gateway private: 192.168.50.1
Windows XP box: 192.168.50.5

No firewalls, NAT on the gateway, Windows XP listening on port 135-139.
What Layer3/4 headers are you going to use thats gonna get a packet delivered to one of those 4 ports on that XP box?

Re:Words without actions are meaningless

[LordLimecat]

For starters, I have read up on it, and many many vendors agree that it IS security.
Sources:
Cisco (Top 2 paragraphs of intro)
http://www.cisco.com/web/about...
SANS institute (Page 5, 2nd paragraph)

And so on.

As to your solution, it has a massive issue. Route tables must use next hops as their gateway; you could not enter a command like that targetting my WAN, and have it work, because my WAN IP would not be a next hop for your computer. The only thing your route table can do is instruct your computer which IP on your broadcast domain will be willing to handle your datagrams. At that point, it is up to that router to figure out the next hops.

You will note I asked you what the L3 / L4 headers would be on your packet; this was specifically to demonstrate why such attacks would fail. You would have a source address of 9.9.9.9, and a destination of 192.168.50.5, and you would instruct your computer to pass that datagram off to a router at ethernet address 99:99:99:99:99:99 (your router), and he would promptly vomit and say "what the hell I cant route an RFC1918". Add the route on your router, and you've shoved the issue back to your ISP, whose router would either fail to find a route for that subnet, or (more likely) outright reject it as a violation of RFC.

The only scenario in which this attack makes sense is when the attacker IS the next hop, that is your ISP. And for 99.999% of users, this is not a realistic threat model they will face, and NAT will be "acceptable" security.

No one argues that a stateful firewall is BETTER (as it prevents attacks like you mentioned), but to say that NAT adds no security whatsoever is being silly; major infrastructure vendors disagree with you.

Re:Words without actions are meaningless

[Em Adespoton]

NAT adds security the same way that the two sets of doors into a shopping mall add security -- an extra layer people have to get through while on their way in/out. They both actually stop absolutely nothing, but they provide another point of defense, and a bit more clarity if something odd is going on.

Of course, that's pretty much meaningless if you don't have a security guard *inside* your NAT. Don't expect some random shopper to report the shoplifter/vandal. And the fact that they're a shoplifter/vandal instead of a "potential" shoplifter/vandal means that your other built-in defenses already failed.

Re:Words without actions are meaningless

[LordLimecat]

The "security" you attribute to NAT does not come from NAT, it comes from using "private" addresses.

Im pretty sure thats what I said, and no one is arguing that point. You're just insisting on being pedantic and condescending.

Your original statement was that NAT is not security. This post of yours agrees that it is security in some shape. If we're agreeing there, then I dont think theres any reason to keep arguing. If youre disagreeing with that, Id ask you to take it up with the links I provided and with stackexchange. I dont have the time to try to make Cisco and SANS' cases on their behalf, if you are unwilling to take their word on it.\

. Besides, why do you trust your ISP not to snoop around on your network?

Because it is an unusual attack scenario, and it would be illegal. It does happen, sure, and defending against a malicious ISP is far beyond the scope of most home security. Luckily for us every consumer OS made in the last 10 years has a stateful firewall, and every consumer router built in the last 10 years has a firewall, so its not an issue.

I mean good grief, 99% of home users are using the ISP provided DNS, and you're worried about probing through NAT in violation of the RFCs? DNS snooping is something that actually happens, and is actually legal. Risk assessment 101: focus on the probable threats.

Without mentioning the need to filter incoming packets, that tutorial concludes: "A computer located in the internet is not able to establish a connection to a local computer, all he can do is address (a port of) the router and hope the best."
Wrong, and leaves anyone who follows the tutorial vulnerable.
As mentioned already, it is impossible in the absence of a published route to your network for someone to reliably send packets directly into a dynamically natted network. The fact that someone could splice onto your cable network is irrelevant, because at that level of effort they could probably climb in through your window and just steal all of your equipment. You're talking about extremely esoteric attacks.

You're really doing people a disservice by perpetuating the myth that NAT adds security.

Im perpetuating the stance of major infrastructure vendors. Argue with them. I imagine you could contact support@cisco.com and explain why their statement that NAT fulfills a security role is incorrect.

In the meantime I would suggest you cut the condescending attitude.

Re:Words without actions are meaningless

[LordLimecat]

3 points.

1) Security measures are measures which mitigate vulnerabilities. Mitigations can involve avoiding an issue, or reducing risk. When you take the potential pool of attackers from "the entire internet" and reduce it to "People with direct access to the link between me and my ISP", you have reduced risk. This is Security 101 stuff, its called "risk assessment".

2) No one is suggesting NAT is the best security ever-- just that it provides some degree of security by way of mitigating some threats. Other threats it does not mitigate, and that doesnt really matter because almost no one relies exclusively on NAT anyways.

3) I've provided sources to a number of vendors; I could easily find more. You still have yet to explain why we should toss out Cisco and SANS' explicit statements that NAT constitutes security, and trust your random internet rant. Put up, or shut up.

Re:Words without actions are meaningless

[LordLimecat]

Then go get a job at cisco or SANS as their chief security engineer, because you clearly know better than them.

I mean, hey, what would Cisco know. Theyre just the folks behind the PIX, the first device to support NAT.

Re:Words without actions are meaningless

[LordLimecat]

I can tell you that if my memory serves me correctly NAT works by changing the last two digits of the mac address on the packets going out so that when they come back in the box knows which port to traffic to.

Thats not really what it does, though its sort of close.

NAT covers a large number of different scenarios; the specific one we are discussing is known as Source NAT, or dynamic NAT (or PAT, in the Cisco world).

In this scenario you have a range of private IP addresses that are not publicly routable, and a single publicly routable WAN IP address to be shared among those private hosts. Each IP packet sent will have a source IP, source port, destination IP, and destination port. The router takes each outbound packet, tears down the layer 2, 3, (and possibly 4) headers, and re-writes the "source" port and IP address using a "pool" of NAT IPs and ports. It forwards the rewritten packet on, and stores in a table the mapping of the private host's IP and source port to the NAT IP/port. Return packets matching that pair of NAT IP/port will be translated (rewritten) to target the private host that originally sent them.

The argument being made is that technically this mechanism does not, in itself, identify and block unsolicited traffic-- which is correct. Technically if you were to guess a mapped pair, you could sneak an unsolicited packet through; if I've opened a connection to Google, (my private IP: 192.168.50.5) and my NAT'd IP/port is "5.5.5.5 / 5238", ANYONE could send a packet to that pair and it should get forwarded through.

In reality, there are problems with this that make it difficult to do, the most obvious being that the private host will simply reject that packet as it does not match an active TCP connection that it recognizes. Additionally, this does not work with listening services (which will not have a PAT mapping, as they arent generally initiating connections), and if there are no active conversations no one on the internet will be able to get their traffic to the private host as the router simply wont have any active NAT mappings-- it wont know what to do with the unsolicited traffic, and will dump it.

The "attack" being described is simply to set up a static route on your machine which tells it "ah, but _I_ know how to get to 192.168.50.5-- its through 5.5.5.5!". This could work, as indeed the router would know how to handle the 192.168.50.5 address; the problem is that no other router on the internet will accept a packet destined for that IP address, and you cant just tell those routers how to route the packet. So this attack only works if you are right next to your target-- either their ISP, or some hacker who is on the same cable drop as your neighborhood.

This is why I call it security: if you have no other firewall, NAT (of the sort we mean when discussing consumer routers) will at least ensure that no geographically removed attackers can access your private network, simply by virtue of every other router on the internet refusing to carry the traffic.

The real crux of this argument is that the AC is being pedantic and obnoxious, and conflating static NAT (his iptables examples) with the sort of NAT found on every consumer firewall. If someone is setting up an iptables NAT, they almost certainly are aware of what doing a default policy of ACCEPT will do: it will remove any sort of filtering and all security. But thats not what the context of the conversation was, which is why theres a disagreement here.

Re:Words without actions are meaningless

[LordLimecat]

If you want to run a test, I will turn off my stateful firewall and give you my current WAN address, and the private IP of a host running a web server; the test would be to see whether you are able to determine what the text of that webserver is.

You wont be able to, however, because as we all know no ISP in the world is going to route your packet because the destination address will be RFC1918-- not because theyre good guy ISPs, but because they cant. This proves the point: The use of NAT-- even in the absence of a firewall-- removes you from the pool of potential attackers, along with anyone not living in the same geographical area as me.

On the first page of Google results, more than half the tutorials for setting up a NAT router leave people with a configuration that allows inbound connections into their entire LAN.

Thats not my deal. People shouldnt rely on NAT solely; I do not disagree. Stateful firewalls are a dime a dozen. But your constant statement that NAT has no security value whatsoever is clearly incorrect.

You dont fight ignorance with half truths. You can combat incorrect configurations by saying "yea, this is better than nothing, but its extremely poor practice in any case."

I dont admit Im wrong not because Im stubborn, but because the security value given by NAT is affirmed by several vendors, none of whom dispute the potential vulnerability you present, but who nevertheless would mark NAT as a part of a security strategy alongside a firewall. If you want me to reject everything I know about routing, and public / private addressing, and everything these vendors are saying, you need to come in here with a lot more than a simple experiment that wont work on the production internet.

Re:Words without actions are meaningless

[LordLimecat]

I do know that it will prevent unsolicited traffic from the wan port into the lan section as long as the connection was not already open from the lan side.

This is not entirely correct, and is his entire point. Someone who is directly connected to the WAN of your router COULD access a port on the inside by manually supplying a route to your private network.

The security value of NAT is that WAN hosts do not generally have a way of routing traffic to your internal private subnet. However, if an attacker had control of every router between them and you, they could manually set up a route into your network.

In that sense he is correct: NAT doesnt provide any guarantees, because hypothetically a hacker could first hack your ISP, and set up static routes to your internal NATted network, and then directly access your internal network remotely.

The reason I continue to say it IS security is because NO security measures are absolute, and security is about layering to reduce risk. Taking the set of attackers from "Everyone on the internet" to some subset of that is an increase in security.

To demonstrate how this all works, lets use the following:

Your private network:
Computer: 192.168.50.5 (listening on port 80)
Router: 192.168.50.1

WAN:
Your router: 1.1.1.1
Your ISP's router: 1.1.1.2
My ISP's router: 9.9.9.2
My router: 9.9.9.1

If I wanted to access your computer, and you had no active connections, I would be unable to: your router would not automatically map any connections to 192.168.50.5, so any connections to 1.1.1.1 / port 80 would just get discarded with your router saying "WTF am I supposed to do with this?". However, if a packet arrived at your router addressed to 192.168.50.5 directly, your router would happily pass that packet on through.

The security here comes from the fact that if my router addresses a packet to 192.168.50.5, it will not know where to send it and will drop it. If I added a manual route to my router saying "packets to 192.168.50.5 go to 9.9.9.2", it will route it to my ISP's router-- who wont know where to send it, and will drop it (I believe it will send a "no route to host" ICMP message). Similarly, traceroute 192.168.50.5 will give "no route to host".

In order for me to break into your network, I would need to take control of both ISP routers (9.9.9.2 and 1.1.1.2), and add a manual route indicating how to route those packets (or modify the OSPF or BGP configuration to distribute those routes). The spec around private addressing in general is where the real security comes from, as it indicates that proper behavior is to not route packets addressed to a private RFC1918 address on the internet.

NAT isnt broken; it isnt designed as a security function, but as a way of stretching addresses. Its ability to hide network details is somewhat of a side effect of that, and that provides the security function-- but its much simpler to just set up a stateful firewall than to set up NAT if all you care about is security.

* RFC1918-- in case this term isnt clear, it refers to non-routable subnets which are not tracked by the public internet addressing authority (IANA). These subnets are what most consumer routers come preconfigured with:
  + 10.0.0.0 - 10.255.255.255 (10/8 prefix)
  + 172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
  + 192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

im sure it took a few tries.

[nimbius]

Dear Customer,
As you may know D-Link recently suffered a security exploit on our routers. Rest assured, as a company that relies on the rock-solid performance of our own affordable, reliable network hardware we took immE8!3#@T@[NO CARRIER]

Re:im sure it took a few tries.

[the_B0fh]

The NO CARRIER jokes were funny when triggered by +++ATH0+++

Good security

[ArhcAngel]

I think D-Link has excellent security. The minute you try to use it the hardware dies. I have some of the old metal box Netgear desktop switches that will outlive me. Almost all of my D-Link products have died prematurely.

Re:Good security

[Anonymous Coward]

This has also been my experience. My internal wireless segment is currently running on an old WAP54G specifically because the D-Link that was purchased to replace it became flaky and fried itself within six months.

Re:Good security

[SirAudioMan]

Ya, I agree! DLink always has been garbage, and always will! I have owned Linksys (aka crappy Cisco) which is moderately better than DLink, but have had better luck with NetGear. That being said, with any home/small office network device, if possible, I always remove the crappy factory firmware and install DDWRT on it.

Re:Good security

[bill.e.gloat]

While I cannot speak to D-Link product longevity every single Netgear Gbit switch -- yes the "pro" metal box ones -- I've ever owned has died after a few years of use. I had great luck with the 10/100 units though, which is why I made the mistake of buying their Gbit models. This last time I bought Cisco and couldn't be happier. Yes more expensive but now that I've had experience with it I believe it to be a very fair price for the quality of design. I'm not even interested in taking Netgear up on their lifetime warranty -- not worth the hassle, especially given how the last one died.

Re:Good security

[ruir]

Good for you. The Cisco home business line is rebranded linked sys material. The Enterprise Cisco active equipment, now, we are talking about top tier material.

Re:Good security

[bobbied]

I'm with you, but I generally use OpenWRT myself...

Re:Good security

[bobbied]

I've actually had pretty good luck with the "small business" line born from the Linksys purchase by Cisco. I have 4 of these old Linksys smart switches in my home network and they've run fine for the last 10 years. The problem you will have is that they can only be configured using a version of IE that was last supported on Windows XP so I have to keep a old Virtual Machine with XP on it laying around so I can configure the switches...

Re:Good security

[bobbied]

The small business stuff isn't that bad actually, once you get past the infant mortality issues in the hardware.. I'd not recommend putting them into a large enterprise network, but for small businesses and home use they are fine. I have 4 of these switches which have been working fine for 10 years now and let me do basic Layer 2 switching, VLAN's and fully functional spanning tree for redundancy. It's a pain to keep the right version of IE laying around so you can manage them, but I just keep an old Windows XP virtual machine for that. Now if you are a large enterprise, don't even think about anything but the full up, enterprise level equipment.

Re:Good security

[SIGBUS]

I have a couple of DIR-825s in my house, and they've been rock solid. Of course, the very first thing I did with them was flash them with DD-WRT. One acts as a router, the other as a WDS station to improve signal coverage throughout the house.

gee thanks

[slashmydots]

It appears that as a countermeasure to getting hacked, all netgear routers freeze up constantly, have the internet connection cut in and out, reset settings for no reason, and fail to load their config pages. Very clever. Maybe they should apologize for the quality of their routers too.

you don't want their actions.

[Lead Butthead]

Keep in mind this is a company that has a history of doing malicious things; willful violation of GPL that was resolved only when they're drag into the court and lost, hard coding default time server IP address in firmware (imagine hundreds of thousands of them all attempting to sync at the same time daily) It demonstrated a culture of (sociopathical) disregard for others, that alone is reason enough to not buy any of their products.

Re:you don't want their actions.

[ScentCone]

A complete disregard for the customers because there is ZERO penalty for producing a shitty product.

Do you purchase their products? Will you in the future? Will you be recommending their products to any people or businesses that you know? Will you be praising or condemning them in venues like this?

What penalty did you have mind beyond them losing sales?

Should we criminalize imperfect software? Let's see some of your code.

Re:you don't want their actions.

[sjames]

Actual enforced consumer laws should be sufficient. In particular, if the device (which *IS* advertised as having a security function) is unfit for purpose (that is, it has serious security flaws), they should be forced to fix it, replace it, or refund it (and if they want it back, they'll need to send out pre-paid packaging for it).

If they choose to replace it, they should ship the replacements out at their cost and again, include pre-paid packaging if they want the old one back. If they can fix it in firmware, they should be prepared to help a bunch of inexperienced people apply the update and if it bricks, replace it promptly.

No more of this "OOOPS, bye now!"

Re:Automated Testing

[Nerrd]

Automated Testing really only works for making sure things work the way they're supposed to work. There really is no such thing as automated Penetration Testing.

Our customers won't know

[ITRambo]

The majority of our customers have no idea how routers work, let alone that they can update its firmware. When we explain that a router is a mini-computer that offers a high level of control to them, some of their eyes glaze over as they think a port is what you plug a cable into. When told that firmware can be updated using DD-WRT or the latest OEM version to patch vulnerabilities, only a few understand how to do this, even when we explain it to them. We do offer to perform the work for them, but most don't care unless their router is acting wonky. Unless D-Link sends letters, not an email that would likely be perceived as spam, to registered owners with simple instructions on how to update firmware. very few of their routers will be patched in the real world.

Re:Our customers won't know

[Anonymous Coward]

The majority of our customers have no idea how routers work, let alone that they can update its firmware. When we explain that a router is a mini-computer that offers a high level of control to them, some of their eyes glaze over as they think a port is what you plug a cable into. When told that firmware can be updated using DD-WRT or the latest OEM version to patch vulnerabilities, only a few understand how to do this, even when we explain it to them. We do offer to perform the work for them, but most don't care unless their router is acting wonky. Unless D-Link sends letters, not an email that would likely be perceived as spam, to registered owners with simple instructions on how to update firmware. very few of their routers will be patched in the real world.

Yes, this is absolutely true.

But, more importantly, consumers SHOULDN'T HAVE TO patch the firmware in their routers. No software is perfect, but this is just getting ridiculous. It's not just D-Link, even though they may be among the worst of the worst, there is now a complete disregard, industry wide, for even the most basic standards of quality.

Re:Our customers won't know

[Anonymous Coward]

Their letters will also likely be rejected as junk mail.

I've done that with more than a few "legal notifications" that I've gotten.

Some of them were, others were perhaps conceivably legitimate.

Re:Our customers won't know

[Ravaldy]

My experience with firmware updates on most devices of the same caliber is that they often reset your configuration which means an auto update would not be advisable. As the devices receive more memory more update options will become available. We probably aren't too far from seeing these types of devices auto update.

Re:Our customers won't know

[geekmux]

The majority of our customers have no idea how routers work, let alone that they can update its firmware. When we explain that a router is a mini-computer that offers a high level of control to them, some of their eyes glaze over as they think a port is what you plug a cable into. When told that firmware can be updated using DD-WRT or the latest OEM version to patch vulnerabilities, only a few understand how to do this, even when we explain it to them. We do offer to perform the work for them, but most don't care unless their router is acting wonky. Unless D-Link sends letters, not an email that would likely be perceived as spam, to registered owners with simple instructions on how to update firmware. very few of their routers will be patched in the real world.

Yes, this is absolutely true.

But, more importantly, consumers SHOULDN'T HAVE TO patch the firmware in their routers. No software is perfect, but this is just getting ridiculous. It's not just D-Link, even though they may be among the worst of the worst, there is now a complete disregard, industry wide, for even the most basic standards of quality.

And yet one quality standard of mine is the old mantra that if it is not broken, don't fix it, which runs in direct conflict against the idea of vendors pushing automated updates, especially to devices that can and will destroy the LAN and WAN connections.

I'm wondering where this conversation would be if TFA was titled "D-Link new automated update service pushes out patch, bricks 100,000 routers at once."

Basic standards of quality would be assuming the vendor is more than willing to support that 2-year old router you "just bought" by keeping people on staff to monitor it for hardware or software vulnerabilities...you know, instead of saying Fuck you Very Much by simply telling you to go buy more of their product by getting a newer (supported) version.

For the average $99 consumer router, which support path do YOU think vendors are more likely to take? Or more to the point, how much are you willing to spend on a new (well-supported) router/firewall? $300? Is $400 too much to ask for the device that protects ALL of your other computing devices? Oddly enough, almost every single consumer thinks so. Even the ones standing in line to pre-order a $500 smartwatch.

Qwality

[xxxJonBoyxxx]

>> The release dates for these patches is not yet set in stone, but some are due today (20 April), some tomorrow (21 April) and the remainder on 24 April.

Da qwality goes in befo da name goes on, right?

Re:Automated Testing

[TechyImmigrant]

What he wants is automated regression testing. They did know about the bug before they tried to fix it.

OpenWRT Anyone?

[Anonymous Coward]

I'm surprised no one has mentioned alternative firmwares... D-Link should issue a patch that upgrades their routers to openwrt.
Problem solved.

Re:OpenWRT Anyone?

[danbob999]

This. D-Link, and other manufacturers, can't be trusted to develop, and especially maintain, router firmwares.

Re:Friends

[rubycodez]

(hand holds egg) This is your home network. (breaks egg into frying pan). This is your home network on D-Link. Any questions?

DIR 868L

[Tenebrousedge]

I have a DIR-868L, it was cheap(-ish) and reviews suggested it had good (unobstructed) wireless speeds. That may well be the case, but unfortunately it has a more serious flaw, only being able to handle about 350 Mbps of my gigabit connection. I'm pretty sure the hardware is capable, but the firmware is crippled. I've already RMA'd one and got another back with the same symptoms. Apparently D-link engineers are trying to reproduce this issue, but I don't really expect them to do anything about it.

So, I'm looking for a little advice here on one or more of the following topics:

• * Choice of Alternate Firmware
• * Firmware Installation Tips
• * Better Gigabit Routers

Additionally, although too long for a bullet point, I'm interested in the viability of simply getting a wireless adapter for my desktop and just using that as the router. The internet is supplied as a simple PPPoE / CAT6 connection, so it's not exactly hard to set up (how D-Link could screw this up would be mystifying but for things like TFA). There are a handful of other devices on the WLAN but wireless throughput is not really a huge concern; I don't yet have any 802.11ac devices so I'm not going to get full speeds to them in any circumstances.

Your sage advice is greatly appreciated. Thanks in advance.

Re:DIR 868L

[ageoffri]

Get an EdgeRouter Lite and a gig switch. I'm finding that the EdgeRouter is very powerful, very fast and being a Linux based appliance is extremely powerful. If you want you could also get one of the EdgeRouter's with more ports and skip the switch, but for me I went with a Lite and a NetGear M4100 12 port switch.

Re:DIR 868L

[Greyfox]

I just picked up municipal fiber in Longmont, Colorado. The company has a page that lists a number of options you could use with their service. I went with the NetGear Nighthawk and am quite pleased with it. Most of the devices in my house are wireless, but I do have a couple of machines plugged into its wired ports and do get ludicrous speed with it. It's a pretty consistent 600 mbps up and down according to speedtest.net, and my one-to-two gigabyte skydiving videos upload to youtube faster than I can type the description of the jump.

Re:DIR 868L

[PRMan]

I used to get 100 Mbps on SpeedTest.net, but the most I've ever seen in the real world is 40 Mbps. I've never seen more from anyone, no matter what. So I recently reduced my internet speed to 50 Mbps and saved $30/month. Why pay for "ludicrous speed" when no company can actually give it to you?

Re:DIR 868L

[Greyfox]

Ah well as I said, my upload speeds to Youtube are ridiculous. I generate two or three skydiving videos a week and it used to take a couple hours to upload them all to youtube. I'll have to make a video of me uploading a video to Youtube, I guess...

I also had a problem, while on Comcast, where my computer waking up from hibernation would not be able to resolve DNS for several minutes. I'd be able to ping numeric IP addresses including Google's DNS servers, which I'd set the machine to use. But it would be several minutes before I could resolve names. That problem went away completely when I switched off Comcast.

So I'm getting gigabit speeds for $59 a month from an ISP that doesn't have the reputation for fuckery that your ISP probably does. Seems worth it to me.

Re:DIR 868L

[Tenebrousedge]

Ironically, the 868L is listed as having the second-highest throughput on the page you linked. It's very strange that mine isn't working correctly. Maybe alternate firmware will help things. The desktop and the ISP-supplied Actiontec get 890 Mbps on speedtest.net, and it's not like PPPoE is computationally expensive. Thanks for the link, it was informative, depressing, and hope-inspiring all at the same time.

Re:Automated Testing

[rubycodez]

Yes there is. In fact many types compliance audits, like PCI Level I, require it.

Look up "vulnerability scanner"

Re:Automated Testing

[Nerrd]

yeah, which work great, for *known* vulnerabilities.

They said their router would work with DD-WRT...

[Karmashock]

... It didn't. It installed sort of but it didn't work. The firmware was all screwed up and half the features had to be manually tweaked by modifying files using the terminal. Seriously pissed because the only reason I bought the damn thing was because they said it was DD-WRT compatible. Fuckers.

I'm burned on D-link for a good long time because of that.

OpenWRT

[Shadow IT Ninja]

I'm glad I did my recent router shopping by starting with the list of OpenWRT supported devices. OpenWRT is a community supported router firmware. There is more active scrutiny of OpenWRT than proprietary manufacturer firmwares. They support hardware more actively and longer than the manufacturers, themselves, do because they use a common source with many hardware models. There is less likelihood of backdoors being introduced or going unnoticed if they are introduced. I'm talking about backdoors like the famous port 32764 back door which was found and patched but then the patch was reverse engineered and found to just hide the back door better.

Now this story highlights another issue which is that the manufacturers are trying to add features to their routers. This is antithetical to security. The best thing for security is to keep it simple. HNAP, the basis of the vulnerability in this story, is just such a feature which I don't need or want. I think this all adds up to a situation where you want to avoid manufacturer supplied firmware if at all possible.

It's a good start.

[Lumpy]

No apologise for D-link router hardware quality.

Sue them out of existence

[ggraham412]

Speaking as one who is tired of sorting through consumer grade routers every few years, I'd love it if 90% of these "smart router" crapware products just went away. Someone said that the best technology is that which disappears from the user's consciousness, but somehow router manufacturers think that their best play is to worm their way into your attention like an insecure child "Hey, look what I can do! Look at me me me!

Yeah, I'm DLink and look what I can do. Real smooth.

Do I need to access an app store on my router? No. Do I need a warm, fuzzy javascript interface? No. Do I need to configure my home router when I'm not at home? No, no, no and those sorts of features probably contribute the lion's share of vulnerabilities.

What I need is a simple, CGI interface to set up basic routing parameters and WiFi that goes more than 20 feet and forget all about the router. I would actually pay up for that.

Re:Automated Testing

[rubycodez]

Almost all problems that cause actual loss for business are caused by *known* vulnerabilities.

Glad I use ASUS now

[Tighe_L]

Although they could be unsecure for all I know...

Re:Glad I use ASUS now

[bobbied]

Don't buy hardware unless you can load your own firmware on it. OpenWRT or DDWRT are both great options. Personally, I have two Netgear routers. One that runs OpenWRT that is my internet facing router and it is rock stable as long as my ISP doesn't do something stupid (like they did last week when they changed me from PPPoE to DHCP access w/o telling me in advance). The router my ISP provided would reset multiple times a day (got to love that actiontech junk) and the stock firmware on the Netgear would require a hard boot about once a week. However, OpenWRT has been rock stable for months.

Re:Glad I use ASUS now

[PRMan]

I had no issues with Asus except my hard drive (which I was using for file sharing and UPnP) dying. Also, all access to that USB-attached drive was slow and would slow down the router, meaning that any attempt to access a large number of files (such as an in-place backup) would slow everything to a crawl. I recently moved my drive to use an old netbook as a server (14W) and it's much better now.

Re:Glad I use ASUS now

[PRMan]

And again, turn off any feature that you don't need. Especially things like public FTP, configuration from the internet, VPN, WPS setup, etc.

Re:Glad I use ASUS now

[Ravaldy]

ASUS is in the same boat. Their motherboard often come with very broken software that requires updates. I've purchased over 60 motherboards from Asus and of that probably 7 different models total. Even their latest Z97 required a BIOS update due to critical issues found in the 3rd version released. I'm not very familiar with the quality of software of Asus network products but like most network products, security issues aren't noticeable until you get broken into or someone tells you about it.

I'm not criticizing ASUS or D-Link since I'd rather have a software engineering department that willing to fix issues rather than one that appears non-existent.

Re:Glad I use ASUS now

[Ravaldy]

That's only good for a small percentage of the population. I'm highly technical and I wouldn't bother with doing my own custom firmware installation unless it's straight forward. To me a router is like a hard drive. I just want to put it in and have it do what is expected of it. Doing updates is obviously a non issue.

FYI, there are a lot of custom firmware available for D-Link products so it's not just Netgear. Also, note that many of the low cost brands you see out there are spin offs from D-Link or Netgear products.

Re:Glad I use ASUS now

[bobbied]

OpenWRT is pretty much brain dead simple with the default load if you have reasonable hardware and use LuCi. Usually the load of the firmware is exactly like what the factory firmware does. Yea, LuCi is a bit more compex than your average home router product, but it's still easy enough that I was able to figure it out with very little help. Armed with the FAQ and or WiKi it's really easy and takes you about 3 steps.. 1. set the root password, 2. configure your internet connection and 3. turn on the wireless connections. Everything else is optional for most.

One issue they could fix is the default configuration. Something a bit more functional out of the first flash might be nice... Just enough to get everything running out of the box, but the failsafe mode is only a few mouse clicks away from an internet connection.

Re:Glad I use ASUS now

[Ravaldy]

You do understand that most users don't even have the guts to upgrade the firmware on a extremely simple device let alone replace the firmware on an existing router.

There's a reason Apple was the king of smart phones early on. They provided a turn key solution that required little to no knowledge of IT to use.

Re:Automated Testing

[bobbied]

Not to mention... How do you know you fixed an unknown vulnerability? I'm waiting for an answer....

Re:Automated Testing

[bobbied]

Automated Testing really only works for making sure things work the way they're supposed to work. There really is no such thing as automated Penetration Testing.

But you can automatically try to find known issues using common attack vectors and avoid shipping the known ones. You can also automatically try randomly generated kinds of potential exploits and see what happens to your software. It's called fuzz testing. And it can expose *possible* exploits, especially if you know something about how your software works. For instance, you can detect that some random packet got passed by the TCP stack and was sent to an application which did something unexpected like logging an exception. You can then take the discovered issue and investigate why the application does what it does and that there isn't an attack vector you can exploit (buffer overflow, SQL injection, or something else).

Re:Automated Testing

[PRMan]

Sony's network hacks were repeatedly done on long-known vulnerabilities.

Re:Automated Testing

[Bob the Super Hamste]

They make these things called fuzzers. Personally I like /dev/urandom and piped into the program.

This is quite old...

[buckfeta2014]

I can't believe they haven't fixed it yet... I've been seeing these in my logs for years.

[Mon Apr 13 14:44:22 2015] [error] [client 104.abc.def.18] File does not exist: /var/www/mywebsite.com/HNAP1

Re:Friends

[viperidaenz]

Fried eggs taste better than raw eggs.

Re:Friends

[rubycodez]

if we're going with Bad Egg Analogies, then my retort would be "can't make a custard pie with fried eggs"