Slashdot Mirror
The Internet of Compromised Things
An anonymous reader writes: Jeff Atwood has a post about a security threat that's becoming more prevalent every day: spreading malware through a compromised router. "Router malware is the ultimate man-in-the-middle attack. For all meaningful traffic sent through a compromised router that isn't HTTPS encrypted, it is 100% game over." He links to a thorough technical analysis of how even HTTPS encrypted traffic can be subverted. Atwood provides a list of suggestions for keeping your router safe that probably won't be any surprise to people reading this site, and he further recommends only browsing on an unknown router if encryption is available. What I'm curious about are the long-term implications — is there a way forward to re-establish trust in our router infrastructure? What can the open source community do to speed this along?
Nearly all home routers run Linux, genius.
if you want to trust a router, you better be sure there is a vested interest in it being secure. new consumer grade routers come out as often as car models and the firmware is common crap that has half-assed security in the name of features.
i wouldn't trust a router without it being open source and open hardware down to the ICs. so... is anyone making a RISC V based router?
Anons need not reply. Questions end with a question mark.
Or you could, you know, go to an ATM, withdraw some cash, then walk into $shop and buy one there, using the cash...
Il n'y a pas de Planet B.
The people who designed the internet had the right idea: Dumb network, intelligent edge. Perimeter security and trusted networks are dead ends. Communication is from endpoint to endpoint. The network shouldn't even matter. You might be running IP over avian carriers if that's what you need to do to get a connection. But if you need to trust the network between the endpoints, you're doing it wrong. Even if you could trust your own router, do you trust the ten or more routers behind it? Ubiquitous encryption and authentication with IPSec is possible with DNSSEC supplying the keys.
Mine runs Linux, compiled for MIPS. It's actually going to be replaced soon anyway so I haven't bothered to do much with it.
Either way, the average person is only going to use the web interface or the software that the manufacturer provided that runs on the computer, if any. They won't be in position to fix anything that's broken if the manufacturer does not provide either an automatic means or a simple means to do so.
I think it'll eventually come down to a regulatory issue. Tech companies and those companies that use consumer-facing electronics (like car companies and their infotainment and body-control computers) have proven that they're not interested in maintaining their arguably defective products. Don't mince words, bugs are defects. Companies need to be taken to task over both this and over the increasingly rapid discontinuation of support (like factory-shipped apps on cell phones that stop working and can't be updated because new versions require OS updates that aren't provided) such that companies end up with mandatory windows of support until the last product ships, where all bugs and changes in communications protocols and services are maintained, such that devices that consumers have paid good money for actually last as long as their pricetags indicate that they should. For smartphones I think that window should be five years. For things line broadband routers, it should be at least five years, and I'd argue that it's not unreasonable to demand closer to a decade. For cars, where the average age of cars on the road is now something like twelve or thirteen years, it should be at least a decade for basic feature maintenance and probably another ten years for critical bugs that compromise the security of the vehicle's systems, like these easily unlocked cars we're hearing about.
Yeah, it sucks to have to maintain old code, but I'm very tired of having to pay for defective products whose features begin to stop working when the companies that wrote those features decide to change directions.
Do not look into laser with remaining eye.
Nevermind your own dinky router: any traffic you send on the internet is exploited by greedy "big data" companies and rogue 1984-style government agency. And encryption doesn't stop them from watching what you do...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
You can for ADSL routers. Cable service routers usually combine modem and router into one box, and DOCSIS authenticates this device with the other end of the network cryptographically - even if you wanted to replace it, you couldn't. If you check the fine print you'll usually find that the modem-router is the property of the cable company and serves as the demarcation point.
Although US cable companies will happily lease you a modem for an exorbitant monthly fee, you're not tied to using their modem or router. The only hardware I absolutely have to use from the cable company for my setup is a cable box, for TV. I also leave a device for switched digital video, and a cablecard. I don't have to use the last two. Maybe things are different where you are, or with a different provider, but being able to bring your own modem and router is pretty standard here in the US. Whether those devices don't have malware included, intentionally or otherwise, in their firmware is a different discussion. But as long as your router and modem are compatible with their network, US cable companies don't mind you using your own hardware instead of theirs. In fact, it generally saves you money in the long run by not paying their monthly fees.
http://myopenrouter.com/
If you're interested in security, you'll buy a router which you can flash and program to your own liking.
I don't know how to counter a custom spying chip that might be embedded on your router's board, but defeating software is pretty damned easy.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
The first thing I notice about that article is that it help spreading the misconception that HTTP is the only use of Internet and HTTPS the only encryption scheme. I must say, I feel much safer knowing my SSH sessions are not HTTPS-encrypted, because the certification mechanism is completely broken.
FIbre to the door here. I don't even *need* a router to connect. Of course, I have multiple devices and desire wireless connectivity, so I do need a router or similar for those things. But my provider doesn't care what I plug in on my end--any off-the-shelf device will do, as far as they're concerned. Of course, the flip side of that is that, if they see that something that affects their network adversely is coming from my connection, they reserve the right to cut it off and make me ring them up to find out why. But I suppose that's fair enough.
(I sometimes forget how stupid and controlling American telecoms can be.)
Il n'y a pas de Planet B.
If you actually care about security maybe you shouldn't let information from the internet control your computer. I mean sure they can edit your webpages via a router to insert whatever, but the inserting whatever part is could just also be malware on the internet proper.
The point of TNO is that you might as well assume your router is altering webpages and inserting malicious content (either that or there's some already on the internet). One should view the internet as a black box of security threats and then just go from there. Yeah, routers can do that stuff. Security is what you do with that understanding. You don't get a router you can trust. You don't trust the router or the rest of the internet.
It is no longer uncommon to be uncommon.
Yeah, it sucks to have to maintain old code, but I'm very tired of having to pay for defective products whose features begin to stop working when the companies that wrote those features decide to change directions.
So the solution is to mandate by law a minimum support period?
I'm in the UK. We have exactly one cable company in the country - there used to be more, but there was a string of mergers until only one stood. The one is Virgin Media, and they insist on the use of their own branded router, the 'Superhub.' You can set it to disable all the routing functionality and just act as a dumb modem though.
Manufacturers should have to support smart phones for five years? What have you been smoking, buddy? And can you pass me some? The hardware itself (screen, casing, battery, etc.) of most phones does not last 5 years - why should the software?
My phone is a Samsung Galaxy SII. I bought it when it was newly launched. It is now four years old. My previous phone was a T-Mobile G1, also sold as the HTC Dream, the first retail Android phone, which I also bought when it was newly launched. I still have it and it actually still works, but we replaced it in part because of application problems from being limited to Android 2.3.
Just because you replace your technology frequently doesn't mean that the rest of us do. Frankly I'd rather spend my money on other pursuits rather than re-buying the same theoretically-durable goods all of the time.
Do not look into laser with remaining eye.
Put your own router behind the ISP's and terminate it to a VPN, game over.
Cheap storage VM.
You can for ADSL routers. Cable service routers usually combine modem and router into one box, and DOCSIS authenticates this device with the other end of the network cryptographically - even if you wanted to replace it, you couldn't. If you check the fine print you'll usually find that the modem-router is the property of the cable company and serves as the demarcation point.
On Cox Communications networks you can use your own Cablemodem, but it must be one from an approved list. Unfortunately that means no buying a used Cisco 2800-series router and throwing a DOCSIS module into the HWIC slot, even if theree was a DOCSIS module conforming to a new enough standard.
All one has to then do is contact them and have them "provision" the modem, which I assume means entering its OUI into your customer record that it appears in their allowed-devices list.
Do not look into laser with remaining eye.
I have another router behind mine. It terminates to a vpn. I also push some ports to it from the ISP's router. Any device I want to have on the VPN, I just change the gateway. If I don't want it behind the vpn, I change the gateway back.
I could also just have my router do the dhcp and use some rules to decide what traffic uses the vpn.
My point is that even without a pass-through mode, you can use your own router to protect your devices.
Cheap storage VM.
The FCC has an open rulemaking proceeding that would expand these requirements beyond the 5 GHz U-NII devices covered by the OET document to all Part 15 devices. See paragraphs 45 and 46 on page 18 of the Notice of Proposed Rulemaking (FCC 15-92):
We propose to modify the SDR-related requirements in Part 2 of our rules
based in part on the current Commission practices regarding software
configuration control. To minimize the potential for unauthorized
modification to the software that controls the RF parameters of the
device, we propose that grantees must implement well-defined measures to
ensure that certified equipment is not capable of operating with
RF-controlling software for which it has not been approved. [ . . . ]
We seek comment on these proposals.
-- http://transition.fcc.gov/Daily_Releases/Daily_Business/2015...
Anyone interested should file public comments with the FCC in ET Docket No. 15-170 by August 16: http://apps.fcc.gov/ecfs/proceeding/view?name=15-170
While some are saying they already ban open source routers these are recent things and the community needs to stand up. There has been an increase in locked down routers and because of these newer rules all upcoming routers will be locked. You need to file objections with the FCC if you want this to stop. That is the only way we'll even begin to get rid of them and secure our routing devices. It's already near impossible to get a 100% free router where we have access to all the sources. ThinkPenguin's been working on fixing that, but can't do it if the FCC bans this. Check out librecmc.org
Just because you replace your technology frequently doesn't mean that the rest of us do. Frankly I'd rather spend my money on other pursuits rather than re-buying the same theoretically-durable goods all of the time.
Agreed. My previous cell phone was a Qualcomm QCP-1900 I bought in 1998 for $200. It was one of the first all-digital phones. It only made voice calls, which is all I needed. I had to get a new phone last month because nTelos (originally PrimeCo in my area) sold their spectrum to Sprint in my area and, for some reason, my phone would no longer work on the network.
Yes, I arguably got my monies worth from the phone, but it *still* worked just fine - grrr..
Just to note: I switched to Ting and got a Kyocera Hydo Vibe. Perhaps not a standout phone, but it's got some nice features and is not a wallet breaker. I went with a smartphone instead of flip to give me options... App plug: NextRadio works great on my phone - uses built-in FM tuner for live, OTA (non-streamed) radio using little/no data (enhance/basic interface).
It must have been something you assimilated. . . .
Heh. My wife had one of the last Analog cell phones, they started implementing a surcharge if she continued using it instead of replacing it with a digital phone. She ended up with a Samsung bar phone, I think an X820, but it's been awhile so I can't remember for sure.
Do not look into laser with remaining eye.
If the vendors won't do it without it, yes.
Do not look into laser with remaining eye.
Simpler and more likely solution for the government, just watch everyone.
If not that, Oh yes, you bought a router for cash, definitely watching anyone who does that.
My sister-in-law had an analog phone with a $10 per month service plan for nearly ten years. One day the phone slipped out of her pocket into the toilet bowl and the toilet automatically flushed when she got up. Bye-bye, analog phone. Hello, digital phone with $50/month service plan. Karma!
Why must the router and modem be a single bit of kit? Don't we have Ethernet to serve as a well-developed cross-connect?
What could possibly be gained from a suitably-new DOCSIS module in a Cisco 2800-series router (or, in my case, an impossibly-conformant VDSL module on aa Asus RT-N16) that cannot be accomplished with a provider-provided Ethernet-connected modem (whatever that is) and an Ethernet-connected router of my own choosing?
These Cisco 2800-series routers you speak of: They do have Ethernet, don't they? Is there magic within? Or is a local Ethernet connection taboo somehow, compared to having all physical interfaces present on one device?
It is IP, at least: Isn't it?
(If I'm worried about MITM attacks, I'll solve my quandaries in an end-to-end sort of way using well-known and secure methods. The medium, whether including a modem or carrier pigeon, does not matter.)
Kid-proof tablet..