The Internet of Compromised Things

An anonymous reader writes: Jeff Atwood has a post about a security threat that's becoming more prevalent every day: spreading malware through a compromised router. "Router malware is the ultimate man-in-the-middle attack. For all meaningful traffic sent through a compromised router that isn't HTTPS encrypted, it is 100% game over." He links to a thorough technical analysis of how even HTTPS encrypted traffic can be subverted. Atwood provides a list of suggestions for keeping your router safe that probably won't be any surprise to people reading this site, and he further recommends only browsing on an unknown router if encryption is available. What I'm curious about are the long-term implications — is there a way forward to re-establish trust in our router infrastructure? What can the open source community do to speed this along?

Comments

Trusted Network Fallacy

[Anonymous Coward]

The people who designed the internet had the right idea: Dumb network, intelligent edge. Perimeter security and trusted networks are dead ends. Communication is from endpoint to endpoint. The network shouldn't even matter. You might be running IP over avian carriers if that's what you need to do to get a connection. But if you need to trust the network between the endpoints, you're doing it wrong. Even if you could trust your own router, do you trust the ten or more routers behind it? Ubiquitous encryption and authentication with IPSec is possible with DNSSEC supplying the keys.

Re:Trusted Network Fallacy

[Anonymous Coward]

I think you still have to trust some aspects of the network. Sure, DNSSEC can provide some protection, but what if your ISP's DNS server is compromised to provide bad information? I suppose you could verify it against other servers. Can you trust that the routers your packets pass through are properly routing your traffic to the IP you want it to reach? If done right, compromising these things could be almost invisible to a lot of users. I think you have to trust certain aspects of the network, though you should use encryption to protect against MITM attacks. I think you can avoid many types of exploits, but you have to trust something in order for the internet to function. The idea of using HTTPS is a step in the right direction, except that CAs can't be trusted and the biggest one has a horrible record of security. Add to it that most users are ignorant of HTTPS and many applications don't reveal the protocol to the user and you have a problem. Can you trust that mobile apps and a lot of other software that doesn't explicitly reveal its protocols to the user makes use of encryption? Sure, you could sniff the packets, but who does that? I just don't think you can entirely remove trust from the equation, though we can do a lot better than we do now.

Re:Don't routers already run BSD?

[TWX]

Mine runs Linux, compiled for MIPS. It's actually going to be replaced soon anyway so I haven't bothered to do much with it.

Either way, the average person is only going to use the web interface or the software that the manufacturer provided that runs on the computer, if any. They won't be in position to fix anything that's broken if the manufacturer does not provide either an automatic means or a simple means to do so.

I think it'll eventually come down to a regulatory issue. Tech companies and those companies that use consumer-facing electronics (like car companies and their infotainment and body-control computers) have proven that they're not interested in maintaining their arguably defective products. Don't mince words, bugs are defects. Companies need to be taken to task over both this and over the increasingly rapid discontinuation of support (like factory-shipped apps on cell phones that stop working and can't be updated because new versions require OS updates that aren't provided) such that companies end up with mandatory windows of support until the last product ships, where all bugs and changes in communications protocols and services are maintained, such that devices that consumers have paid good money for actually last as long as their pricetags indicate that they should. For smartphones I think that window should be five years. For things line broadband routers, it should be at least five years, and I'd argue that it's not unreasonable to demand closer to a decade. For cars, where the average age of cars on the road is now something like twelve or thirteen years, it should be at least a decade for basic feature maintenance and probably another ten years for critical bugs that compromise the security of the vehicle's systems, like these easily unlocked cars we're hearing about.

Yeah, it sucks to have to maintain old code, but I'm very tired of having to pay for defective products whose features begin to stop working when the companies that wrote those features decide to change directions.

The entire friggin' internet is compromised

[Rosco P. Coltrane]

Nevermind your own dinky router: any traffic you send on the internet is exploited by greedy "big data" companies and rogue 1984-style government agency. And encryption doesn't stop them from watching what you do...

Re:The entire friggin' internet is compromised

[rmdingler]

This is unfortunately the ugly reality: the internet as we knew it is dead. What many dreamed would be an empowering tool for the masses became the ultimate instrument of power and control for the Ruling Elite.

To be fair, it's actually a little bit of both.

Having access to all the compiled knowledge of mankind is empowering for any and every person with internet access, as is being essentially free to contact nearly every other Worldly citizen via the web. The ability to monitor an individual's access to that information is maddeningly power grubbing for the government's surveillance state.

Being realistic, if it was not advantageous to the ruling elite, would they let us keep it?

HTTPS is not the only encryption

[Cigaes]

The first thing I notice about that article is that it help spreading the misconception that HTTP is the only use of Internet and HTTPS the only encryption scheme. I must say, I feel much safer knowing my SSH sessions are not HTTPS-encrypted, because the certification mechanism is completely broken.

Pfft. This all misses the point.

[Tatarize]

If you actually care about security maybe you shouldn't let information from the internet control your computer. I mean sure they can edit your webpages via a router to insert whatever, but the inserting whatever part is could just also be malware on the internet proper.

The point of TNO is that you might as well assume your router is altering webpages and inserting malicious content (either that or there's some already on the internet). One should view the internet as a black box of security threats and then just go from there. Yeah, routers can do that stuff. Security is what you do with that understanding. You don't get a router you can trust. You don't trust the router or the rest of the internet.