Slashdot Mirror
New FCC Rules Could Ban WiFi Router Firmware Modification
An anonymous reader writes: Hackaday reports that the FCC is introducing new rules which ban firmware modifications for the radio systems in WiFi routers and other wireless devices operating in the 5 GHz range. The vast majority of routers are manufactured as System on Chip devices, with the radio module and CPU integrated in a single package. The new rules have the potential to effectively ban the installation of proven Open Source firmware on any WiFi router.
ThinkPenguin, the EFF, FSF, Software Freedom Law Center, Software Freedom Conservancy, OpenWRT, LibreCMC, Qualcomm, and others have created the SaveWiFi campaign, providing instructions on how to submit a formal complaint to the FCC regarding this proposed rule. The comment period is closing on September 8, 2015. Leave a comment for the FCC.
ThinkPenguin, the EFF, FSF, Software Freedom Law Center, Software Freedom Conservancy, OpenWRT, LibreCMC, Qualcomm, and others have created the SaveWiFi campaign, providing instructions on how to submit a formal complaint to the FCC regarding this proposed rule. The comment period is closing on September 8, 2015. Leave a comment for the FCC.
You can buy an ALIX or Soekris board with a case and wifi card, then install your favorite router distribution on it such as pfSense
I was just thinking that. This is so broad as to be unusable.
And mature products like DD-WRT are what make consumer-grade routers fly. It's pretty much the only reason I'll buy an ASUS, because the stock firmware doesn't have the feature set needed for latency sensitive hardware.
--- Need web hosting?
I have a advanced-consumer-level wifi router and I put Tomato on it long ago. Is that what they are talking about? What kind of rule can prevent you from installing software on computers you own? It seems like a violation of something fundamental to me.
My phone can act as a WiFi router. Does that mean no more firmware updates allowed for my phone?
Parsing legalese tends to cause me physical pain, but I decided to check the actual text rather than accept the summary.
So, here's the deal, any radio transmitter physically capable of operating in certain controlled bands has some complex and moderately convoluted limits applied to parts of those bands. This is about keeping those bands operating in the ways the FCC has approved. IFF your preferred Open Source software were to include those restrictions in its default behavior list, they'll be fine. If you use such a re-written wifi controller with the proper default behavior list, you'll be fine. If you remove one of the safeguards and start broadcasting a jammer signal on police radio frequencies, you'll be very far from fine.
We don't want you to be able to overwrite our back doors.
That I'll happily ignore.
Lawyers, MBA's, RIAA? A jedi fears not these things!
At least this has something to do with electromagnetic spectrum, but only tangentially: They're still claiming the ability to rule over hardware and software, as opposed to merely effects that are detectable over the air.
Wonder what the public key field is for?
This sounds like the perfect sort of thing to include in a comment to them, so they know just how bad of an idea making the rule change would be. I encourage you to submit it, if you haven't already.
It simply requires the hardware to be designed such that if you install open source, you cannot modify the radio to use frequency bands and powers that it is not supposed to use.
And this is easy to do. Just put in settings to limit power and lock out bands and make those settings irreversible until a full system reset. Then make the bootloader set those settings before running the installed OS.
Then the OS can be open source.
It would be absolutely fantastic if people would be rational about tech news. Tech people/netizens are starting to sound like my grandfather now. Every change is something to be feared. OBAMA IS GOING TO TAKE YOUR GUNS! The people running the FCC are people, just like you. They aren't demons or out to get you. Try to work with other people you haven't met instead of exhibiting xenophobia.
http://lkml.org/lkml/2005/8/20/95
No, they want the routers to ship with CPU Trusted mode turned on. Without access to the private key you won't be able to load WRT.
This a security nightmare since you will now be dependent on router manufacturers for issuing security updates and remotely loading them into your router. We all know how well that has gone in the past.
I also believe that to date the FCC has received zero actually complaints about someone illegally modify current routers. So in attempting to address this imagined problem the FCC is going to enlarge a gigantic real problem (ie unpatched routers).
Layer 1, maybe 2 would be baked in. But Layer 3, if that that can't be modified, that's a major major problem. Meaning, if Apple isn't allowed to have the firmware updated for post-sales support on a routing bug, that' very bad news. That is to say, might as well make it all ROM based storage.
I suppose they could make updates in the form of console-like cartridges; swap em out. YUCK!
Life is not for the lazy.
We couldn't get the rape, hate crime and murder charges to stick... But you're going down for updating your WiFi!
Justice Has Been Served !!!!
I wish someone would make this stuff to have a consumer private key... say like a USB drive that is plugged in the router when you get it. Once you set it up, you pull the USB key. Anytime that the router needs to be updated, you insert your USB key, do you updates, and then pull it when you are done. Ta-dah! Private key to keep it from being compromised and owner has control. You could also add some consumer dummy protection: once it is setup, require the key to be pulled to operate (keeps people from being lazy and leaving the router unlocked), prompt people for the key only when updating.
Actually, no.
Almost every embedded SoC - from the most expensive Altera down to Atmel's pinhead-sized ATTiny-13 BGA package - comes with security fuses for exactly this purpose. By writing 1 to fuse bits in the code, upon upload it can be made to physically destroy the debug interface, the flash memory's writeability, and/or a few other things used by the in-house hackers (engineers) to develop a product before rendering it "final" when it's shipped out to the hostile world. Yes, our beloved hobbyist micros can do this too.
Believe it or not, SoC designers have in fact thought of how to keep people from altering and expropriating the code that's stored on microcontrollers before. If you want to prevent somebody with less than a full-on chemistry, nanolithography and electron microcroscopy setup from even *reading* it, it's not hard.
Of course, most non-trivial systems don't go this far precisely because it also makes updates to the main code impossible. So they design a bootloader that IS locked down this way, and which is trusted to check the main code before running it, which is the good-on-paper theory behind Trusted Computing.
The article I read
You must be new around here. You'll learn.
Not everything that can be measured matters; Not everything that matters can be measured.
The PDF explicitly mentions DD-WRT as an example of what should not be permitted:
Third-Party Access
Control
1. Explain if any third parties have the capability to operate a US sold device on any
other regulatory domain, frequencies, or in any manner that is in violation of the
certification.
2. What prevents third parties from loading non-US versions of the
software/firmware on the device? Describe in detail how the device is protected
from “flashing” and the installation of third-party firmware such as DD-WRT.
Wrote a comment.
Leonid S. Knyshov
Find me on Quora
Not to mention that DD-WRT is often the only way to make a security upgrade of an older router.
The corner case that the FCC want to address is not worth the risk increase that may leave a lot of devices insecure because they have issues that haven't been discovered today.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
i really wish they'd get around to whacking the whackers around here. I'm getting tired of hams driving retired cop cars with aftermarket lightbars and "REACT" painted on the doors with a somewhat official-looking seal and a plastic badge they bought at the security guard outfitter supply thinking they're somehow entitled to do more than use the radio.
Do not look into laser with remaining eye.
If this is enacted then that means only router manufacturers would be able/allowed to modify router firmware, right? That means that any security flaws or backdoors will be permanently in place with nothing the end-user can do about it.
Gee-whiz, cui bono?
Stallman was 100% right.
That would be reasonable, perhaps, but it's not the approach the FCC is taking. The FCC instructions (linked below) require all applicants (manufacturers) to:
Describe in detail how the device is protected
from âoeflashingâ
and the installation of third-party firmware such as DD-WRT.
So indeed the rule they have proposed is to explicitly require that manufacturers prevent the installation of DD-WRT.
https://apps.fcc.gov/kdb/GetAt...
At worst, hardware manufacturers will make the WiFi portion of the device untouchable from the rest of the firmware, or perhaps requiring signed binary firmware for the WiFi transmitter.
It would be a nice compromise position, but the one of the FCC Documents, in describing the reporting requirements, specifically asks how the device prevents loading "third-party firmware, such as DD-WRT."
IF uncle charlie has actually started earning his money I'll be very happy.
I was reduced to putting a pin through a dudes coax. He was running a 1kW linear on the cheapest tweaked for power CB base station he could get for free off craigslist. We could not only hear him on the TV, Radio and phone but on the god damn microwave oven.
Repeated complaints to the FCC were ignored and I was forced to fix it myself.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
The restriction seems to the RF portion only: "and would affect the operating parameters of frequency range, modulation type or maximum output power". So if the firmware doesn't effect any of those 3 items, you're not subject to this.
The cesspool just got a check and balance.
I submitted a comment to the FCC outlining several significant security concerns regarding the proposed rule.
Based on 18 years of professional experience in network security, in both the private sector and government, the proposed rule causes significant concern for information security posture. There are three primary reasons. The legitimate goals of the FCC could be achieved in an alternate manner which does not cause the same widespread security vulnerabilities, by instead requiring that output power levels and any other critical parameters be limited to legal levels by a separate chip. This approach would be far superior to effectively banning proper security practice for the ENTIRE operating system and all utilities on the device, as the current proposal does.
1
The proposed rule which requires that manufacturers disallow firmware updates (other than signed manufacturer updates, typically provided for only a very short time), makes it much more difficult to prevent incidents such as the $45 million loss at TJX and the Target breach. In both cases, the victim companies were initially targeted because insecure wifi devices were in use. To reduce future occurrences of such breaches, it is imperative to be able to update devices which use wireless networking. Especially when a vulnerability such as Shellshock is discovered, it is imperative that risks be mitigated immediately.
Updates provided by the manufacturer may at first seem to be a possible solution, but are not actually a viable solution for two reasons. Manufacturers generally do not provide long-term updates, updates for devices more than about one-two years old. In many cases, no updates are offered at all to handle issues after the date of sale. It is not reasonable to anticipate that organizations and families will replace their network gear every year or two - firmware updates are needed, including for devices which are a few years old. Perhaps ESPECIALLY for devices which are a few years old.
Secondly, updates from the manufacturer are not a viable solution for more sensitive government and private organizations due to the response time required. In the first 24 hours after the release of Shellshock, thousands of systems were compromised. For many networks, it is critically important to mitigate the threat during this initial time frame. Manufacturer full updates were not available for several days to several months, as we first discussed the best long term solution and that solution propagated downstream from the authors, to the subsystem maintainers, distribution maintainers, OEM repackagers, and finally out to customers after testing at each level. In the meantime, temporary MITIGATIONS were performed on-site by network engineers and security contractors. These vital mitigations which protected sensitive networks in the interim would be illegal and prevented by manufacturer locks under the proposed rule. In simple terms, the proposal makes it illegal to manufacturer equipment which can be _quickly_ protected against new threats to our cyber security.
2
Another reason that the proposed rule is problematic is that the manufacturer default firmware, with all available features designed to be as easily accessible as possible, is not appropriate for any environment in which security is a concern. A central tenet of information security, and security in general, is that the attack surface should be as small as possible - services not needed for a particular installation should not be installed and enabled. The only software which definitely cannot be exploited is software which is not installed or not enabled. Therefore, the most secure firmware tends to be that with as many features _removed_ as possible, with only those items required for the current role installed.
Manufacturer firmware does the exact opposite, for ease-of-use by ordinary consumers. All services which might be of use to any customer are installed, enabled, and wide open for
You're wrong.
The parameters can be set by the bootloader and a digitally signed. There is no need to make 3 different chips for 3 different units. Just put the parameters in a payload with the target serial number then digitally sign it.
Then in secure code (either in ROM or loaded from flash by a ROM and checked before running) you load those parameters into the radio before proceeding.
This would add no cost (or trivial at best). All you need is an unchangeable unique ID. Everything else can be in the existing flash storage. It would add some complexity.
Why would a manufacturer do this? Because the FCC would mandate it.
You do not need a separate firmware for the radio, you design the radio so that these values become read-only after set. Then the entire driver can be modifiable (open source) it just can't modify that data.
This can be done relatively simply and for no additional cost. So no, the FCC wouldn't be banning open source, simply changing how the systems which use open source must work. And in a way that is really easy to roll out.
http://lkml.org/lkml/2005/8/20/95
I also believe that to date the FCC has received zero actually complaints about someone illegally modify current routers. So in attempting to address this imagined problem the FCC is going to enlarge a gigantic real problem (ie unpatched routers).
There's the clue to "follow the money." If this isn't a real problem, it's likely legislation that's been written by some big company whose profit model is threatened by open source. Look for the sponsors to be Cisco or Belkin, someone who would benefit by selling you replacement hardware if their old hardware gets hacked.
And that suggests a potential cure.
If this is to go forward, it needs to come with a big safety, hacking, and consumer safety clause, something like "Due to the restrictive nature of this rule, the vendors of devices subject to these restrictions must offer a free 20 year warranty repair or replacement of any device found to have a flaw in either the hardware or the software included with the device, including any flaws that expose the device to unauthorized access or use. This replacement must include free shipping of the replacement part, free return shipping of the failing device, and free on-site installation of the replacement device. If repairs can be made via software update, the manufacturer may opt to update all affected machines remotely. All such repairs must be completed within one month of the FCC being made aware of the flaw. This free service must be extended for 20 years from the date of the device registration with the FCC. Any company who dissolves or reorganizes before the 20 year span expires will automatically transfer the liability for free replacements to the majority acquirer of their assets. Non-compliance with this law will result in fines to the manufacturers and distributors of these devices equal to twice the retail purchase price at the date of the sale of the first device multiplied by the quantity of devices manufactured, with the fines to be disbursed equally to customers who physically present the device to an authorized FCC representative, and the FCC."
If they still want this law when it includes a poison pill like this, then we'll all be cheering for bugs to be found every month so we can get another "router check" from them.
John
With NSA hijacking shipments of routers and installing "special" firmware on them wouldn't it be smart of them to have a fellow agency make a law that would stop you from undoing all their hard work. The NSA didn't go to all the trouble of hijacking that truck so you could install clean firmware. I'm surprised this hasn't been brought up in the comments yet. http://yro.slashdot.org/story/... http://tech.slashdot.org/story...
Some certainly don't care for it.
On the other hand, the "wrt" in dd-wrt and openwrt refers to the WRT-54 line of routers from Linksys. It was the first one that had widely available third-party firmware.
When Linksys changed their internal architecture to use less expensive parts, they also starting selling a special modder version which retained dd-wrt compatible internals. So that's one example of _catering_ to people who choose open firmware.
On a related note in a different industry, Roomba did the same.
I noticed when I put in my comments that the deadline has been extended by about a month, but still, I put a comment in before the FCC took their system down for a WEEK for a software upgrade. That in itself ought to be an indication of how wrong-headed this regulation is - even the FCC can't write software that doesn't fail and require modification in the field. This regulation will effectively freeze development of wireless routers and other wireless devices that are key to Internet security and ensure that these devices are full of unfixable software defects that when discovered, make these products immediately and irreversably worthless. Not that any of these routers and devices are actually unfixable or irreversably damaged, but they are effectively so, because manufacturers often take no obligation to repair broken software in products that have expired warranties. Unfortunately, it's the nature of these software defects that the entire manufactured base of product become 100% defective all at once upon the discovery of a critical software security defect - that's world's away from the kind of random, slowly developing defects that result in poorly manufactured hardware. For example, all of my twenty or so personally owned routers would have needed to have been thrown away and replaced when "Heartbleed" was uncovered, and again when "Shellshock" was uncovered, except that they were all running open software for which fixes were provided by the open source community. If I had to rely on the kindness of profit-seeking router manufacturers, they'd all be in the garbage bin, so that I could "shell-out" for new routers. Others have written that millions of devices will never be fixed because of effectively abandoned support of these devices: http://www.technologyreview.co... ..or have exposed long-standing vulnerabilties left unfixed: https://www.mocana.com/blog/20...
This one-week downtime is unfortunate, because the news may be forgotten by this community by the time the FCC restores the ability to provide comments online. Someone needs to ping slashdot back in a week when the FCC restores service, or else this ill-considered proposal may become part of established regulation.