Slashdot Mirror
TP-Link Begins Lockdown of Firmware In Response To FCC
An anonymous reader writes: In response to an FCC rule that requires manufacturers to lock down computing devices (routers, PCs, phones) to prevent modification if they have a "modular wireless radio," TP-Link has begun locking down its routers to prevent firmware not signed by TP-Link from being installed. This essentially prevents open source OSs (OpenWRT, for example) from being used on routers. TP-Link may not be a prestige brand, exactly, but the company makes a lot of routers suitable for installing third-party firmware, precisely the sort of thing being locked down makes difficult if not impossible.
So this is the end of open source firmware on basically any device with a radio
The FCC didn't claim this would happen, and it still happened. Congrats, FCC!
I don't have first hand experience with it, but if you are an aspiring OpenWRT hacker then you might want to look into WRTNode. Using third party proprietary hardware is always fraught with peril anyway.
I am not interested in articles about life extension advancements.
Except the FCC has repeatedly stated time and time again they have no intent of hurting third party open source firmware and they're solely focused on the radio component not causing interference. They even recently modified these rules to appease people worried about this:
http://arstechnica.com/information-technology/2015/11/fcc-we-arent-banning-dd-wrt-on-wi-fi-routers/
So I have a sneaking suspicion this support employee has no damn idea what they're actually talking about.
Does you no good if the bootloader on the soc wont run anything not signed.
No sir I dont like it.
Glad I already returned my TP-Link and bought an Asus. I had the C9 Archer and it was terribly unstable. I guess TP-Link will be falling into obscurity again.
If it can't run OpenWRT without soldering, it's not useful for me. Same goes for any other router that doesn't run a variant of OpenWRT, RouterOS or IOS-*.
Guess I'll be shadowing the OpenWRT forum for my next purchase.
TP-Link is about to see their sales decline. Their cheap shit was eagerly consumed by DIY types putting openWRT on it and frankly you could do some interesting things with it. But, this makes them into just another cheap-shit proprietary Chinese junk network equipment vendor.
I'll pass, thanks.
P.S. Isn't it great how well the FCC listened to all those comments that they solicited? Don;t you feel like your voice matters? That you're part of the system? That your government works for you and takes your concerns into consideration?
The last few routers I've bought for family and friends have been TP-Link, and of course I immediately flash them all with OpenWRT. The last two routers I bought had firmware from October that was locked down, just like TFA makes note of. I wasn't pleased with the google effort and time required to get to where I wanted to go.
As I recall, first I had to find a sort of neutral flashing dd-wrt firmware from early last year, that was possible to be flashed by TP-Link's firmware. Then, since TP-Link's October's firmware was useless, I had to flash the router with a much older version of their firmware, making the unit an April TP-Link router. Once I got that far, I was able to flash to OpenWRT as planned.
I'm happy with the units price and performance under OpenWRT, however I will look to other vendors from now on. Of course I must also blame the FCC, which sort of hurts because lately the FCC has been making a lot of good calls for its actual constituents, (while ignoring its paid-for lobbyists).
Regrettably, they seem to have mistaken channel-based hardware with cryptographically-signed (linux, bsd) databases of allowed channels for something completely different, completely programmable "software defined radios".
The latter are an unsolved problem for the FCC: the former are the chip designers and the Linux networking team working hard to make it easy for the FCC... and being treated badly.
davecb@spamcop.net
In nearly every SoC currently available now, the chain is:
IROM (or similar) bootloader baked into the SoC. This verifies the signature of uboot, and jumps to it for execution
Uboot then takes over, verifies the next step in the chain (if configured to do so), then jumps to it if it verifies.
Note: The IROM signature checks prevent you from replacing uboot with something that does not enforce signature verification.
retrorocket.o not found, launch anyway?
Most modern SoCs have the ability to verify u-boot prior to execution. Either the public key, or a hash of it (The little documentation I could find on TI's architecture was that to avoid storing 2048 bits in efuses, they stored a 128-bit hash of the 2048-bit key in efuses. The chip would verify the key (while in flash, could not be changed due to fixed hash), then use that key to verify uboot. TI had extensions to uboot to support hardware accelerated verification of the next stage in the boot chain.
Note: My bit counts might be off. Might be 1024/256, 4096/256, or ???
retrorocket.o not found, launch anyway?
The FCC's rule change makes the manufacturers responsible for compliance, not the owner/operator. How, then, will the vendors deal with the updates required by the glibc bug, http://linux.slashdot.org/stor...
The vendors of anything that can't be reflashed by their users are now responsible to the FCC for any compliance-critical errors in their devices. A DNS hack can can allow anyone to change to an illegal channel or use an illegal power level.
Similarly, the vendors are at risk of being named in class-action suits for anyone whose router gets hacked through their negligence. Especially in the US, where suing people seems to be the national hobby (;-))
Do you suppose some tiny Taiwanese firm can afford to do a recall like an auto manufacturer, and fix all their locked-down devices? Or be haulded into a US court without going broke? I suspect not...
Locking down your products for the US market because "it's easy" may turn out to be a company-killing error.
--dave
davecb@spamcop.net
tplink still makes quite a number of decent standalone wireless access points with injector capability. ive never used their AIO devices, but instead ive built a network at the office with a central gentoo router connected to a switch, and the AP's locked to vlans with an IDS sniffing the network. FWIW if you need alternatives, pc engines Geode based alix routers are great (AND include AES offload at the cpu level for true random number generator acceleration.)
Good people go to bed earlier.
Isn't this a GPL violation? If any of the software they use is GPL v3 then they can't tivoize it in this way.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
This is a very good point. The question is, is any of the stock firmware covered by GPLv3? Linux kernel is GPLv2, which does not have the tivoization clause.
With only a PCB-trace antenna and one ethernet port, that is nearly useless.
Please help metamoderate.
TP-Link is about to see their sales decline. Their cheap shit was eagerly consumed by DIY types putting openWRT on it and frankly you could do some interesting things with it.
The TP-Link router is a mass market consumer product that retails for $20 and up when purchased from outlets like Amazon.com.
The DIY market is microscopic and always has been.
You don't have to compile the thing. They produce a large number of pre-built images ready to go for a large number of routers.