Slashdot Mirror

← Back to Stories (view on slashdot.org)

Netgear Adds Support For "Collecting Analytics Data" To Popular R7000 Router

Posted by EditorDavid on from the watching-the-wifi dept.

An anonymous reader writes: Netgear's latest firmware update for the R7000 includes new support for collecting analytics data. The update release notes include this caution:

NOTE:It is strongly recommended that after the firmware is updated to this version, log back in to the router s web GUI and configure the settings for this feature.

An article on Netgear's KB states updated last week that Netgear collects information including IP addresses, MAC, certain WiFi information, and information about connected devices.

110 comments

  1. Wow! by Anonymous Coward · · Score: 5, Insightful

    I guess it is time to switch to a different brand.

    1. Re: Wow! by Anonymous Coward · · Score: 0

      I've had it with routers and wound up rolling my own. Not too hard with packages like Pfsense but a Linux one from scratch isn't too hard either with lots of guides online to help

    2. Re: Wow! by Z00L00K · · Score: 4, Interesting

      Same here - I'm using a Linux box with iptables to select which traffic that I allow.

      And it even more highlights that using DD-WRT is what you should look into if you want to get some level of security on your wireless.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    3. Re:Wow! by Anonymous Coward · · Score: 0

      The fun is going to continue. Soon ISPs will be rolling out bridged-only services to "optimize" your network for their profit.

      You will be charged for pleasure of the service AND they will enforce it with tethering detection measures to ensure your "quality of experience" so that you don't try hide your real network behind a router.

      Everyone wants their half of the pie.

    4. Re: Wow! by Anonymous Coward · · Score: 1

      There's nil/zero/nada reason for Netgear to be collecting this information. In Europe most of this is flat out illegal.

      I think we're reaching the point of negative value now. Devices seem to do everything *but* the thing printed on the box. Most of the Chinese IoT devices are basically badly coded malware in a single. Remind me how the Internet is enriching our lives again?

    5. Re:Wow! by Anonymous Coward · · Score: 0

      News Flash! Netgear sells routers with spyware installed, calls it a feature! These routers should work well with the Win10 spy-virus!

      Seriously, folks, its time to stop buying anything from Netgear until this "feature" is totally removed...AND can be proven to have been removed!

    6. Re: Wow! by Anonymous Coward · · Score: 0

      But... but... but...
      If we can't spy on you how can we enrich your life?

    7. Re:Wow! by jazzdude00021 · · Score: 1

      How did an AC get modded insightful with that comment? Especially on this site. Or are there that many people with mod points that don't already know how to switch firmware on their router?

      Seriously, most people here know that stock router firmware sucks. It's not a secret. If you read the linked KB, you'll see Netgear might actually be working to make their hardware/firmware better using this and not just collecting advertising data like the tinfoil hats are suggesting. Working to make a better functioning, more secure product is NOT a bad thing ESPECIALLY in the SOHO router market.

        If you're paranoid, switch to DD-WRT, Open-WRT, Tomato or any other number of alternative firmwares and use the hardware that works for you, whether it be Negear or even (gasp) Linksys.

    8. Re: Wow! by Anonymous Coward · · Score: 0

      And I've got some roses you can use that explanation on. Unsurprisingly other good software like DD-WRT didn't ever feel the need to spy on your LAN in order to "improve" their software. It's the weakest most transparently false excuse ever.

    9. Re:Wow! by Anonymous Coward · · Score: 0

      Which firmware version? Mine is R7000 Firmware Version 1.0.7.12 and I have it on AP mode and I can't find the option.. Thanks!

    10. Re:Wow! by peawormsworth · · Score: 1

      If you're paranoid, switch to DD-WRT, Open-WRT, Tomato

      This is not paranoid. I have a netgear router and I installed DD-WRT on it. Now I have a router with many features that were not available with the stock software.

      Installing your own software on your router is not paranoid, it is what smart people do because it makes their router work better. Relieving paranoia is a side benefit.

      I should know, I am paranoid. The real thing that relieves paranoia is NOT using a router supplied by your ISP. Connecting an ISP supplied device to your home network is for happy naive people.

    11. Re: Wow! by Anonymous Coward · · Score: 0

      Updated then found out..rolled back to previous firmware...what my router does is non of your damn business...

  2. "Was this article helpful?" by Anonymous Coward · · Score: 0

    Yes, in convincing me to never buy Netgear.

  3. This is supposed to be a security device by Anonymous Coward · · Score: 2, Insightful

    And it's leaking the owner's personal information over the internet.

    1. Re:This is supposed to be a security device by Svartalf · · Score: 2, Insightful

      Ah, but must will stupidly agree to it.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    2. Re:This is supposed to be a security device by Anonymous Coward · · Score: 0

      There's a switch for disabling it on the Advanced->Administration->Router Update page, http://www.routerlogin.net/UPG_upgrade.htm .

    3. Re:This is supposed to be a security device by Anonymous Coward · · Score: 0

      But does that switch really work - or does it just pretend to disable telemetry? Does the switch to disable wi-fi really work?

    4. Re:This is supposed to be a security device by Anonymous Coward · · Score: 0

      But does that switch really work ...

      No, of course not. They are publicizing the fact that they will collect user data in order to fool us and collect user data secretly!

      Can we share meds?

  4. Yup by rholtzjr · · Score: 4, Insightful

    Not sure I like the "feature" if it is not configurable to either enable or disable (e.g. opt in/out).

    1. Re:Yup by Z00L00K · · Score: 1

      Since most such "services" are opt-out most people wouldn't understand it and are afraid to disable it. Same with this UPnP service which is a security hole the size of Valles Marineris.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    2. Re:Yup by Anonymous Coward · · Score: 1

      Not sure I like the "feature" if it is not configurable to either enable or disable (e.g. opt in/out).

      Configurability is nothing to do with this. This feature will now be turned on by default at all your friend's houses. It will be turned on at all internet cafe's. I guess the only thing that can be said for this is that it reminds us that VPNs are not just for bypassing region limitations and that we should all be using one which guarantees user privacy.

    3. Re:Yup by Anonymous Coward · · Score: 0

      When you update the router, it will ask you whether you want to enable/disable this feature next time you log into the GUI and it explains very clearly what information it would be sending back to NetGear.

      Not sure about it being turned on by default... I would assume that, when the router is configured the first time, it will ask the same question, giving the user a chance to disable the analytics.

      I'm not a fan of "features" like this, but as long as you can disable it permanently, I don't think it's a big deal.

    4. Re:Yup by Anonymous Coward · · Score: 0

      They could add an "off" option in the UI, but it doesn't mean the back-end will honor it. Just think of all those webcams that don't have the LED illuminated but the CCD is still capturing images. Any EE can prove they're still working, but not one single tech or consumer rights site will cover it. I wonder why...

  5. Notgear... by Svartalf · · Score: 4, Insightful

    I'm unsure I even like this "feature" with it being controllable.

    --
    I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    1. Re:Notgear... by rholtzjr · · Score: 1

      Good point

    2. Re:Notgear... by Anonymous Coward · · Score: 0

      I guess you'll be flashing it to DD-WRT (or similar) then.

  6. Clarification: Netgear collects your data by the_other_chewey · · Score: 5, Insightful

    It's not made clear at all in TFS, and could be read as if Netgear routers now supported more network stats available to the router's owner.

    That's not it: "Analytics Data" collection is done by Netgear, remotely.

    1. Re:Clarification: Netgear collects your data by GrumpySteen · · Score: 4, Informative

      If you'd clicked on the link,, or even hovered over it to see the url, you'd have seen "What router analytics data is collected and how is the data being used by NETGEAR?" which makes it pretty obvious that they're talking about data that's sent to the company.

  7. i dont care by Anonymous Coward · · Score: 0

    all my router stuff has been chinese brands since decades ago, in fact i always buy chinese stuff, they dont give a flying fuck about what i do since im not chinese and i dont live in china

    1. Re:i dont care by Z00L00K · · Score: 2

      You may be in for a nasty surprise.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    2. Re:i dont care by Anonymous Coward · · Score: 0

      But do they forward SMB and SSDP multicasts by default? Who knows where those SSDP packets emanating from smart TV end up going.

  8. Many others will follow by Anonymous Coward · · Score: 0

    Its probably not going to stop with Netgear. I hear that a person can drown in a teacup. I wonder what a giant Reese's mug could do....

  9. It's a fad! by Anonymous Coward · · Score: 2, Insightful

    IMHO this shouldn't be more of an outrage than all of the tracking companies involved in collecting user data on various websites, i would dare to say that the biggest online companies make the most of if not all of their revenue selling user data. Not to mention that certain alphabet soup agency affiliate outreach that seems to have had a hand in most of the startup companies from the mid 90's or so.

    I try to avoid using that certain operating system that wants to "get to know me" through online telemetry, voice analysis, typing and inking.
    Though recently i have started to notice that more and more websites require you to log in to even get any sort of access, preferably through Facebook or Twitter. When a popular web-browser all of a sudden asked me to "log in" so i could share my history and bookmarks with more devices and wanted me to download stuff not to my own computer but to their cloud service it just sort of clicked on me. It's a fad!

    If you can make it to the top of the fortune 500 with your only source of revenue being selling user data and telemetry then that's the way that other companies are going to conduct their business. I wouldn't be surprised if you would find the equivalent terms mentioned in the EULA in various fruit or robot associated brands of mobile technology either.

    The question is. If surveillance sells who's buying?

    1. Re:It's a fad! by arth1 · · Score: 4, Insightful

      IMHO this shouldn't be more of an outrage than all of the tracking companies involved in collecting user data on various websites,

      Well, yes, it should. A web site only tracks users who visit it, using web browsers that cooperate.
      A router sees all traffic to and from all addresses for all users.

      The collected data from a router would also be of great help to anyone trying to penetrate the network.

    2. Re:It's a fad! by JaredOfEuropa · · Score: 3

      Also, if some desirable but naughty IoT device* sends my data to the mothership, I can block it at the firewall (i.e. in the router), in fact I make sure that's the default. But if the firewall itself decides to phone home, you're SOL.
      How about a law: collecting data and sending it off-LAN works strictly opt-in only, unless transmitting that data is critical to the advertised functionality of the device or app.

      *) please, no discussions or remarks about how no IoT device could ever be desirable.

      --
      If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
    3. Re:It's a fad! by Anonymous Coward · · Score: 0

      IMHO this shouldn't be more of an outrage than all of the tracking companies involved in collecting user data on various websites,

      Well, yes, it should. A web site only tracks users who visit it, using web browsers that cooperate.
      A router sees all traffic to and from all addresses for all users.

      The collected data from a router would also be of great help to anyone trying to penetrate the network.

      "Social apps" track users that aren't visiting the mothership sites and haven't signed license agreements. Not to mention all of the tracking companies that share and merge data between each other. In many cases having "social apps" is a requirement for gaining ad revenue at all.
      Look around and you'll find them in the most unexpected places.

      But yes, from a security standpoint this is more along the IoT mindset.
      You aren't buying devices anymore.
      you are just buying the right to be the end user of them.
      The owners want all of their equipment to be phoning home constantly so they can harvest the produce of the internet 2.0.
      We are witnessing the end of our right to privacy and the baby being thrown out with the proverbial bath water is our right to security.

    4. Re:It's a fad! by Anonymous Coward · · Score: 0

      I've written software that analyzes packets while it's in the packet path. Fun fact: Your Amazon purchases are encrypted. The Add to Cart button is not encrypted. You can get some interesting data.

    5. Re:It's a fad! by Anonymous Coward · · Score: 0

      Also, if some desirable but naughty IoT device* sends my data to the mothership, I can block it at the firewall (i.e. in the router), in fact I make sure that's the default. But if the firewall itself decides to phone home, you're SOL.

      How about a law: collecting data and sending it off-LAN works strictly opt-in only, unless transmitting that data is critical to the advertised functionality of the device or app..

      Well what we're seeing is essentially advertising companies joining forces with security agencies.

      If anything the war on terror is going to strip any law abiding citizens right of security and privacy away and if the advertisers can cash in on that development then that's the way business is going to be conducted. Most people couldn't give a damn.
      Quite a few of them live in skinner-boxes where the conditioned response will get you rewarded with likes and shares, getting withdrawal symptoms over not constantly being validated.

      As far as big brother is concerned I have very little to fear, but when it comes to online surveillance and entrapment schemes, especially in these times of panopticon or glasnost i am concerned. Doxxing and extortion over online activities is getting to be commonplace, and it's not government agencies that are doing it.

      These days not participating in social media at all can lead to HR departments declining your job offer with suspicion on weather the applicant has something to hide or not.

      To paraphrase Hillary Clinton. "You've got to have a public and a private persona".
      I for one am not a happy camper.

    6. Re:It's a fad! by Khyber · · Score: 1

      "unless transmitting that data is critical to the advertised functionality of the device or app. "

      In case you haven't paid attention, app makers are already kinda doing that so they can collect data they should not be collecting.

      --
      Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
    7. Re: It's a fad! by Anonymous Coward · · Score: 0

      Yes it is.

    8. Re:It's a fad! by Motherfucking+Shit · · Score: 1

      The question is. If surveillance sells who's buying?

      Your insurance company, who'll discover that your wife searched for "breast lump" and then jack up your monthly premiums accordingly, even though it turned out to be nothing.

      Your employer, who wants to clean house of any employees who practice a certain religion, but can't exactly go around asking everyone about it.

      Your employer, who might be interested to know that you subscribe to both Netflix and Hulu; you obviously have too much disposable income, and can be passed over for a raise.

      Your father-in-law, who's never liked you and can't wait to use your porn surfing habits to embarrass you at Thanksgiving dinner this year.

      Your company's competition, who would love to brag about how you visit their website dozens of times a day.

      We haven't even started with the government yet. Get creative. Your enemies are.

      --
      "BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
    9. Re:It's a fad! by Anonymous Coward · · Score: 0

      How about a law: collecting data and sending it off-LAN works strictly opt-in only, unless transmitting that data is critical to the advertised functionality of the device or app.

      Until the definitions are changed and someone starts considering the Internet just one large LAN technically then nothing would ever leave your LAN as it is all one.

    10. Re:It's a fad! by Anonymous Coward · · Score: 0

      Samsung and LG HDTVs block network functionality if you prevent them from talking to the mothership. If you use Netflix, Amazon wossit, iplayer et al, you are denied access to them on the TV. So what happens when the mothership is "under maintenance" or being DoSed? Same thing, no access to services you are paying for as a feature of your expensive TV. They even block LAN media.

      Do the consumer electronic review mags/sites, the security sites, or even AVS mention this? Of course not!

    11. Re:It's a fad! by JaredOfEuropa · · Score: 1

      I'd say blocking core functionality (Netflix and local media) unless you enable data harvesting amounts to the same thing as not allowing customers to opt out.

      --
      If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
  10. Their answer by markdavis · · Score: 3, Informative

    "What router analytics data is collected and how is the data being used by NETGEAR? Technical data about the functioning and use of our routers and their WiFi network can help us to more quickly isolate and debug general technical issues, improve router features and functionality, and improve the performance and usability of our routers. Such data may include information regarding the routerâ(TM)s running status, number of devices connected to the router, types of connections, LAN/WAN status, WiFi bands and channels, IP address, MAC address, serial number, and similar technical data about the use and functioning of the router, as well as its WiFi network."

    1. Re:Their answer by Z00L00K · · Score: 1

      And how is the data transferred? If your ISP do a MITM attack on it then they can see a lot about your local network as well.

      --
      If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    2. Re:Their answer by Anonymous Coward · · Score: 0

      If it's not encrypted, which it sure as hell better be.

    3. Re:Their answer by dknj · · Score: 1

      can still MITM encrypted connections if the router doesn't do certificate verification

      -dk

    4. Re:Their answer by Anonymous Coward · · Score: 1

      The key phrase is "improve router features and functionality". This includes legitimate things such as e.g. malware detection and blocking, which they won't actually get round to and anti-customer "features" like advertising targeting, which, since it pays well, they will get done pretty soon.

  11. Hence my new pet name for them... by Svartalf · · Score: 4, Insightful

    Notgear.

    --
    I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    1. Re:Hence my new pet name for them... by Anonymous Coward · · Score: 0

      Snitchgear

  12. Your ISP will choose it by Anonymous Coward · · Score: 0

    Now that its legal to share your private internet access details in the US, this router will let them get behind the NAT and do it per machine.

    Best at this point to start running your own NAT server and firewall off the ISPs router. We seem to be the product being sold right now.

    1. Re:Your ISP will choose it by ooloorie · · Score: 1

      Now that its legal to share your private internet access details in the US,

      It's legal to share your private Internet access details in most countries; in fact, in most countries, it's required when the government asks for them.

  13. Good idea by 110010001000 · · Score: 4, Interesting

    I had this idea a while back. When you collect analytic data like this and feed it back into a correlation engine you can do analysis and look for things like widespread attacks, malware propagation.

    It would be nice to have an open source answer to this.

    1. Re:Good idea by Anonymous Coward · · Score: 0

      look up omnia turris

  14. You can turn that off by Deadstick · · Score: 1, Informative

    ..and they tell you so in, y'know, the update message.

    1. Re:You can turn that off by Anonymous Coward · · Score: 0

      Please shut up. Opt-out is a scam. At the rate tings are going, in 2020 the average user won't have time to do anything anymore because they will be configuring opt-out settings all day.

    2. Re:You can turn that off by Anonymous Coward · · Score: 0

      Yeah, because everyone reads those. No-one just clicks the "oh god, not another damn dialog box, just fsck off and do the update, ok" button, no-siree-bob, that never happens.

      Now excuse me, my lawyer just turned up to walk me through the latest licensing update from redmond: oh look, they added another data collection clause, bless their shiny hearts!

    3. Re:You can turn that off by cats-paw · · Score: 1

      be sure and check to see if it's really turned off.

      also, bug which keeps it on all the time or exposes a vulnerability when enabled in 3 2 1...

      --
      Absolute statements are never true
    4. Re:You can turn that off by Neuronwelder · · Score: 1

      More than that.. Is it really, really, turned off? After all, they had the guts to do it.

    5. Re:You can turn that off by Deadstick · · Score: 1

      What's the difference between that and any other setting in your router or browser?

    6. Re:You can turn that off by danomac · · Score: 1

      You mean you currently can turn that off. That may not be so true in the future.

    7. Re:You can turn that off by epyT-R · · Score: 1

      That doesn't make it all ok.

    8. Re:You can turn that off by Anonymous Coward · · Score: 0

      Don't update to that future firmware then.

    9. Re:You can turn that off by Anonymous Coward · · Score: 0

      Well, if Windows 10 is any indication, it seems that privacy-oriented options mysteriously keep defaulting to turn all telemetry on during updates every now and again.

      Strange correlation. Shocking if it carried over to other software.

  15. Home brew router. by Rockoon · · Score: 1

    I wonder how inexpensive it would be to replace these commercial routers with equivalent home-built ones.

    Re-purposing an old desktop isn't equivalent due to both space and power consumption. A Raspberry Pi although both small and low power, would need to be augmented with significant further hardware in order to perform an equivalent task.

    Throwing an open-source firmware onto a commercial router is a good idea, but in no way really protects you from a hostile hardware maker (or more accurately, a hostile hardware industry.)

    --
    "His name was James Damore."
    1. Re:Home brew router. by Anonymous Coward · · Score: 0

      It's easy. A $100 desktop w/ an extra nic and Linux+iptables works fine. I've used one for years. Wifi is handled by an access point on the internal network. One plus is you can ssh into the firewall and see what's happening in the bag bad world. Plus you can filter precisely. But as you mentioned there are space and power issues.

    2. Re:Home brew router. by Gaygirlie · · Score: 1

      A standard router is better optimized H/W-wise for these tasks, just get one that is supported by OpenWRT and/or LEDE. OpenWRT/LEDE gives you SSH and everything else just as well, if you want that, plus it's actually all optimized for router-use.

    3. Re:Home brew router. by Anonymous Coward · · Score: 0

      I'm using a J1900 with dual nics, some Gigabyte mainboard IIRC. Works just fine with pfsense, and if you want to go hard core, I'm sure Vyos works just as well.

    4. Re:Home brew router. by ledow · · Score: 1

      I have run entire schools from a single desktop re-purposed as a router. It easily handled everything necessary, including captive transparent web filter and firewalling.

      There are a number of Mini-ITX and Pico-ITX boards that are packaged in router-like or UTM cases , some with several Ethernet ports on board making them perfect. It's what people like Smoothwall and Watchguard sell as commercial products - Linux or equivalent on a UTM.

      Trying to cobble them together from RPi makes no sense. Connectivity and speed of response (e.g. VPN's) are critical. The more gigabit ports, the better.

      But the best option has always been "just use a PC in some form", even since the days of DOS / floppy disks / 10Base2 networking. Lookup Freesco. You used to be able to do more on an old throwaway desktop with two ISA NICs and a live-floppy-disk version of Linux than you could for anywhere near the same kind of price with a dedicated device.

      Even NAS etc. are nothing more than embedded boards that you can buy and build your own Mini-ITX equivalent of, and buy a NAS chassis for it that connects to all the drives as plain SATA. FreeNAS is basically built for that too.

      You buy commercial when you want support warranties and no tinkering. Anything else, you deploy yourself.

      Hell, the primary router/firewall/web filter at my current school is nothing more than a Smoothwall VM running on a Windows hypervisor. The network limits incoming lines to a VLAN, only that VM can talk on that VLAN. And it has several other virtual network interfaces for NATing and connecting to, e.g. telephony networks (QoS'd VLAN), guest wifi networks, printer networks, etc. It all "just works" managing several leased lines, hundreds of users Internet access, VPNs for all kinds of things, and an entire telephony/SIP network - and apart from a decent switch with VLAN capability, you don't need any specialist hardware at all.

    5. Re:Home brew router. by spire3661 · · Score: 1

      You use x86 itx motherboards with dual NICs. Stuff like this https://www.amazon.com/Intel-F... Actually this isnt equivalent, it destroys any ARM based router in performance and reliability.

      --
      Good-bye
    6. Re: Home brew router. by Lvdata · · Score: 1

      Not sure I'd trust the onboard nicks due to Intel management security holes. The primary Intel NIC is now worthless.

    7. Re: Home brew router. by Anonymous Coward · · Score: 0

      Ironically, you're wrong. It's too cheap to have that kind of functionality.

    8. Re:Home brew router. by epyT-R · · Score: 1

      Not if you have gigabit service, esp not if you're using QoS and other filtering.

    9. Re:Home brew router. by Gaygirlie · · Score: 1

      What's stopping you from using QoS and other kinds of filtering-techniques on OpenWRT/LEDE? I use QoS on my router running LEDE without an issue.

    10. Re:Home brew router. by aXis100 · · Score: 1

      I would argue that most home/SOHO routers are not specialized for the task. Many of them have quite underwhelming specs and don't even have full bandwidth access to their own network interfaces. A old PC with PCI network cards is an order of magnitude more capable.

    11. Re:Home brew router. by Anonymous Coward · · Score: 0

      Or a PC Engines APU (or similar). Much less power draw than a PC but more capable than the average SOHO router. For less than $100 too.

  16. alternative OpenSource firmware? by Anonymous Coward · · Score: 0

    What is the best alternate firmware to use with the Netgear R7000? DD-WRT, openWRT, Tomato?

  17. Avoid the problem by FantyMingo · · Score: 1

    Advanced Tomato works perfectly on my R7000.

    1. Re:Avoid the problem by Anonymous Coward · · Score: 0

      Agreed! I don't buy a router without making sure it will run DD-WRT or Tomato!

    2. Re:Avoid the problem by Anonymous Coward · · Score: 0

      Tomato definitely works on the R7000, but isn't there a an issue with closed-source drivers on that model, reducing the maximum throughput while using Tomato?

  18. default firmware lifetime by Anonymous Coward · · Score: 0

    So, the R7000's default firmware will have a lifetime measured in 10's of minutes, before it gets wiped and has DD-Wrt, AdvancedTomato, or OpenWRT installed.

    For shits and giggles, I hope someone analyzes the data sent, and floods it with:

    MAC Address: 00:DE:AD:BE:EE:FF visited "more porn.com"
    MAC Address: C0:01:D0:00D:07:01 visited "more porn.com"
    MAC Address: BA:D0:DE:CA:F1:00 visited "more porn.com"

  19. Popular R7000 router bundled with malware by WaffleMonster · · Score: 1

    Love this our product contains malware warning message:

    NOTE:It is strongly recommended that after the firmware is updated to this version, log back in to the router's web GUI and configure the settings for this feature.

    Nothing screams we're doing something wrong AND WE KNOW IT than cute little notes like these.

    How much data is sent to Netgear before this malware can possibly be disabled?

    1. Re:Popular R7000 router bundled with malware by sexconker · · Score: 1

      None, if you unplug the WAN link.

  20. How long until a vulnerability is detected by Anonymous Coward · · Score: 0

    Anybody want to make a bet on how long before a vulnerability is discovered in this new "feature"?

  21. Where is the by Anonymous Coward · · Score: 0

    none of your fucking business packet option?

    Sssh and they want us to trust them to do automatic updates and still they pull shady shit like this?

  22. Sounds like a good way to fuck yourself Netgear by Khyber · · Score: 5, Interesting

    Where is this traffic being sent, DNS and IP-wise? How is the data configured for their systems?

    Figure these out, and then you could just flood the shit out of their systems with legit-looking bogus data that appears to come from their routers with whatever data you want.

    Bonus points if you use this to gain yourself escalated access inside their own network (which wouldn't surprise me given Netgear's security track record.)

    --
    Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
  23. I have a R7000 by Woldscum · · Score: 1

    I have a R7000 and had DDWRT on it back during the security hole thing. Max speed was 150-160 ish down on lan and Wi-Fi. I have 300/30 net BTW and got only half speed. DDWRT also kills the WAP button on the router. I have a cheap canon all in one printer. That can only connect to a wireless network by WAP. So DDWRT killed my remote network printer. Also DDWRT kills the R7000s USB3 port. The Dev said it is a custom USB3 implementation that DDWRT will never support. So DDWRT will "work" on a R7000. But severely cripples the hardware. I bought the R7000 on launch with the promise of DDWRT support. I am looking into making a cheap low power PFSense box and turning the R7000 into a wi-fi access point. Other than the firmware security holes and now this BS. The hardware has been good.

    1. Re:I have a R7000 by Guyle · · Score: 1

      I think you meant WPA - Wi-Fi Protected Access. It's insecure as hell and should never be used - just Google around and you'll learn why. If that's the only way your printer will connect, get a new printer, or plug it into a cheap PC and share it on your network. You won't get WPA using PFSense anyway. I also don't understand why it's important to have USB 3.0 in a router. If you're wanting to plug in an external hard drive and serve it up as a NAS, the little chip in a router isn't going to be very efficient at distributing that across your network at much higher than USB 2.0 speeds anyway, so IMO it's better to just have a cheap PC serve it up on the network. Hell, Newegg had a basic refurbished PC running on a Celeron with USB 3.0 advertised to me in my email this morning for $90, and even an i3 for $120. Perfect to stick in a corner and have it run basic server tasks for you without running up the light bill, and still cheaper than a lot of fancy ass routers. Sexy? No. Efficient? Yup.

      PFSense is pretty solid, but if you're looking for cheap and low powered but still get serious performance, check out the EdgeRouter Lite. Best decision I ever made. Way more bang for your buck.

    2. Re:I have a R7000 by Guyle · · Score: 1

      ... WPA - Wi-Fi Protected Access.

      Dammit, I meant WPS - Wi-Fi Protected Setup.

    3. Re:I have a R7000 by Woldscum · · Score: 1

      Yea WPS my bad. Don't make excuses for DDWRT. I have used it from the beginning on a 54WRT then a Buffalo Networks N. Also use OpenWRT at work. Fact is DDWRT kills a lot of the functionally of the hardware. I did set the printer up as a TCP/IP network printer using the R7000s USB2. But Win7 and Win10 only will allow generic Canon drivers. Which only prints. It kills the network scanning and most importantly Air Print. It also forces me to move the printer into cable distance of the R7000. With the USB3 it kills it completely. Does not work. With a printer hanging off the USB2 all the ports are used. I have an old laptop HD in a USB3 enclosure that we use as a household drop box on the R7000. A NAS will be overkill. 4 HTPCs, gaming rig, laptop, 2 pads and 3 phones. All of that needs to hit the printer. I have everything in a Windows homegroup. It is a PIA to need to boot everything at the same time to share something. It is just easier to grab it off of the router the next time a HTPC is turned on.

      A low power PC + a Intel PCI nic + PFS is the plan. Then configure the R7000 behind PFS. I want to play with and learn PFS. But that Ubiquiti EdgeRouter Lite looks about perfect. Newegg has it for $92.

    4. Re:I have a R7000 by zOper · · Score: 1

      Sadly, that's the problem with Netgear; the only thing good about the R7000 is (was?) the hardware. Security holes asside, I experienced wifi stability problems with FW 1.05 and 1.06 (I had to downgrade to 1.04 each time). And I was only using it as a WIFI bridge! Ok, I was running stuff that was super sensitive to packet drops but still... I can't imagine how many bugs there was with all the features turned on. The fact that they are now collecting analytics does not surprise me; it is likely that they retained that solution to try improve the quality of their software.

  24. Never did much care for Netgear by rsilvergun · · Score: 1

    I always found their stuff cheaply made but expensive to buy. But a couple times I've seen something for a really good price and been tempted. Thanks Netgear, for ensuring I'm never tempted to buy anything again.

    --
    Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
  25. PfSense by spire3661 · · Score: 1

    Time to build that Pfsense box i have been talking about for years.

    --
    Good-bye
  26. Just load DD-WRT on it... by Anonymous Coward · · Score: 0

    https://dd-wrt.com/wiki/index.php/DD-WRT_on_R7000

    Just saying...

  27. What if I don't ... by CaptainDork · · Score: 1

    ... apply the firmware upgrade?

    I checked my Netgear 7000 and it does have an update.

    As far as I can determine, there's nothing there for ME.

    Also, I don't see any security updates.

    So, maybe I just opt to leave it as-is?

    --
    It little behooves the best of us to comment on the rest of us.
    1. Re:What if I don't ... by CaptainDork · · Score: 1

      Also, my 7000 is behind my new Spectrum (old TWC) Internet modem. Does that layer of imsulation protect me t all if I were to allow the firmware upgrade?

      Common sense tells me, "No."

      Thanks.

      --
      It little behooves the best of us to comment on the rest of us.
    2. Re:What if I don't ... by SirAdelaide · · Score: 1

      Never upgrade something that is working.

      (Unless it is a worthwhile security update, obviously)

      --
      I'm a fruit pirate. I bought a watermelon once, and spat the seeds in the back yard. They grew into another watermelon,
    3. Re:What if I don't ... by CaptainDork · · Score: 1

      Thanks.

      I'm a retired IT guy and I knew to check each server (3Com, Novell, Windows NT, Windows 2xxx) and desktop update before application, but I'm weak in router stuff.

      Think I'll pass.

      Again, thanks.

      --
      It little behooves the best of us to comment on the rest of us.
  28. Take it to Anchorhead and get its memory erased by hwstar · · Score: 1

    I won't use any router which I can't load third party firmware on. If this router requires the use of stock firmware, then I would not consider purchasing it. There's too many conflicting interests (i.e. ways to please shareholders) getting in the way of privacy these days. If I pay for something, this I want options to retain my privacy.

    1. Re:Take it to Anchorhead and get its memory erased by jazzdude00021 · · Score: 1

      Please someone mod this up to the top comment and leave it there. You've always had 2 choices: 1) Learn to install your own firmware. 2) Take whatever the manufacturer provides. We've known #2 is crap for years, but maybe this time someone is trying to fix that with a little analytics. If you don't like it, see #1. If you can't do #1, buy from someone who can.

  29. I use Tomato firmware, not stock Netgear by krelvin · · Score: 1

    Actually just updated today as the newest firmware was release this week.
    1.28.0000 -3.4-140 K26ARM USB AIO-64K, While there is an option (and has been) to turn on statistics, I have never had it turned on.

    https://advancedtomato.com/dow...

    Works better than stock firmware and dealt with vulnerabilities that the router had with stock firmware long before Netgear caught up.

  30. New business model by volt4ire · · Score: 1

    It's surely no accident that Netgear is releasing this "feature" just 2 months after Congress voted to allow ISPs to sell users' browsing history.

  31. This is a common practice. by Anonymous Coward · · Score: 0

    This is a common practice in enterprise wireless devices.

    https://documentation.meraki.com/?title=zGeneral_Administration/Privacy_and_Security/Privacy_Concerns_and_Regulatory_Compliance_with_PCI_%26_HIPAA

    https://www.ubnt.com/legal/privacypolicy/

    But sure, lets freak out about netgear doing the same thing now.

  32. So, now we need a router for a router! by Anonymous Coward · · Score: 0

    Who will watch the watchers?

  33. Firmware Version by Anonymous Coward · · Score: 0

    Which version? I didn't find the option.

  34. So I should keep it by Anonymous Coward · · Score: 0

    So my R7000 has been collecting dust for a while. Sounds like I should be keeping it.

  35. Love letter to Ubiquiti? by Anonymous Coward · · Score: 0

    Seriously Ubiquiti, a wifi AP that doesn't suck and isn't evil? SELL THAT THING ON THE TWITTERS MANG