Netgear Adds Support For "Collecting Analytics Data" To Popular R7000 Router

An anonymous reader writes: Netgear's latest firmware update for the R7000 includes new support for collecting analytics data. The update release notes include this caution:

NOTE:It is strongly recommended that after the firmware is updated to this version, log back in to the router s web GUI and configure the settings for this feature.

An article on Netgear's KB states updated last week that Netgear collects information including IP addresses, MAC, certain WiFi information, and information about connected devices.

Comments

Wow!

[Anonymous Coward]

I guess it is time to switch to a different brand.

Re: Wow!

[Z00L00K]

Same here - I'm using a Linux box with iptables to select which traffic that I allow.

And it even more highlights that using DD-WRT is what you should look into if you want to get some level of security on your wireless.

This is supposed to be a security device

[Anonymous Coward]

And it's leaking the owner's personal information over the internet.

Re:This is supposed to be a security device

[Svartalf]

Ah, but must will stupidly agree to it.

Yup

[rholtzjr]

Not sure I like the "feature" if it is not configurable to either enable or disable (e.g. opt in/out).

Notgear...

[Svartalf]

I'm unsure I even like this "feature" with it being controllable.

Clarification: Netgear collects your data

[the_other_chewey]

It's not made clear at all in TFS, and could be read as if Netgear routers now supported more network stats available to the router's owner.

That's not it: "Analytics Data" collection is done by Netgear, remotely.

Re:Clarification: Netgear collects your data

[GrumpySteen]

If you'd clicked on the link,, or even hovered over it to see the url, you'd have seen "What router analytics data is collected and how is the data being used by NETGEAR?" which makes it pretty obvious that they're talking about data that's sent to the company.

It's a fad!

[Anonymous Coward]

IMHO this shouldn't be more of an outrage than all of the tracking companies involved in collecting user data on various websites, i would dare to say that the biggest online companies make the most of if not all of their revenue selling user data. Not to mention that certain alphabet soup agency affiliate outreach that seems to have had a hand in most of the startup companies from the mid 90's or so.

I try to avoid using that certain operating system that wants to "get to know me" through online telemetry, voice analysis, typing and inking.
Though recently i have started to notice that more and more websites require you to log in to even get any sort of access, preferably through Facebook or Twitter. When a popular web-browser all of a sudden asked me to "log in" so i could share my history and bookmarks with more devices and wanted me to download stuff not to my own computer but to their cloud service it just sort of clicked on me. It's a fad!

If you can make it to the top of the fortune 500 with your only source of revenue being selling user data and telemetry then that's the way that other companies are going to conduct their business. I wouldn't be surprised if you would find the equivalent terms mentioned in the EULA in various fruit or robot associated brands of mobile technology either.

The question is. If surveillance sells who's buying?

Re:It's a fad!

[arth1]

IMHO this shouldn't be more of an outrage than all of the tracking companies involved in collecting user data on various websites,

Well, yes, it should. A web site only tracks users who visit it, using web browsers that cooperate.
A router sees all traffic to and from all addresses for all users.

The collected data from a router would also be of great help to anyone trying to penetrate the network.

Re:It's a fad!

[JaredOfEuropa]

Also, if some desirable but naughty IoT device* sends my data to the mothership, I can block it at the firewall (i.e. in the router), in fact I make sure that's the default. But if the firewall itself decides to phone home, you're SOL.
How about a law: collecting data and sending it off-LAN works strictly opt-in only, unless transmitting that data is critical to the advertised functionality of the device or app.

*) please, no discussions or remarks about how no IoT device could ever be desirable.

Their answer

[markdavis]

"What router analytics data is collected and how is the data being used by NETGEAR? Technical data about the functioning and use of our routers and their WiFi network can help us to more quickly isolate and debug general technical issues, improve router features and functionality, and improve the performance and usability of our routers. Such data may include information regarding the routerâ(TM)s running status, number of devices connected to the router, types of connections, LAN/WAN status, WiFi bands and channels, IP address, MAC address, serial number, and similar technical data about the use and functioning of the router, as well as its WiFi network."

Hence my new pet name for them...

[Svartalf]

Notgear.

Good idea

[110010001000]

I had this idea a while back. When you collect analytic data like this and feed it back into a correlation engine you can do analysis and look for things like widespread attacks, malware propagation.

It would be nice to have an open source answer to this.

Re:i dont care

[Z00L00K]

You may be in for a nasty surprise.

Sounds like a good way to fuck yourself Netgear

[Khyber]

Where is this traffic being sent, DNS and IP-wise? How is the data configured for their systems?

Figure these out, and then you could just flood the shit out of their systems with legit-looking bogus data that appears to come from their routers with whatever data you want.

Bonus points if you use this to gain yourself escalated access inside their own network (which wouldn't surprise me given Netgear's security track record.)