Slashdot Mirror
Germany Proposes Router Security Guidelines (zdnet.com)
German government would like to regulate what kind of routers are sold and installed across the country. From a report: The German government published at the start of the month an initial draft for rules on securing Small Office and Home Office (SOHO) routers. Published by the German Federal Office for Information Security (BSI), the rules have been put together with input from router vendors, German telecoms, and the German hardware community. Once approved, router manufacturers don't have to abide by these requirements, but if they do, they can use a special sticker on their products showing their compliance. The 22-page document, available in English here, lists tens of recommendations and rules for various router functions and features.
I'm confused about this rule: "Only DNS, HTTP, HTTPS, DHCP, DHCPv6, and ICMPv6 services should be available on the LAN and WiFi interface"
What about SSH, VPN, VPN-over-SSH, etc? Are they saying that other than those few services, no other services should be passed through to the Internet? Or that the router ITSELF shouldn't provide services other than those six?
No special character requirements, just longer. https://www.wsj.com/articles/the-man-who-wrote-those-password-rules-has-a-new-tip-n3v-r-m1-d-1502124118?mod=trending_now_2
Some interesting stuff in that document.
- By default the router must only offer DNS, ping response and a web interface to devices on the LAN. Seems like even UPnP is disabled.
- Default SSID must not give anything away, such as the manufacturer of the router. Not sure what exactly the point is, considering that things like the MAC address reveal that.
- Half decent default passwords.
- Manufacturer must state how long they supply updates for and what severity level merits a patch.
- IPv6 is optional.
Seems rather basic to be honest.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
I give you my sticker for half the price they do.
The draft sets out to not only list what expectations/requirements routers will need, but it explains, in layman's terms, the reasoning behind it all. The best way to secure a thing is to properly educate those that are using it.
Politics; n. : A religion whereby man is god.
...not a regulatory programme. Even TFA calls them guidelines. It is a sad day when the Slashdot editors are worse than the press for adding fud.
is to simply hold the manufacturers of said hardware fully liable for the half-assed products they sell.
Great big eye-opening-with-cries-of-thats-not-fair-from-the-companies-who-peddle-this-shit fines with the option to forgo said fines if the CEO goes to jail for a decade instead.
Industry only takes security seriously when it impacts their profits.
No NTP or ICMPv4?
Just a thought: At least here in the U.S., Underwriters Laboratory does electrical testing on products to ensure they're safe. Why not expand their role in the case of computing equipment like this (and perhaps also so-called 'IoT' devices) to test for vulnerabilities? Basically, throw a bunch of attacks at Internet-facing devices and see if you can crack them. As new exploits are discovered, expand the suite of testing to include those attacks. Would never be 100% because exploits and attack methods seem to evolve faster than they can code around them, but it would likely be better than these manufacturers have been doing on their own.
... the rules have been put together with input from router vendors, German telecoms, and the German hardware community.
No input from the IT people wearing boots? Expectations of fixing problems by those who are the problem ...
It little behooves the best of us to comment on the rest of us.
I have to make the day in the calendar! Hadn't it been for the DSGVO (data protection laws), I couldn’t remember the last time this happened!
Maybe this is the one thing, where the batshit insane comic villain level evil psychopathic fatcat fascists' interests line up with that of actual humans.
It's a very weak set of requirements, and reads like all Germany did was consult Router makers and gave them a list of the things they already do. It just sounds like a router makers marketing department made this up so they could sell more routers that were now "government certified".
Here's what I see as missing and severely lacking.
Once sold, a router MUST support security updates to firmware for a minimum of 5 years, and SHOULD support security updates for 10 years.
A router MUST NOT have any manufacturer back doors.
A router MUST be configured by default to automatically patch severe security issues during the supported lifetime, but also MUST allow the end user to turn this off.
gweihir KNEW u IMPERSONATE me https://it.slashdot.org/commen... c6gunner proves it https://linux.slashdot.org/com... & forgot to SUBMIT AC & used his registered 'lusrname' (he tried to mock me both BEFORE & after I FAIRLY challenged him to show he's done better work - he had ZERO).
I'd never "cry victim" to ne'er-do-wells (TROLLS, not all /.ers) either.
U EVEN HELPED ME https://science.slashdot.org/c... (& then realizing it you quit trying to make me look bad via what you thought were lies on hosts as "ME" IN YOUR IMPERSONATIONS of me e.g. https://tech.slashdot.org/comm... on speculative execution attack: Hosts PREVENT 'EM, joke's on you)
APK
P.S.=> 2nd to last link's KILLING U THAT U HELPED ME & got me to see if hosts stop portsmash/meltdown/spectre & yes - hosts WORK on 'em - U LOSE + FAIL a PORTFILTER TEST https://yro.slashdot.org/comme...
xkcd: Free
AVM, the maker of the most popular router "Fritz!Box" (and for good reasons), will have this on their boxes. Big and fat. They're the type or manufacturer who offers free updates to entirely new versions of their FritzOS, with all new features that the hardware can manage, even years later. Security patches often even are in the local tech news.
Which means, everyone who doesn't have this certification, has even less of a chance of competing against them.
There are people here, who pick their ISP based on who gives them the best FritzBox. Not even having a (maybe branded) FritzBox included, is often grounds for exclusion.
Trust me, this will have an effect on the majority of people in Germany.
(Provided AVM doesn’t already do all that’s demanded.)
In Germany you buy a reasonably recent Fritz!Box and get security updates for several years. For the internationals.. this is the most popular Cable/DSL WiFi router in Germany and to be honest, for a very good reason. Really really good stuff.
> The router must allow any authenticated user to change [the wifi] password.
> The procedure of changing the WiFi password should not show a password strength meter or force users to use special characters.
Wtf?
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Can you hear the Stalin-organ already?
â
Not the faintest sign of skepticism in the summary? This "certification", which is voluntary by the way, has been heavily criticized by CCC and the OpenWRT project, cf. https://translate.googleusercontent.com/translate_c?depth=1&hl=de&nv=1&rurl=translate.google.com&sl=de&sp=nmt4&tl=en&u=https://www.heise.de/newsticker/meldung/IT-Sicherheit-CCC-kritisiert-BSI-Routerrichtlinie-scharf-4226397.html
Guidelines are not rules or laws or even Best Practices. They're just suggestions. And vague ones at that, which allow the person using them to figure out all the details of how and when and what.
Guidelines are like saying "you ought to have painted walls" but leaving the paint color and even the wall material (brick, plaster, drywall, stucco, recycled political signs) up to the occupant.
We've HAD this sort of thing in routers for years. Everybody had some base standards to follow and went off on their own to implement it. It didn't exactly work well, and hell, that's part of why it's a mess now. Although another huge part is the industry settling on single suppliers like Broadcom and then implementing the same hardware and software across hundreds of models. So everybody look under your chairs. Yes YOU get a vulnerability and YOU get a vulnerability and YOU get a vulnerability.
Sig for hire.
We've seen this with "heart-safe" and "halal-safe" foodstuffs: Vendors perform certification for 2 or 3 years, then decide it isn't going to attract more customers so they stop buying the sticker.