Slashdot Mirror
Germany Proposes Router Security Guidelines (zdnet.com)
German government would like to regulate what kind of routers are sold and installed across the country. From a report: The German government published at the start of the month an initial draft for rules on securing Small Office and Home Office (SOHO) routers. Published by the German Federal Office for Information Security (BSI), the rules have been put together with input from router vendors, German telecoms, and the German hardware community. Once approved, router manufacturers don't have to abide by these requirements, but if they do, they can use a special sticker on their products showing their compliance. The 22-page document, available in English here, lists tens of recommendations and rules for various router functions and features.
I'm confused about this rule: "Only DNS, HTTP, HTTPS, DHCP, DHCPv6, and ICMPv6 services should be available on the LAN and WiFi interface"
What about SSH, VPN, VPN-over-SSH, etc? Are they saying that other than those few services, no other services should be passed through to the Internet? Or that the router ITSELF shouldn't provide services other than those six?
Some interesting stuff in that document.
- By default the router must only offer DNS, ping response and a web interface to devices on the LAN. Seems like even UPnP is disabled.
- Default SSID must not give anything away, such as the manufacturer of the router. Not sure what exactly the point is, considering that things like the MAC address reveal that.
- Half decent default passwords.
- Manufacturer must state how long they supply updates for and what severity level merits a patch.
- IPv6 is optional.
Seems rather basic to be honest.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
I give you my sticker for half the price they do.
The draft sets out to not only list what expectations/requirements routers will need, but it explains, in layman's terms, the reasoning behind it all. The best way to secure a thing is to properly educate those that are using it.
Politics; n. : A religion whereby man is god.
...not a regulatory programme. Even TFA calls them guidelines. It is a sad day when the Slashdot editors are worse than the press for adding fud.
is to simply hold the manufacturers of said hardware fully liable for the half-assed products they sell.
Great big eye-opening-with-cries-of-thats-not-fair-from-the-companies-who-peddle-this-shit fines with the option to forgo said fines if the CEO goes to jail for a decade instead.
Industry only takes security seriously when it impacts their profits.
No NTP or ICMPv4?
Just a thought: At least here in the U.S., Underwriters Laboratory does electrical testing on products to ensure they're safe. Why not expand their role in the case of computing equipment like this (and perhaps also so-called 'IoT' devices) to test for vulnerabilities? Basically, throw a bunch of attacks at Internet-facing devices and see if you can crack them. As new exploits are discovered, expand the suite of testing to include those attacks. Would never be 100% because exploits and attack methods seem to evolve faster than they can code around them, but it would likely be better than these manufacturers have been doing on their own.
... the rules have been put together with input from router vendors, German telecoms, and the German hardware community.
No input from the IT people wearing boots? Expectations of fixing problems by those who are the problem ...
It little behooves the best of us to comment on the rest of us.
xkcd: Free
AVM, the maker of the most popular router "Fritz!Box" (and for good reasons), will have this on their boxes. Big and fat. They're the type or manufacturer who offers free updates to entirely new versions of their FritzOS, with all new features that the hardware can manage, even years later. Security patches often even are in the local tech news.
Which means, everyone who doesn't have this certification, has even less of a chance of competing against them.
There are people here, who pick their ISP based on who gives them the best FritzBox. Not even having a (maybe branded) FritzBox included, is often grounds for exclusion.
Trust me, this will have an effect on the majority of people in Germany.
(Provided AVM doesn’t already do all that’s demanded.)
In Germany you buy a reasonably recent Fritz!Box and get security updates for several years. For the internationals.. this is the most popular Cable/DSL WiFi router in Germany and to be honest, for a very good reason. Really really good stuff.
> The router must allow any authenticated user to change [the wifi] password.
> The procedure of changing the WiFi password should not show a password strength meter or force users to use special characters.
Wtf?
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Not the faintest sign of skepticism in the summary? This "certification", which is voluntary by the way, has been heavily criticized by CCC and the OpenWRT project, cf. https://translate.googleusercontent.com/translate_c?depth=1&hl=de&nv=1&rurl=translate.google.com&sl=de&sp=nmt4&tl=en&u=https://www.heise.de/newsticker/meldung/IT-Sicherheit-CCC-kritisiert-BSI-Routerrichtlinie-scharf-4226397.html
Guidelines are not rules or laws or even Best Practices. They're just suggestions. And vague ones at that, which allow the person using them to figure out all the details of how and when and what.
Guidelines are like saying "you ought to have painted walls" but leaving the paint color and even the wall material (brick, plaster, drywall, stucco, recycled political signs) up to the occupant.
We've HAD this sort of thing in routers for years. Everybody had some base standards to follow and went off on their own to implement it. It didn't exactly work well, and hell, that's part of why it's a mess now. Although another huge part is the industry settling on single suppliers like Broadcom and then implementing the same hardware and software across hundreds of models. So everybody look under your chairs. Yes YOU get a vulnerability and YOU get a vulnerability and YOU get a vulnerability.
Sig for hire.