5 ms·

This is why your routers should run open source software. At least then you can reinstall it and be reasonably assured it does not have malware. Also we need a

• acd 11y ago
  I have not inspected the full source of Linux but I have read parts of it. I suspect other hackers also read parts of the source and will spot if there is anything fishy in there. The point is that should be able to read the source code like a recepie for your cake. If someone hides the recepie and tells you its a yummy cake but you know its full of exploits its not. Main point is, if it can be hacked it will be hacked. It´s better that we can read the source code and verify that the software in our devices has not been tampered with.
• snowy 11y ago
  Routers used by most networks are proprietary boxes from specific vendors. There is no such thing as open source software for them. I do not know of an open source router hardware that is available (at ISP scale) Getting an X86 box and throwing freebsd and quagga on it might work for small amounts of traffic. But for ISP scale bandwidth your stuck with a few main vendors...
  • rsync 11y ago
    "I do not know of an open source router hardware that is available (at ISP scale)" You're basically correct but it's worth remembering that it is possible to add a bunch of quad nics to whitebox and run bpf on it, courtesy of one of the BSDs and do real routing at an ISP scale. That would be completely open source (and quite secure). Probably pretty performant if you knew what you were doing.
    • snowy 11y ago
      yep, but you are never going to get a generic processor architecture to have anywhere near the performance of custom silicon ASICs designed for specifically for routing packets. No matter what software you put on top of it. Its never going to work in a core network routing 100s of gigs of traffic. So it's not going to work for ISPs
  • Zigurd 11y ago
    This story is about Cisco IOS ROMMON. AFAIK that limits the issue to enterprise-class routers. Such routers can be replaced with PC-based routers running open software.
• msellout 11y ago
  Not really, this same vulnerability would apply to F/OSS. It's just that the users never changed the password from the factory default. The article is sensationalist, but it's not news.
• roel_v 11y ago
  " At least then you can reinstall it and be reasonably assured it does not have malware." How so? Is there anywhere a list of hashes of software that multiple people independently from each other verified, compiled (and compared)? Because without that, "open source" adds 0 to security in the scenarios we are talking about here. Additionally, how many packages/firmwares have you inspected the last, let's say, decade? If I were a betting man, I'd put my money on 'less than I can count on one hand' (well maybe you're in infosec and get paid for audits...)
  • Swannie 11y ago
    Why has this been downvoted? It's an important argument. Which open source projects have deterministic builds, with a verifiable source of signature information - be that concensus or a source of truth that is verfied by concensus, so that I can be sure that either a) the binary I download has a very high certainty of being correct, or b) the source code I downloaded and compiled from has a very high certainty of being un-modified. With a vendor, they don't need deterministic builds so badly, as they push a single file, and an authoritative source of signatures.
    • schoen 11y ago
      Ultimately a vendor needs deterministic builds too. Otherwise, it doesn't necessarily know what it's shipping! I have an example of a binary where the difference between a remotely exploitable service and a fixed version of the same service is a single bit. That bit (or some other bit that also changes the code's functionality in an important way) can be changed by any person or (potentially compromised) computer in the chain of compilation, packaging, and distribution unless someone has a way to tell whether what those people and computers assert is "correct". If the binaries routinely change appreciably every time someone cuts a software release, it's going to be expensive to go back and check whether there's also a malicious change, bearing in mind that the person whose computer made the change doesn't have to have been malicious.
      • roel_v 11y ago
        Sure, my point was that open source doesn't matter anything for this attack vector. I have yet to see anyone with reproducible builds being used and cared about in production. It's too expensive, and impractical. How are you going to verify that a system you just installed is OK? An attacker would've patched the md5sum (or other hashing) utility as well, so you'd need to mount you whole filesystem from another (trusted) machine, run the checksum on each file from that other machine, and compare with a known-good (through a reputation network) list. And in the mean time, a million monkeys have social-engineered your secretary's machine through a Farmville js trick and pwned your network 3 ways from Sunday.
• WalterBright 11y ago
  Even better: routers should have a physical switch where flashing the firmware can be disabled. Malware wouldn't survive a reboot.
  • tedunangst 11y ago
    The likely result of that is even more routers running unpatched vulnerable software.