8 ms·

Asus lawsuit puts entire industry on notice over shoddy router security

120 points by transpute 11y ago

manyxcxi 11y ago
I really hope this leads to some change some day. If router makers can be held accountable for not providing minimum security standards then maybe we'll stop seeing so many "me too" BS options and gimmicks and get a smaller stable of trustworthy routers/firmwares. It kind of sucks that my first requirement for buying a router is that I must be able to immediately, and easily, flash a new firmware on to it. It doesn't matter whose makes them, you are going to be receiving absolute shit for an OS, save for maybe a few prestige models of some of the better brands. I liked the TP-Link Archer C7s because they were easy to flash and came with some pretty nice hardware for the price. Their products have been badly vulnerable, and now they're locking out alternative firmware. So even when you find a brand/model you like, that may not last.
- threatofrain 11y ago
  The thing is that security is a fuzzy boundary, so no amount of case law or statutes can draw an easy-to-understand line between negligent insecurity and acceptable insecurity, and the legal community is ill-equipped to make excellent technological laws. Also, there's no engineering society that censures its members and creates standards or certifications for quality or security, and it doesn't look like engineers are too interested in that. Medical malpractice or unethical behavior are also fuzzy lines, but at least there's a medical association that draws some kind of line, determines standards for membership, and censures its members for malpractice or bad behavior, thereby also improving its public image as a trustworthy institution.
  - BogusIKnow 11y ago
    You've nailed it.
ck2 11y ago
Except part of the "solution" is going to be mandating signed firmware, which means you won't be able to actually own your router anymore. TP-Link has already fallen victim to this. You can take openwrt, ddwrt, tomato and padavan from my cold dead hands.
- banku_brougham 11y ago
  can you provide a link showing how to use these things? (Openwrt...etc) I want to but networking is such a dark place for me.
  - icebraining 11y ago
    https://wiki.openwrt.org/doc/start https://wiki.openwrt.org/doc/start
  - ck2 11y ago
    OpenWRT is plain vanilla and probably a hard place to start if you don't understand terminology, etc. Try Tomato for a friendlier newbie environment. Google your router to see what alternate firmwares are available for it and never buy a new router unless you know one of the alternatives is available for it because most factory firmware is full of holes.
    - wtallis 11y ago
      What do you find friendlier about Tomato than modern OpenWRT? The latter has more features, but from what I recall of Tomato it really wasn't much different about how it presented the core functionality.
      - ck2 11y ago
        You can't be suggesting OpenWRT is newbie-friendly. Powerful and flexible, yes. Newbie or casual-user friendly, no. If Tomato is not enough, then DD-WRT, but Tomato being more stripped down becomes more newbie friendly by default.
Isamu 11y ago
>The action should serve as a wake-up call, not just for other router makers, but entire industries tied to the so-called Internet of Things wave that's adding Internet connectivity to refrigerators, watches, and other everyday devices. Over the past few years, researchers have uncovered a litany of security defects that make it possible for such devices to be remotely hijacked by attackers. Often, the hackers can use their position to install malicious code on the devices or to surreptitiously monitor the comings and goings of the owners. Pretty much what we've all been saying here.
- x0x0 11y ago
  I think it's time to encode in law security requirements, a minimum timespan for security patches to be provided post purchase, a maximum timeframe for security patch provision, and liability for unpatched security holes.
  - _delirium 11y ago
    Just normal consumer-protection and product-liability law ought to take care of it for the most part, if really applied. Computer software has somehow managed to almost entirely escape liability, avoiding legal responsibility for shipping software with serious defects that makes it not fit for advertised purpose. But I suspect people shipping physical devices will find it harder to avoid, because the legal regime for physical devices like ovens and toasters is well established. Nest being forced to issue a product recall of its thermostats over a software flaw is one example of this starting to play out.
    - mtgx 11y ago
      Samsung is actually in a lawsuit in the EU over this right now. The lawsuit says Samsung should provide at least 2 years of software updates as part of the 2 year mandatory "warranty".
    - reitanqild 11y ago
      > Computer software has somehow managed to almost entirely escape liability, avoiding legal responsibility for shipping software with serious defects that makes it not fit for advertised purpose. So did early car manufacturers etc etc. Personally I think if everything had been thoroughly regulated from the start a lot of the innovations we are all benefiting from today wouldn't have happened or would have taken far longer time. So I am not against regulations, but I can understand why waiting a bit and thinking very carefully before implementing regulation might be smart.
AdmiralAsshat 11y ago
While I have no doubt that OpenWRT/DD-WRT are better than the stock firmware provided on these routers, has anyone actually audited OpenWRT for exploits?
- AnthonyMouse 11y ago
  The root of the problem is more that the stock routers can't be or aren't updated when e.g. there is a Linux kernel or libc vulnerability.
DanBlake 11y ago
I think the most egregious issue that the asus routers had (even up to the RT-N66U) was that when you used the interface to check for a firmware update, it would report you were on the latest update, even if you were multiple patches behind.
- curun1r 11y ago
  The most egregious, for me, is that while they published the source code for their firmware as GPL (good) they were too lazy to incorporate fixes made by a third-party developer who was fed up with their buggy software and decided to do something about it. The AsusWRT Merlin builds are much higher quality and the source code to them is, per the GPL, also available. It's one thing to not fix security issues, it's another thing to have a single guy fixing your security problems and not even be bothered to take his work and pass it on to your customers. They deserve all the punishment they're receiving.
FLUX-YOU 11y ago
Medical device manufacturers should be the next industry to get put on notice about this.
TACIXAT 11y ago
The company I work for runs a home router based CTF at security conferences. So many of these products have vulnerabilities it's mind blowing. This IoT thing is a crazy trade off, we're getting really powerful devices but people are moving fast and really fucking shit up in terms of security. Some devs will know a good amount about security or their framework will cover them, but so many don't. The end result are networks with gaping holes in them waiting to be exploited.
AnthonyMouse 11y ago
Notice that this never happened with PCs because it was well expected for people to choose and install their own operating system, which is where the vulnerabilities lie. If you have an old PC and you don't want to throw it away then you can install a newer OS (or *nix) and your only problem is that it's old/slow, not that it's insecure. Make it trivially easy to install open source firmware and the security problem gets solved by the people who know more what they're doing.
acd 11y ago
I think its time for consumers to demand the ability to run open source operating systems on their devices! All consumer routers should have open device drivers. Right now its a lot of closed firmware from both router makers and the wireless radio chip manufacturers that prevents that. There is very few 802.11ac devices that is well supported by OpenWRT because of closed drivers and firmware. Lets face it, the manufacturer are not that interested in supporting the operating system of your device after a few years. Device manufacturers profit from selling you new devices not maintaining old devices. Throwing a perfect working hardware device just because it has outdated software is bad for the environment and not good when we have global warming. Do we want to have a Wall-E kind of future scenario of the working junk we consume and throw to consume to throw? This is of course not only consumer routers, all devices that run embedded software that the manufacturer stops caring for are in danger of getting hacked. If they can be hacked they will be hacked - hackers law. Why does consumer devices have to be that different from a PC? A PC can load any operating system you like on including good open source operating systems. This is also the same for cell phones, there are lots of Android devices with older releases that are not security updated.

120 points by transpute 11y ago

I really hope this leads to some change some day. If router makers can be held accountable for not providing minimum security standards then maybe we'll stop seeing so many "me too" BS options and gimmicks and get a smaller stable of trustworthy routers/firmwares. It kind of sucks that my first requirement for buying a router is that I must be able to immediately, and easily, flash a new firmware on to it. It doesn't matter whose makes them, you are going to be receiving absolute shit for an OS, save for maybe a few prestige models of some of the better brands. I liked the TP-Link Archer C7s because they were easy to flash and came with some pretty nice hardware for the price. Their products have been badly vulnerable, and now they're locking out alternative firmware. So even when you find a brand/model you like, that may not last.

threatofrain 11y ago
The thing is that security is a fuzzy boundary, so no amount of case law or statutes can draw an easy-to-understand line between negligent insecurity and acceptable insecurity, and the legal community is ill-equipped to make excellent technological laws. Also, there's no engineering society that censures its members and creates standards or certifications for quality or security, and it doesn't look like engineers are too interested in that. Medical malpractice or unethical behavior are also fuzzy lines, but at least there's a medical association that draws some kind of line, determines standards for membership, and censures its members for malpractice or bad behavior, thereby also improving its public image as a trustworthy institution.
- BogusIKnow 11y ago
  You've nailed it.

ck2 11y ago

Except part of the "solution" is going to be mandating signed firmware, which means you won't be able to actually own your router anymore. TP-Link has already fallen victim to this. You can take openwrt, ddwrt, tomato and padavan from my cold dead hands.

banku_brougham 11y ago
can you provide a link showing how to use these things? (Openwrt...etc) I want to but networking is such a dark place for me.
- icebraining 11y ago
  https://wiki.openwrt.org/doc/start https://wiki.openwrt.org/doc/start
- ck2 11y ago
  OpenWRT is plain vanilla and probably a hard place to start if you don't understand terminology, etc. Try Tomato for a friendlier newbie environment. Google your router to see what alternate firmwares are available for it and never buy a new router unless you know one of the alternatives is available for it because most factory firmware is full of holes.
  - wtallis 11y ago
    What do you find friendlier about Tomato than modern OpenWRT? The latter has more features, but from what I recall of Tomato it really wasn't much different about how it presented the core functionality.
    - ck2 11y ago
      You can't be suggesting OpenWRT is newbie-friendly. Powerful and flexible, yes. Newbie or casual-user friendly, no. If Tomato is not enough, then DD-WRT, but Tomato being more stripped down becomes more newbie friendly by default.

Isamu 11y ago

>The action should serve as a wake-up call, not just for other router makers, but entire industries tied to the so-called Internet of Things wave that's adding Internet connectivity to refrigerators, watches, and other everyday devices. Over the past few years, researchers have uncovered a litany of security defects that make it possible for such devices to be remotely hijacked by attackers. Often, the hackers can use their position to install malicious code on the devices or to surreptitiously monitor the comings and goings of the owners. Pretty much what we've all been saying here.

x0x0 11y ago
I think it's time to encode in law security requirements, a minimum timespan for security patches to be provided post purchase, a maximum timeframe for security patch provision, and liability for unpatched security holes.
- _delirium 11y ago
  Just normal consumer-protection and product-liability law ought to take care of it for the most part, if really applied. Computer software has somehow managed to almost entirely escape liability, avoiding legal responsibility for shipping software with serious defects that makes it not fit for advertised purpose. But I suspect people shipping physical devices will find it harder to avoid, because the legal regime for physical devices like ovens and toasters is well established. Nest being forced to issue a product recall of its thermostats over a software flaw is one example of this starting to play out.
  - mtgx 11y ago
    Samsung is actually in a lawsuit in the EU over this right now. The lawsuit says Samsung should provide at least 2 years of software updates as part of the 2 year mandatory "warranty".
  - reitanqild 11y ago
    > Computer software has somehow managed to almost entirely escape liability, avoiding legal responsibility for shipping software with serious defects that makes it not fit for advertised purpose. So did early car manufacturers etc etc. Personally I think if everything had been thoroughly regulated from the start a lot of the innovations we are all benefiting from today wouldn't have happened or would have taken far longer time. So I am not against regulations, but I can understand why waiting a bit and thinking very carefully before implementing regulation might be smart.

AdmiralAsshat 11y ago

While I have no doubt that OpenWRT/DD-WRT are better than the stock firmware provided on these routers, has anyone actually audited OpenWRT for exploits?

AnthonyMouse 11y ago
The root of the problem is more that the stock routers can't be or aren't updated when e.g. there is a Linux kernel or libc vulnerability.

DanBlake 11y ago

I think the most egregious issue that the asus routers had (even up to the RT-N66U) was that when you used the interface to check for a firmware update, it would report you were on the latest update, even if you were multiple patches behind.

curun1r 11y ago
The most egregious, for me, is that while they published the source code for their firmware as GPL (good) they were too lazy to incorporate fixes made by a third-party developer who was fed up with their buggy software and decided to do something about it. The AsusWRT Merlin builds are much higher quality and the source code to them is, per the GPL, also available. It's one thing to not fix security issues, it's another thing to have a single guy fixing your security problems and not even be bothered to take his work and pass it on to your customers. They deserve all the punishment they're receiving.

FLUX-YOU 11y ago

Medical device manufacturers should be the next industry to get put on notice about this.

TACIXAT 11y ago

The company I work for runs a home router based CTF at security conferences. So many of these products have vulnerabilities it's mind blowing. This IoT thing is a crazy trade off, we're getting really powerful devices but people are moving fast and really fucking shit up in terms of security. Some devs will know a good amount about security or their framework will cover them, but so many don't. The end result are networks with gaping holes in them waiting to be exploited.

AnthonyMouse 11y ago

Notice that this never happened with PCs because it was well expected for people to choose and install their own operating system, which is where the vulnerabilities lie. If you have an old PC and you don't want to throw it away then you can install a newer OS (or *nix) and your only problem is that it's old/slow, not that it's insecure. Make it trivially easy to install open source firmware and the security problem gets solved by the people who know more what they're doing.

acd 11y ago

I think its time for consumers to demand the ability to run open source operating systems on their devices! All consumer routers should have open device drivers. Right now its a lot of closed firmware from both router makers and the wireless radio chip manufacturers that prevents that. There is very few 802.11ac devices that is well supported by OpenWRT because of closed drivers and firmware. Lets face it, the manufacturer are not that interested in supporting the operating system of your device after a few years. Device manufacturers profit from selling you new devices not maintaining old devices. Throwing a perfect working hardware device just because it has outdated software is bad for the environment and not good when we have global warming. Do we want to have a Wall-E kind of future scenario of the working junk we consume and throw to consume to throw? This is of course not only consumer routers, all devices that run embedded software that the manufacturer stops caring for are in danger of getting hacked. If they can be hacked they will be hacked - hackers law. Why does consumer devices have to be that different from a PC? A PC can load any operating system you like on including good open source operating systems. This is also the same for cell phones, there are lots of Android devices with older releases that are not security updated.