4 ms·

Your N300 is not getting security updates, but my OnHub is.

semi-extrinsic 10y ago
Pray tell, security updates for what? My router has all WAN-side management features etc. turned off, WPS is turned off and it has a long random WPA passphrase. Unless someone breaks into my apartment, there just isn't a significant potential for security risks that I'm aware of.
- delroth 10y ago
  Unless you also disable execution of Javascript on all the devices that connect to your network (including your phones, set-top boxes, etc.), these devices can be used to attack your router from the LAN. Just use Javascript to autosubmit a form with action="http://192.168.1.1/exploitable/endpoint/" http://192.168.1.1/exploitable/endpoint/" (you can autodetect the IP, look for Javascript port scanners on Google) and you're in. And before you say that DD-WRT is not $WEIRD_CHINESE_BRAND and obviously doesn't have such vulnerabilities on its HTTP interface that can be accessed without auth, see https://www.cvedetails.com/vulnerability-list/vendor_id-9341/product_id-16564/Dd-wrt-Dd-wrt.html https://www.cvedetails.com/vulnerability-list/vendor_id-9341... for some real examples, including "getting root by sending an HTTP query that doesn't require any authentication". In fact, for that remote root exploit, disabling Javascript execution wouldn't even help that much, because it can be triggered through e.g. <img src="..."/> on any HTML page you visit (with some guessing required for the IP address, but there are only so many IPs people commonly use for their gateway).
  - shiftpgdn 10y ago
    DD-WRT allows you to set access control lists. A simple protection would be only allow device with X MAC address to see the admin page(s). That device could be a virtual machine that only exists to manage the router.
  - greggman 10y ago
    How is that any more secure? Are you sure every native app on your phone isn't sending the correct network packets to your router to reconfigure it? Seems like in either case all you need is a password to protect either in a secure enough way. Or isolate the router config on its own vlan
  - slrz 10y ago
    Or simply disable the freakin' web interface if people just can't get it secure? You should still apply security fixes for (relevant) kernel and sshd issues, of course.
  - dzhiurgis 10y ago
    At this point it would be the best if Google just contributed to OpenWRT project itself.
- victorhooi 10y ago
  All products probably have (undiscovered) security holes - whether it's issues with the firewall, issues with the management console, SSL vulnerabilities, manufacturer backholes that get discovered later, or vulnerability in the wireless encryption scheme - this is stuff we find out later (if we knew about it earlier, it would have been fixed). Having security updates pushed to your phone is never a bad thing. It's the reason why enterprise Linux distro updates promise security patches (but possibly not bug fixes) for such a long period - because people do care about these things. Security patches are a good thing.
- nopinrop 10y ago
  Those precautions alone won't save you from CSRF and XSS vulnerabilities common in SOHO routers.
- TheSpiceIsLife 10y ago
  Agreed. I'm way more concerned about my computers and phones being compromised than I am my router. In comparison to the other devices I use the router has a tiny attack surface.
  - ithkuil 10y ago
    good thing the world is slowly moving to TLS, because your router, with its tiny attack surface, is the prototypical man in the middle

Pray tell, security updates for what? My router has all WAN-side management features etc. turned off, WPS is turned off and it has a long random WPA passphrase. Unless someone breaks into my apartment, there just isn't a significant potential for security risks that I'm aware of.

delroth 10y ago
Unless you also disable execution of Javascript on all the devices that connect to your network (including your phones, set-top boxes, etc.), these devices can be used to attack your router from the LAN. Just use Javascript to autosubmit a form with action="http://192.168.1.1/exploitable/endpoint/" http://192.168.1.1/exploitable/endpoint/" (you can autodetect the IP, look for Javascript port scanners on Google) and you're in. And before you say that DD-WRT is not $WEIRD_CHINESE_BRAND and obviously doesn't have such vulnerabilities on its HTTP interface that can be accessed without auth, see https://www.cvedetails.com/vulnerability-list/vendor_id-9341/product_id-16564/Dd-wrt-Dd-wrt.html https://www.cvedetails.com/vulnerability-list/vendor_id-9341... for some real examples, including "getting root by sending an HTTP query that doesn't require any authentication". In fact, for that remote root exploit, disabling Javascript execution wouldn't even help that much, because it can be triggered through e.g. <img src="..."/> on any HTML page you visit (with some guessing required for the IP address, but there are only so many IPs people commonly use for their gateway).
- shiftpgdn 10y ago
  DD-WRT allows you to set access control lists. A simple protection would be only allow device with X MAC address to see the admin page(s). That device could be a virtual machine that only exists to manage the router.
- greggman 10y ago
  How is that any more secure? Are you sure every native app on your phone isn't sending the correct network packets to your router to reconfigure it? Seems like in either case all you need is a password to protect either in a secure enough way. Or isolate the router config on its own vlan
- slrz 10y ago
  Or simply disable the freakin' web interface if people just can't get it secure? You should still apply security fixes for (relevant) kernel and sshd issues, of course.
- dzhiurgis 10y ago
  At this point it would be the best if Google just contributed to OpenWRT project itself.
victorhooi 10y ago
All products probably have (undiscovered) security holes - whether it's issues with the firewall, issues with the management console, SSL vulnerabilities, manufacturer backholes that get discovered later, or vulnerability in the wireless encryption scheme - this is stuff we find out later (if we knew about it earlier, it would have been fixed). Having security updates pushed to your phone is never a bad thing. It's the reason why enterprise Linux distro updates promise security patches (but possibly not bug fixes) for such a long period - because people do care about these things. Security patches are a good thing.
nopinrop 10y ago
Those precautions alone won't save you from CSRF and XSS vulnerabilities common in SOHO routers.
TheSpiceIsLife 10y ago
Agreed. I'm way more concerned about my computers and phones being compromised than I am my router. In comparison to the other devices I use the router has a tiny attack surface.
- ithkuil 10y ago
  good thing the world is slowly moving to TLS, because your router, with its tiny attack surface, is the prototypical man in the middle