7 ms·

AsusWRT sends network traffic data to Trend Micro if certain features enabled

79 points by cknight 9y ago

brudgers 9y ago
Please don't editorialize titles. The whole article is interesting. It's better to add a comment once the article appears on the |new| page. Title, Review: ASUSWRT router firmware Link to top of page, https://ctrl.blog/entry/review-asuswrt https://ctrl.blog/entry/review-asuswrt
- cknight 9y ago
  Thanks. I'll admit I am likely to still be somewhat Reddit-minded with sharing things, so I appreciate the criticism.
- pfooti 9y ago
  On the other hand, I probably would not have clicked through to the underlying article if it were not for the title as written (ASUS Router Sends Data to Third Party). The whole blog post feels a bit like an exercise in burying the lede. The rest of the review is interesting, for sure, and worth reading. But the actual bombshell here is that the firmware indeed sends data about your browsing to trend micro if you activate some of the firmware's advanced features.
  - deleted 9y ago
    [deleted]
- Karunamon 9y ago
  That title as given is completely uninteresting and does nothing to describe the interestingness of its content (or why the OP decided to post it in the first place).
knodi 9y ago
Hmm, any suggestions on a good router that won't spy on me?
- bisby 9y ago
  I wanted to be able to suggest using something like ubiquiti or mikrotik. But then I realize that I have no idea how secure/private those are either. I imagine pfSense is good (or any of the forks) for privacy. But that can be pretty overkill, and really shouldnt be necessary just for a small SOHO router.
- haswell 9y ago
  To be clear, this router does not spy on you. If you want to enable features like the virus detection service or traffic history / analysis, those features rely on upstream services and your data will be sent to ASUS / Trend Micro. Unless I'm missing something from the article, I won't be trading in my ASUS, I just won't be turning these features on.
- emeidi 9y ago
  Turris Omnia
  - throw2016 9y ago
    That's good but pricey. The new $49 expression bin board on kickstarter based on the Marvell Armada Aarch64 SOC with mainline support seems delightful for a router. But the Turris may be a more suitable alternative to an off the shelf router.
  - helb 9y ago
    Omnia has a similar opt-in feature. Everything is open source though (including hardware).
  - bubblethink 9y ago
    Omnia is a good concept, but the execution isn't quite there yet. I had ordered one, which I ended up returning due to a broken hardware part and less than stellar software. Maybe in a couple of years, it will be a solid platform.
- bubblethink 9y ago
  You can split it into a router and a wireless access point. Run pfsense or lede on the router, and use any commercial access point (ubiquiti seems to be a good bang for the buck).
PTRFRLL 9y ago
I wonder if Asuswrt-merlin does the same.
- vanadium 9y ago
  Last I checked (RT-AC87U owner here), most of the features are still there, but still opt-in. I believe there's one I can't name off the top of my head that was neutered, though.
- diimdeep 9y ago
  RMerl Eric Sauvageau - commented 13 minutes ago This article is based on speculation. A EULA doesn't say what is happening, it merely states what the company might be allowed to do. Asus is the one you will have to ask, I don't have any technical information on how the Trend Micro features work. https://github.com/RMerl/asuswrt-merlin/issues/1348 https://github.com/RMerl/asuswrt-merlin/issues/1348
infocollector 9y ago
So does Meraki, Cisco, ... Well they give you an option to send your data to the company.
- kkirsche 9y ago
  Asus provides it as an opt in option :) it's not on by default
sly010 9y ago
Btw anyone ever measured that gamer shaped wifi routers with fancy remote apps sell better? I was going to buy into Google's Wifi solution until I realized you manage it with an App. Is that really what customers want or is it just the marketers brainfart?
- jrimbault 9y ago
  Aren't those apps just a replacement for people who can't (or don't know how to) login into and manage their router ?
  - narrowrail 9y ago
    Typing in raw IPs in the URL bar is not something many laypeople are comfortable with exactly. Private LAN addresses seem odd if you navigate the web with a search engine.
    - jrimbault 9y ago
      That's what I mean yeah.
    - cptn_brittish 9y ago
      On the other hand some ruters use url's like http://routerlogin.net http://routerlogin.net and from my perspective that seems dodgy since that could mean all the routers are centrally configured somehow.
- ghostly_s 9y ago
  Apple's management app for the Airport line is one of the few great features of that product. So much more convenient than a web interface. Of course I don't trust anyone else to implement something half as good as what they did.
- bubblethink 9y ago
  Google's wifi solution looks interesting. I don't know how friendly they are to tinkering and third party firmware, but there doesn't seem to be a big community around it. In theory, it should be possible since they are based on chromium OS.
haswell 9y ago
I own an ASUS RT-AC68U. To be clear, this is an opt-in feature. When you switch the toggle button that enables any of these features, you're immediately greeted by the EULA, making it clear that what you're doing has more implications than just "turn the feature on". I wanted to see bandwidth usage history/analysis, so I was going to enable it. When I was greeted by the scary EULA, I backed out and didn't turn it on. To be fair, I'm not sure how a router like this could actually perform this functionality without sending information to an upstream service to manage the data. Simply not enough computing power / storage to support those features locally. I don't want to send my data to ASUS/Trend Micro, so I didn't enable it. I don't think there's anything malicious going on here.
- cknight 9y ago
  I am not sure why any bandwidth usage history, web history or QoS system would require Trend Micro's services.
  - haswell 9y ago
    If I recall correctly, they're doing more than just giving you a graph of bandwidth consumption. They're giving you views of the data that show which apps are consuming the most data among other things. I can imagine why this may need additional processing - maintaining a mapping of addresses that make up "Dropbox" traffic as an example. I always saw it as an attempt to put analysis/QoS tools into non-technical hands. You can absolutely do many of these things by yourself, but that's not who they're targeting.
    - cknight 9y ago
      I can certainly understand how some features in the list would require sending user data to Trend Micro - blocking malware domains, for example. This makes sense - and it already happens with all the major browsers. I am less sure why, for many of the other examples in the list, the router can't just receive updates from ASUS/Trend Micro without sending user data abroad. Maintaining a local list of common software and popular services is not that onerous for such a device. People with less common software are not likely, as you said, to be who they are targeting. As I understand the article, the current EULA means I have to give access to my data to a third party if I want my router to receive some useful information (say, mapping) from them. This is information which they could just give my router anyway, without needing my data, in many of the cases for which the EULA is required.
NKCSS 9y ago
Google and Microsoft do the same to check URL reputation...
MegaDeKay 9y ago
Even more reason to install alternative firmware. I run Tomato by Shibby on my Asus and it works great. http://tomato.groov.pl/ http://tomato.groov.pl/
- kkirsche 9y ago
  Not really, it's opt in and provides a EULA
  - Pxtl 9y ago
    For features that really don't seem like they should require this opt-in and EULA nonsense.
MarkG509 9y ago
I use an Asus RT-68P. The EULA did scare me off from running all of the services listed in the article, with the exception of "Web History", where I do not recall having seen any indication that my history would be leaked. But, regardless I just turned off that function. I agree with the author's disappointment in Dynamic DNS support. But, I followed instructions on the web[1] and added a cheap USB thumb-drive to run a script on every router boot. This script sets up a cron job that supports DuckDNS.org, and fixes other annoyances like turning off all the router's LEDs. [1] https://www.securityforrealpeople.com/2015/08/cron-on-asus.html https://www.securityforrealpeople.com/2015/08/cron-on-asus.h... Edit: Grammar, and a clarification.

79 points by cknight 9y ago

Please don't editorialize titles. The whole article is interesting. It's better to add a comment once the article appears on the |new| page. Title, Review: ASUSWRT router firmware Link to top of page, https://ctrl.blog/entry/review-asuswrt https://ctrl.blog/entry/review-asuswrt

cknight 9y ago
Thanks. I'll admit I am likely to still be somewhat Reddit-minded with sharing things, so I appreciate the criticism.
pfooti 9y ago
On the other hand, I probably would not have clicked through to the underlying article if it were not for the title as written (ASUS Router Sends Data to Third Party). The whole blog post feels a bit like an exercise in burying the lede. The rest of the review is interesting, for sure, and worth reading. But the actual bombshell here is that the firmware indeed sends data about your browsing to trend micro if you activate some of the firmware's advanced features.
- deleted 9y ago
  [deleted]
Karunamon 9y ago
That title as given is completely uninteresting and does nothing to describe the interestingness of its content (or why the OP decided to post it in the first place).

knodi 9y ago

Hmm, any suggestions on a good router that won't spy on me?

bisby 9y ago
I wanted to be able to suggest using something like ubiquiti or mikrotik. But then I realize that I have no idea how secure/private those are either. I imagine pfSense is good (or any of the forks) for privacy. But that can be pretty overkill, and really shouldnt be necessary just for a small SOHO router.
haswell 9y ago
To be clear, this router does not spy on you. If you want to enable features like the virus detection service or traffic history / analysis, those features rely on upstream services and your data will be sent to ASUS / Trend Micro. Unless I'm missing something from the article, I won't be trading in my ASUS, I just won't be turning these features on.
emeidi 9y ago
Turris Omnia
- throw2016 9y ago
  That's good but pricey. The new $49 expression bin board on kickstarter based on the Marvell Armada Aarch64 SOC with mainline support seems delightful for a router. But the Turris may be a more suitable alternative to an off the shelf router.
- helb 9y ago
  Omnia has a similar opt-in feature. Everything is open source though (including hardware).
- bubblethink 9y ago
  Omnia is a good concept, but the execution isn't quite there yet. I had ordered one, which I ended up returning due to a broken hardware part and less than stellar software. Maybe in a couple of years, it will be a solid platform.
bubblethink 9y ago
You can split it into a router and a wireless access point. Run pfsense or lede on the router, and use any commercial access point (ubiquiti seems to be a good bang for the buck).

PTRFRLL 9y ago

I wonder if Asuswrt-merlin does the same.

vanadium 9y ago
Last I checked (RT-AC87U owner here), most of the features are still there, but still opt-in. I believe there's one I can't name off the top of my head that was neutered, though.
diimdeep 9y ago
RMerl Eric Sauvageau - commented 13 minutes ago This article is based on speculation. A EULA doesn't say what is happening, it merely states what the company might be allowed to do. Asus is the one you will have to ask, I don't have any technical information on how the Trend Micro features work. https://github.com/RMerl/asuswrt-merlin/issues/1348 https://github.com/RMerl/asuswrt-merlin/issues/1348

infocollector 9y ago

So does Meraki, Cisco, ... Well they give you an option to send your data to the company.

kkirsche 9y ago
Asus provides it as an opt in option :) it's not on by default

sly010 9y ago

Btw anyone ever measured that gamer shaped wifi routers with fancy remote apps sell better? I was going to buy into Google's Wifi solution until I realized you manage it with an App. Is that really what customers want or is it just the marketers brainfart?

jrimbault 9y ago
Aren't those apps just a replacement for people who can't (or don't know how to) login into and manage their router ?
- narrowrail 9y ago
  Typing in raw IPs in the URL bar is not something many laypeople are comfortable with exactly. Private LAN addresses seem odd if you navigate the web with a search engine.
  - jrimbault 9y ago
    That's what I mean yeah.
  - cptn_brittish 9y ago
    On the other hand some ruters use url's like http://routerlogin.net http://routerlogin.net and from my perspective that seems dodgy since that could mean all the routers are centrally configured somehow.
ghostly_s 9y ago
Apple's management app for the Airport line is one of the few great features of that product. So much more convenient than a web interface. Of course I don't trust anyone else to implement something half as good as what they did.
bubblethink 9y ago
Google's wifi solution looks interesting. I don't know how friendly they are to tinkering and third party firmware, but there doesn't seem to be a big community around it. In theory, it should be possible since they are based on chromium OS.

haswell 9y ago

I own an ASUS RT-AC68U. To be clear, this is an opt-in feature. When you switch the toggle button that enables any of these features, you're immediately greeted by the EULA, making it clear that what you're doing has more implications than just "turn the feature on". I wanted to see bandwidth usage history/analysis, so I was going to enable it. When I was greeted by the scary EULA, I backed out and didn't turn it on. To be fair, I'm not sure how a router like this could actually perform this functionality without sending information to an upstream service to manage the data. Simply not enough computing power / storage to support those features locally. I don't want to send my data to ASUS/Trend Micro, so I didn't enable it. I don't think there's anything malicious going on here.

cknight 9y ago
I am not sure why any bandwidth usage history, web history or QoS system would require Trend Micro's services.
- haswell 9y ago
  If I recall correctly, they're doing more than just giving you a graph of bandwidth consumption. They're giving you views of the data that show which apps are consuming the most data among other things. I can imagine why this may need additional processing - maintaining a mapping of addresses that make up "Dropbox" traffic as an example. I always saw it as an attempt to put analysis/QoS tools into non-technical hands. You can absolutely do many of these things by yourself, but that's not who they're targeting.
  - cknight 9y ago
    I can certainly understand how some features in the list would require sending user data to Trend Micro - blocking malware domains, for example. This makes sense - and it already happens with all the major browsers. I am less sure why, for many of the other examples in the list, the router can't just receive updates from ASUS/Trend Micro without sending user data abroad. Maintaining a local list of common software and popular services is not that onerous for such a device. People with less common software are not likely, as you said, to be who they are targeting. As I understand the article, the current EULA means I have to give access to my data to a third party if I want my router to receive some useful information (say, mapping) from them. This is information which they could just give my router anyway, without needing my data, in many of the cases for which the EULA is required.

NKCSS 9y ago

Google and Microsoft do the same to check URL reputation...

MegaDeKay 9y ago

Even more reason to install alternative firmware. I run Tomato by Shibby on my Asus and it works great. http://tomato.groov.pl/ http://tomato.groov.pl/

kkirsche 9y ago
Not really, it's opt in and provides a EULA
- Pxtl 9y ago
  For features that really don't seem like they should require this opt-in and EULA nonsense.

MarkG509 9y ago

I use an Asus RT-68P. The EULA did scare me off from running all of the services listed in the article, with the exception of "Web History", where I do not recall having seen any indication that my history would be leaked. But, regardless I just turned off that function. I agree with the author's disappointment in Dynamic DNS support. But, I followed instructions on the web[1] and added a cheap USB thumb-drive to run a script on every router boot. This script sets up a cron job that supports DuckDNS.org, and fixes other annoyances like turning off all the router's LEDs. [1] https://www.securityforrealpeople.com/2015/08/cron-on-asus.html https://www.securityforrealpeople.com/2015/08/cron-on-asus.h... Edit: Grammar, and a clarification.