4 ms·

I wonder if a factory reset is enough in all cases - the source for the factory reset has to be on the device itself. I haven't played with it much, but there

I wonder if a factory reset is enough in all cases - the source for the factory reset has to be on the device itself. I haven't played with it much, but there are ways to persist after a reset on Android, I'd assume the same is possible here. Very happy to be corrected. Anyone know what the cheapest Linksys I could buy is, and whether these vulnerabilities have been released publicly?

lamlam 9y ago
If the security of your router is of concern to you I would recommend setting up your own FreeBSD+pfSense router. Another option is to setup a vpn server that all your devices connect to to access the internet. In that scenario it won't matter if your router is compromised because all traffic flowing through would be encrypted.
- posguy 9y ago
  PFSense runs PHP as root. Let that just sink in for a second, does that sound like a recipe for security? Nevermind the community, when it comes to vaguely complex things like IPTV and similar, support is either legacy or gone. At this point OpenWRT is the only sane choice, at least it doesn't run everything as root and isn't going to shove off Multicast UDP packet forwarding support in the next year or two.
  - voltagex_ 9y ago
    OpenWRT definitely has quirks, and my vendor thinks spawning hundreds of socat processes is acceptable in production firmware: https://forum.turris.cz/t/ever-increasing-leaking-nuci-process/3743/7 https://forum.turris.cz/t/ever-increasing-leaking-nuci-proce...
rickycook 9y ago
i'm not saying it's happened here, but i'd imagine with router firmware (because it's not too large) it'd be pretty cheap to have a copy of the factory firmware and settings in a physically read only storage of some kind
- voltagex_ 9y ago
  You're correct in some cases. My last "consumer" router was a TP Link Archer D9 and doing a factory reset only restored the last flashed version of the firmware - so that partition was writeable during updates at least.
throwanem 9y ago
Yeah, I'd think it would take a reflash to get rid of the compromise, since the compromise is implemented by means of firmware replacement to begin with. Probably your cheapest bet on the supported device list (ca. p27 of the PDF on Wikileaks) would be a WRT54G v5. The GL models have some support as well, but last I checked they had a relatively high used value, presumably for their hackability - the G models are much more limited.
willstrafach 9y ago
> Anyone know what the cheapest Linksys I could buy is, and whether these vulnerabilities have been released publicly? To be clear, the main "vulnerability" is just ability to get physical access and re-flash the devices with a custom firmware which allows the access to the target network. The best defense would be locking down the router physically and setting a strong password for the admin portal.
bsamuels 9y ago
A factory reset _is not_ enough. A factory reset will just clear a part of the NVRAM that holds configuration - any firmware implant will still be on the device. There were no vulnerabilities included in the cherryblossom leak. The firmware implant deployment instructions included in the leak don't mention using any vulnerabilities either. Almost all of the devices listed in the cherryblossom leak are not being sold anymore.

lamlam 9y ago

If the security of your router is of concern to you I would recommend setting up your own FreeBSD+pfSense router. Another option is to setup a vpn server that all your devices connect to to access the internet. In that scenario it won't matter if your router is compromised because all traffic flowing through would be encrypted.

posguy 9y ago
PFSense runs PHP as root. Let that just sink in for a second, does that sound like a recipe for security? Nevermind the community, when it comes to vaguely complex things like IPTV and similar, support is either legacy or gone. At this point OpenWRT is the only sane choice, at least it doesn't run everything as root and isn't going to shove off Multicast UDP packet forwarding support in the next year or two.
- voltagex_ 9y ago
  OpenWRT definitely has quirks, and my vendor thinks spawning hundreds of socat processes is acceptable in production firmware: https://forum.turris.cz/t/ever-increasing-leaking-nuci-process/3743/7 https://forum.turris.cz/t/ever-increasing-leaking-nuci-proce...

rickycook 9y ago

i'm not saying it's happened here, but i'd imagine with router firmware (because it's not too large) it'd be pretty cheap to have a copy of the factory firmware and settings in a physically read only storage of some kind

voltagex_ 9y ago
You're correct in some cases. My last "consumer" router was a TP Link Archer D9 and doing a factory reset only restored the last flashed version of the firmware - so that partition was writeable during updates at least.

throwanem 9y ago

Yeah, I'd think it would take a reflash to get rid of the compromise, since the compromise is implemented by means of firmware replacement to begin with. Probably your cheapest bet on the supported device list (ca. p27 of the PDF on Wikileaks) would be a WRT54G v5. The GL models have some support as well, but last I checked they had a relatively high used value, presumably for their hackability - the G models are much more limited.

willstrafach 9y ago

> Anyone know what the cheapest Linksys I could buy is, and whether these vulnerabilities have been released publicly? To be clear, the main "vulnerability" is just ability to get physical access and re-flash the devices with a custom firmware which allows the access to the target network. The best defense would be locking down the router physically and setting a strong password for the admin portal.

bsamuels 9y ago

A factory reset _is not_ enough. A factory reset will just clear a part of the NVRAM that holds configuration - any firmware implant will still be on the device. There were no vulnerabilities included in the cherryblossom leak. The firmware implant deployment instructions included in the leak don't mention using any vulnerabilities either. Almost all of the devices listed in the cherryblossom leak are not being sold anymore.