5 ms·
> If users believe their router firmware may have been compromised, Linksys recommends that users download the latest available firmware from http://www.linksys
by avaer 9y ago
> If users believe their router firmware may have been compromised, Linksys recommends that users download the latest available firmware from http://www.linksys.com/support/ http://www.linksys.com/support/ and update your router.
Is there a hardware feature that makes the firmware boot secure in a way that prevents the firmware from interfering with the update? Such as croning itself to reinstall the compromise when you're not looking? Or lying that it updated?
- mentat 9y agoDownload from non-TLS site, yeah, what could go wrong.
- concatime 9y agoSadly true.
- abfan1127 9y agobecause the CIA couldn't create fake certs?
- Already__Taken 9y agoNot without more risk of being caught.
- yjftsjthsd-h 9y agoThe key question would be whether certificate transparency was involved.
- mikecb 9y agoNeed something with a TPM, like an Onhub/Google Wifi.
- avaer 9y agoYes, I was speaking to these routers in particular. Because if they don't have this, then this is bad security advice against what is considered a targeted attack.
- bsamuels 9y agoLinksys security guy here - we got that firmware update tidbit from the cherryblossom documentation. The firmware implant (aka flytrap) reproduces all of the router's normal functionality. On page 122 of the cherryblossom docs, it says that the firmware upgrade feature is implemented normally by the flytrap, and that if a user attempts to upgrade their router's firmware, it will overwrite the flytrap firmware.
- kentt 9y agoPerhaps I'm missing something, but are you saying you trusted that the malware documentation is correct?
- joefkelley 9y agoYeah this is a bit worrying. But since it was leaked, this actually doesn't seem so bad. What incentive would the CIA have to lie internally?
- TheSpiceIsLife 9y agoOne good reason I can think of is to have something for leakers to leak that isn't based in reality. Or: the CIA leaked it intentionally as smoke-screen. I don't know. Are there organisational silos within intelligence agencies? Layers of access? It's hard to know for sure, but I'm yet to see a human organisation that doesn't have political in-fighting.
- bsamuels 9y agoDidn't really have any other choice. We had tons of users calling in last week panicking over what to do about cherryblossom. Without a sample of the implant or confirmation from the CIA that the documents are legitimate & unaltered, this advisory is pretty much all we can do for those users.
- pbhjpbhj 9y agoDidn't you have an infected target to test against?
- smoyer 9y agoYou can disable management via the WAN port and/or wi-fi if you put OpenWRT on them.
- Jaruzel 9y agoThere should have never been management access enabled by default via WAN or WLAN on ANY router to be honest. In a misguided effort to make their consumer devices more 'friendly'[1] they've just made them more insecure. -- [1] Even though most users have no idea the management interface even exists.
- yjftsjthsd-h 9y agoI don't mind it being on WiFi. But yeah, public facing management port is insane.
- pbhjpbhj 9y agoIt's a tough call. The comms companies who provide my router provide millions of them. They want ACS/TR-069 by default and use it for automated updates. I always disable it, but I'll bet I'm something like 1:10k in that respect.