4 ms·

How should/would we design routers and any Internet-connected device that we expect the users to not patch themselves? e.g. SOHO users. Let's not get into the

How should/would we design routers and any Internet-connected device that we expect the users to not patch themselves? e.g. SOHO users. Let's not get into the discussion of whether or not everything that can be connected to the Internet should be. (I'm in the "should not be connected camp", but I think my question can stand on its own without this discussion).

hannob 9y ago
The first answer is obviously auto-updates. The second answer is also obvious: Try to avoid as many bugs as possible before shipping the product. If you include a highly exposed software like dnsmasq make sure you look for bugs in it before shipping it. I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router manufacturers out there, yet none of them chose to fund one...
- raesene9 9y ago
  This is one of those times it's a shame I only have one upvote for a comment... Open source is extremely heavily used by commercial software and hardware manufacturers and the reality is that very few of them contribute back, meaningfully, to Open source security. The end result will continue to be bugs like this, with ever growing impact.
- bannedtruth 9y ago
  HATEOAS
- newman314 9y ago
  Also, good secure defaults. I see too many pieces of software ship with insecure defaults for ease of use. This needs to stop.
- sitkack 9y ago
  The other one is that embedded devices need to running their components in sandboxes.
  - gcp 9y ago
    To be honest, a compromised dnsmasq can do quite a lot of harm even if it is running in a sandbox. The rest of the system expects to trust the output.
- thephyber 9y ago
  > I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router manufacturers out there, yet none of them chose to fund one... "Tragedy of the Commons." If all manufacturers in the space assume someone else will pay for the audit (or assume it won't get audited), then it doesn't get audited. If one does pay for it, they all get to benefit due to the nature of open source patches. It's funny yet sad that it took Google Security acting on a bug report by a (presumably unrelated) engineer to find some of these security issues. Google has strong incentives to protect its own network (its livelihood depends on intellectual property and safeguarding data). The companies that sell mostly disposable SOHO routers have such little interest in security, yet it's literally the gateway most of us use to the internet.
- jlgaddis 9y ago
  > I don't remember having seen any professional security audit for dnsmasq before. Mozilla ("Secure Open Source" [0]) funded an audit of dnsmasq [1] by Cure53 [2] about a year and a half ago. The final report [3] (PDF) lists one "medium" and five "low" issues. It just goes to show that a "successful" audit (i.e., one that doesn't find any major/critical issues) ultimately doesn't prove much of anything at all WRT the overall security of a piece of software. [0]: https://wiki.mozilla.org/MOSS/Secure_Open_Source https://wiki.mozilla.org/MOSS/Secure_Open_Source [1]: https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#dnsmasq https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#d... [2]: https://cure53.de/ https://cure53.de/ [3]: https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf
fulafel 9y ago
Consumer grade CPE should always be in bridge mode, with managent access needing a physical cable plugged to a dedicated port. This is common sense to anyone following the 10+ years of atrocious security record of ADSL/cable boxes. As a bonus you get working ip connectivity (no half assed NAT ALGs messing up your packets).
- ctz 9y ago
  Think for one moment: how utterly screwed the internet would be if the majority of consumer computer equipment wasn't behind NAT by default?
  - the8472 9y ago
    That's already reality with IPv6 and the sky is not falling because instead of NAT the router boxes provide (simple) firewalls. The downside is that they yet again break P2P protocols, although that's somewhat easier to fix.
  - snuxoll 9y ago
    Just fine? NAT at the end of the day is a glorified stateful firewall, but it's even worse because of the overhead of mapping (src, port) pairs to other (src, port) pairs and the mess of rewriting packets (which breaks in really fun way with protocols like SIP). You can get the same protection NAT offers for IPv6 with an incredibly basic set of firewall rules, only allowing devices on the LAN side of the connection to establish connections and punching holes where necessary.
- snuxoll 9y ago
  That's great and all, but even though my Arris gateway from my (not so) friendly neighborhood cable company is in bridge mode my EdgeRouter X connected to it (which is responsible for providing NAT and stateful firewall services for my network) uses dnsmasq and is vulnerable. Mind you, I'm pretty sure ubnt will have an update fairly quickly - but just because consumer DSL/DOCSIS gateways have a poor track record doesn't mean that prosumer or even commercial gear is perfect either.
kelnos 9y ago
I think we're basically in a worse version of the Android fragmentation / device support issue. At least with Android, Google is forcing manufacturers to have a minimum security patch lifetime. There's no one in a position to require or enforce that among the tens (hundreds?) of thousands of home/SOHO routers models out there. I expect we'd maybe be able to get some of the big players (Netgear, Linksys, D-Link, etc.) to agree individually to support products with security updates for X amount of time, but it's still dicey. I used to work for one of them[0], and often the people internally who own the products don't even know enough about the software running on them to even be aware of security issues. They're entirely at the mercy of the outsourced software firm for that. The margins are low enough (and price competition high enough) that you're not going to see much effort without consumer support. That is, consumers being actively willing in large numbers to pay more for a more secure product (so, that's not happening). If we could go by a model where everything was based on a third party, like OpenWRT or LEDE, and if the appliances could auto-update in-place from the upstream package repositories (nothing run by manufacturers or the software integrators), then that might work, but the manufacturers would have a hard time supporting it, as I'd expect there to be a lot of random breakage. I'm not sure there's a great solution here. Savvy consumers will pick a brand that has a strong track record with security (perhaps buying SMB or enterprise-grade products), or will flash 3rd-party firmware that they can maintain and upgrade themselves. The masses are pretty much lost and dependent on a commodity industry that has little incentive to pay close attention to security, and a lot of incentive (in the form of cost and pricing pressure) to ignore all but the worst security problems. [0] This was 2004-2009, so things may have changed, but I'm not expecting much.
- wmf 9y ago
  If we could go by a model where everything was based on a third party, like OpenWRT or LEDE, and if the appliances could auto-update in-place from the upstream package repositories (nothing run by manufacturers or the software integrators), then that might work, but the manufacturers would have a hard time supporting it, as I'd expect there to be a lot of random breakage. Yep, I'm enjoying my OnHub.
- the8472 9y ago
  > At least with Android, Google is forcing manufacturers to have a minimum security patch lifetime. There's no one in a position to require or enforce that among the tens (hundreds?) of thousands of home/SOHO routers models out there. ISPs bundle routers with their contracts. So if their customers get attacked through hardware that they supplied they will have at least some incentive to put pressure on the upstream manufacturers.

hannob 9y ago

The first answer is obviously auto-updates. The second answer is also obvious: Try to avoid as many bugs as possible before shipping the product. If you include a highly exposed software like dnsmasq make sure you look for bugs in it before shipping it. I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router manufacturers out there, yet none of them chose to fund one...

raesene9 9y ago
This is one of those times it's a shame I only have one upvote for a comment... Open source is extremely heavily used by commercial software and hardware manufacturers and the reality is that very few of them contribute back, meaningfully, to Open source security. The end result will continue to be bugs like this, with ever growing impact.
bannedtruth 9y ago
HATEOAS
newman314 9y ago
Also, good secure defaults. I see too many pieces of software ship with insecure defaults for ease of use. This needs to stop.
sitkack 9y ago
The other one is that embedded devices need to running their components in sandboxes.
- gcp 9y ago
  To be honest, a compromised dnsmasq can do quite a lot of harm even if it is running in a sandbox. The rest of the system expects to trust the output.
thephyber 9y ago
> I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router manufacturers out there, yet none of them chose to fund one... "Tragedy of the Commons." If all manufacturers in the space assume someone else will pay for the audit (or assume it won't get audited), then it doesn't get audited. If one does pay for it, they all get to benefit due to the nature of open source patches. It's funny yet sad that it took Google Security acting on a bug report by a (presumably unrelated) engineer to find some of these security issues. Google has strong incentives to protect its own network (its livelihood depends on intellectual property and safeguarding data). The companies that sell mostly disposable SOHO routers have such little interest in security, yet it's literally the gateway most of us use to the internet.
jlgaddis 9y ago
> I don't remember having seen any professional security audit for dnsmasq before. Mozilla ("Secure Open Source" [0]) funded an audit of dnsmasq [1] by Cure53 [2] about a year and a half ago. The final report [3] (PDF) lists one "medium" and five "low" issues. It just goes to show that a "successful" audit (i.e., one that doesn't find any major/critical issues) ultimately doesn't prove much of anything at all WRT the overall security of a piece of software. [0]: https://wiki.mozilla.org/MOSS/Secure_Open_Source https://wiki.mozilla.org/MOSS/Secure_Open_Source [1]: https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#dnsmasq https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#d... [2]: https://cure53.de/ https://cure53.de/ [3]: https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf

fulafel 9y ago

Consumer grade CPE should always be in bridge mode, with managent access needing a physical cable plugged to a dedicated port. This is common sense to anyone following the 10+ years of atrocious security record of ADSL/cable boxes. As a bonus you get working ip connectivity (no half assed NAT ALGs messing up your packets).

ctz 9y ago
Think for one moment: how utterly screwed the internet would be if the majority of consumer computer equipment wasn't behind NAT by default?
- the8472 9y ago
  That's already reality with IPv6 and the sky is not falling because instead of NAT the router boxes provide (simple) firewalls. The downside is that they yet again break P2P protocols, although that's somewhat easier to fix.
- snuxoll 9y ago
  Just fine? NAT at the end of the day is a glorified stateful firewall, but it's even worse because of the overhead of mapping (src, port) pairs to other (src, port) pairs and the mess of rewriting packets (which breaks in really fun way with protocols like SIP). You can get the same protection NAT offers for IPv6 with an incredibly basic set of firewall rules, only allowing devices on the LAN side of the connection to establish connections and punching holes where necessary.
snuxoll 9y ago
That's great and all, but even though my Arris gateway from my (not so) friendly neighborhood cable company is in bridge mode my EdgeRouter X connected to it (which is responsible for providing NAT and stateful firewall services for my network) uses dnsmasq and is vulnerable. Mind you, I'm pretty sure ubnt will have an update fairly quickly - but just because consumer DSL/DOCSIS gateways have a poor track record doesn't mean that prosumer or even commercial gear is perfect either.

kelnos 9y ago

I think we're basically in a worse version of the Android fragmentation / device support issue. At least with Android, Google is forcing manufacturers to have a minimum security patch lifetime. There's no one in a position to require or enforce that among the tens (hundreds?) of thousands of home/SOHO routers models out there. I expect we'd maybe be able to get some of the big players (Netgear, Linksys, D-Link, etc.) to agree individually to support products with security updates for X amount of time, but it's still dicey. I used to work for one of them[0], and often the people internally who own the products don't even know enough about the software running on them to even be aware of security issues. They're entirely at the mercy of the outsourced software firm for that. The margins are low enough (and price competition high enough) that you're not going to see much effort without consumer support. That is, consumers being actively willing in large numbers to pay more for a more secure product (so, that's not happening). If we could go by a model where everything was based on a third party, like OpenWRT or LEDE, and if the appliances could auto-update in-place from the upstream package repositories (nothing run by manufacturers or the software integrators), then that might work, but the manufacturers would have a hard time supporting it, as I'd expect there to be a lot of random breakage. I'm not sure there's a great solution here. Savvy consumers will pick a brand that has a strong track record with security (perhaps buying SMB or enterprise-grade products), or will flash 3rd-party firmware that they can maintain and upgrade themselves. The masses are pretty much lost and dependent on a commodity industry that has little incentive to pay close attention to security, and a lot of incentive (in the form of cost and pricing pressure) to ignore all but the worst security problems. [0] This was 2004-2009, so things may have changed, but I'm not expecting much.

wmf 9y ago
If we could go by a model where everything was based on a third party, like OpenWRT or LEDE, and if the appliances could auto-update in-place from the upstream package repositories (nothing run by manufacturers or the software integrators), then that might work, but the manufacturers would have a hard time supporting it, as I'd expect there to be a lot of random breakage. Yep, I'm enjoying my OnHub.
the8472 9y ago
> At least with Android, Google is forcing manufacturers to have a minimum security patch lifetime. There's no one in a position to require or enforce that among the tens (hundreds?) of thousands of home/SOHO routers models out there. ISPs bundle routers with their contracts. So if their customers get attacked through hardware that they supplied they will have at least some incentive to put pressure on the upstream manufacturers.