3 ms·

If I were you I'd check to see if your router can run one of the several open source firmware packages like OpenWRT, dd-wrt, or Tomato. In my personal experienc

If I were you I'd check to see if your router can run one of the several open source firmware packages like OpenWRT, dd-wrt, or Tomato. In my personal experience the OpenWRT/lede team is on top of security issues, and the router web interface and tooling is completely fine. I'd be confident that flashing your device with modern open source firmware would solve the problem, but if you're paranoid just recycle the device and get a new one. In any event, I don't see a solution for you that doesn't involve some homework.

rubatuga 8y ago
Yeah, you can start by resetting the NVRAM of the router, (30-30-30 reset) then get a flash chip clip, read the data off the router flash using a raspberry pi, and compare it to the firmware binary from the router manufacturers website.
- deleted 8y ago
  [deleted]
- skynetv2 8y ago
  > user-friendly (or even relatively techy but not a network engineer user-friendly) instructions for... what to do. I am an experienced SWE and this is not something I can do without setting aside a day or two to investigate all the tools and purchase an RPi.
  - WrtCdEvrydy 8y ago
    This is the reason IOT security should be enforced by law. Oh, you sold a piece of shit insecure WiFi lightbulb that's mining bitcoin, here's a fine for every penny you made.
jrochkind1 8y ago
In general, I am cautious of running my own open source thing without being an expert in the relevant area (or interested in becoming one) -- having to put something together (and maintain it) yourself seldom, in my experience, ends up _more_ secure or _more_ maintainable, when you don't know what you're doing. However, routers may be an exception. Apparently the industry has basically no business motivation to keep consumer-grade networking hardware secure, at all. Irrelevant to their profits or reputation. I'll consider it. When I bought my router I intentionally got one that can run OpenWRT, but never ended up installing it, cause, who's got time for that? But perhaps there isn't really an alternative, unless you want a bot-net-ed router. Which honestly, and with shame, I'd just ignore the botnet sending out spam to other people if I didn't think it was compromising the functionality (and security) of my router for me. Last thing I wanna do is spend time becoming a network engineer after a day of getting paid to write software, but i guess that's where we're at. (Oh crap, I just realized it could be my DSL modem instead of or in addition to my (wired and wifi) router. I know even LESS about that thing. I think none of these consumer products, owned by people who know a lot less than me, are ever gonna be protected, if even I am intimidated by trying to figure it out).
- spudlyo 8y ago
  It may not be as hard as you think. Doing a little homework, flashing the router with the OpenWRT firmware, and getting a basic config up and running should take most folks an afternoon. If you already understand concepts like CIDR addressing, DNS, DHCP, and NAT then it's an hour tops. OpenWRT is not a pain to use -- it's not all that different than the web GUI that ships with most routers.
- creeble 8y ago
  Another option is to buy a pre-configured router from someone like FlashRouters.com (not affiliated, but a customer). They provide routers with DD-WRT or Tomato pre-installed. Yes, you should probably know how to update your router at some point in the future, but your starting point is probably much safer than depending on the poorly-tested and heavily-exploited factory firmware.
- jsjohnst 8y ago
  I’d recommend swapping out your consumer grade router for a commercial packaged version of pfSense. Just as easy to setup as most consumer grade routers and it auto updates (if you want) and has a decently secure base. Sure, you’ll spend $50 more, but isn’t the piece of mind worth it?
- xorcist 8y ago
  You're going to have to upgrade your firmware anyway, so why not upgrade to something that actually cares about basic functionality? Some people unused to open source solutions sometimes have this idea that all software developed by enthusiasts by necessity is hard to use or require tinkering, but that's not a fair picture. When developers share your interests, that's when software gets usable. That interest might not always be UI, but sometimes it is. OpenWRT (and friends!) is clearly much easier to use and delivers richers functionality than any of the software it replaces. If your router is listed as supported, go for it.
  - jrochkind1 8y ago
    The good reviews of OpenWRT help. The caution is mostly because it's unclear to me how hard it would be to switch it back. But yeah, probably will.

rubatuga 8y ago

Yeah, you can start by resetting the NVRAM of the router, (30-30-30 reset) then get a flash chip clip, read the data off the router flash using a raspberry pi, and compare it to the firmware binary from the router manufacturers website.

deleted 8y ago
[deleted]
skynetv2 8y ago
> user-friendly (or even relatively techy but not a network engineer user-friendly) instructions for... what to do. I am an experienced SWE and this is not something I can do without setting aside a day or two to investigate all the tools and purchase an RPi.
- WrtCdEvrydy 8y ago
  This is the reason IOT security should be enforced by law. Oh, you sold a piece of shit insecure WiFi lightbulb that's mining bitcoin, here's a fine for every penny you made.

jrochkind1 8y ago

In general, I am cautious of running my own open source thing without being an expert in the relevant area (or interested in becoming one) -- having to put something together (and maintain it) yourself seldom, in my experience, ends up _more_ secure or _more_ maintainable, when you don't know what you're doing. However, routers may be an exception. Apparently the industry has basically no business motivation to keep consumer-grade networking hardware secure, at all. Irrelevant to their profits or reputation. I'll consider it. When I bought my router I intentionally got one that can run OpenWRT, but never ended up installing it, cause, who's got time for that? But perhaps there isn't really an alternative, unless you want a bot-net-ed router. Which honestly, and with shame, I'd just ignore the botnet sending out spam to other people if I didn't think it was compromising the functionality (and security) of my router for me. Last thing I wanna do is spend time becoming a network engineer after a day of getting paid to write software, but i guess that's where we're at. (Oh crap, I just realized it could be my DSL modem instead of or in addition to my (wired and wifi) router. I know even LESS about that thing. I think none of these consumer products, owned by people who know a lot less than me, are ever gonna be protected, if even I am intimidated by trying to figure it out).

spudlyo 8y ago
It may not be as hard as you think. Doing a little homework, flashing the router with the OpenWRT firmware, and getting a basic config up and running should take most folks an afternoon. If you already understand concepts like CIDR addressing, DNS, DHCP, and NAT then it's an hour tops. OpenWRT is not a pain to use -- it's not all that different than the web GUI that ships with most routers.
creeble 8y ago
Another option is to buy a pre-configured router from someone like FlashRouters.com (not affiliated, but a customer). They provide routers with DD-WRT or Tomato pre-installed. Yes, you should probably know how to update your router at some point in the future, but your starting point is probably much safer than depending on the poorly-tested and heavily-exploited factory firmware.
jsjohnst 8y ago
I’d recommend swapping out your consumer grade router for a commercial packaged version of pfSense. Just as easy to setup as most consumer grade routers and it auto updates (if you want) and has a decently secure base. Sure, you’ll spend $50 more, but isn’t the piece of mind worth it?
xorcist 8y ago
You're going to have to upgrade your firmware anyway, so why not upgrade to something that actually cares about basic functionality? Some people unused to open source solutions sometimes have this idea that all software developed by enthusiasts by necessity is hard to use or require tinkering, but that's not a fair picture. When developers share your interests, that's when software gets usable. That interest might not always be UI, but sometimes it is. OpenWRT (and friends!) is clearly much easier to use and delivers richers functionality than any of the software it replaces. If your router is listed as supported, go for it.
- jrochkind1 8y ago
  The good reviews of OpenWRT help. The caution is mostly because it's unclear to me how hard it would be to switch it back. But yeah, probably will.