18 ms·

D-Link Home Routers Open to Remote Takeover Will Remain Unpatched

522 points by LinuxBender 7y ago

dubyabee2 7y ago
D-Link SIRT :: For Accurate and Up-to-Date information please go to: https://bit.ly/2nNawAc https://bit.ly/2nNawAc
- willis936 7y ago
  The irony of using a shortened link in a comment on cyber security.
  - frereubu 7y ago
    Non-shortened link: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10124 https://supportannouncement.us.dlink.com/announcement/public...
    - ape4 7y ago
      "D-Link takes the issues of network security and user privacy very seriously. " ... "These products have entered End of Service Life. There is no support or development for these devices. We recommend replacing the device with an new device that is actively supported."
      - WalterSobchak 7y ago
        Reminds of an old post by Troy Hunt: https://www.troyhunt.com/we-take-security-seriously-otherwise/ https://www.troyhunt.com/we-take-security-seriously-otherwis...
qwerty456127 7y ago
For national security sake all routers should be required to support open firmwares.
- pessimizer 7y ago
  s/routers/computers/g
- pdonis 7y ago
  You can install OpenWRT on most D-Link routers. I have one at home that works fine that way.
  - tzs 7y ago
    Most, maybe, but not all. Only one of the 4 models in this case is listed as supported on the OpenWRT site.
- chatmasta 7y ago
  Not exactly what you’re asking for, and it has its own problems [0], but the US military has a “trusted foundry program” [1] for sourcing chips. [0] https://semiengineering.com/a-crisis-in-dods-trusted-foundry-program/ https://semiengineering.com/a-crisis-in-dods-trusted-foundry... [1] https://en.m.wikipedia.org/wiki/Trusted_Foundry_Program https://en.m.wikipedia.org/wiki/Trusted_Foundry_Program
  - iagovar 7y ago
    Is there an equivalent of the Trusted program in Europe? I know of a bunch of companies capable of manufacturing chips, like STM, but because of the scattered nature of europe, I don't know how euro militaries handle this issue, specially Airbus.
  - ktta 7y ago
    Being open source at the chip level, while an admirable goal isn't really required for open source firmware. Most router firmware is linux, that runs on either ARM or MIPS based SoCs. Opening up that code is more than enough to fix any security flaws like these.
- ktta 7y ago
  Open source software on routers is a little complicated. FCC requires home router manufacturers to prevent users from modifying transmit settings (primarily to prevent interference with weather systems - which 5G is also going to mess with). While the router manufacturers themselves might not provide features to modify the parameters, allowing third-party open source firmware opens them upto liability, because third-party firmware -- almost all of which are open source, can provide users with features that allow changing the transmit parameters. This is because the radio operation is controlled by the OS (most of these have linux on them), and the parameters are to be included in the same firmware blob as the OS. FCC is not the problem here either. FCC saw the quick-fix that some manufacturers took, like TP-Link, which is to block any third-party firmware. So they required TP-Link to reverse their decision to prevent installation of third-party firmware. Then what's the solution? The best way to prevent allowing consumers to change the transmit settings, while allowing open source firmware meant for the rest of the board (where all of the security issues arise), will require having different flash chips - one for most of the firmware, and a separate on for the storage radio parameters. This route is what Linksys is taking. Personally, I doubt this is a good enough solution. Board designs today use a single SoC that does everything. So I'm not sure how they think storing the transmit settings on a different flash chip will prevent the firmware from using different parameters. Any design that is more complex than the two flash chip solution will require a lot of reworking of designs, because most board designs basically consist of a few components: the SoC, the flash and RAM. Nothing else. Apart from the re-working of existing designs, there's another problem. The problem is the BOM constraints router makers face, since they are always in a race to the bottom price-wise. Adding additional chips, introduces cost and complexity, which they don't want to go through.
pxeboot 7y ago
Until there is some legally required amount of time to provide security updates for connected devices, I would expect the "buy a new one if you want to be protected" response to continue indefinitely.
- hackbinary 7y ago
  What do you expect from companies that sell kit at $50/£50/€50? You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Then again, I buy stuff that can be flashed with OpenWRT ...
  - asdf21 7y ago
    $50 honestly seems expensive considering how long home routers have been around. It's not as if it's novel technology. I'd expect cheap mass-produced routers to be around $15 - $25, like an immersion blender.. I don't quite understand why cheap ones are still $40-$60.
    - core-questions 7y ago
      People pay hundreds for these things on the high end; the market seems to have settled on the price. There may be room to under-cut, but you risk looking like a cheapo option when all the established manufacturers charge more.
    - kazen44 7y ago
      $50 is incredibly cheap for a home-router (which also is a wireless access point, a switch and a firewall). Prosumer or enterprise grade hardware is usually magnitudes more expensive. An edgerouter X is $50 for instance, but doesn't have wifi and lacks serious routing features. It is considered a very low end router compared to more expensive stuff from Juniper or Cisco. (even an entry grade router/firewall like an SRX300 will run you back atleast 4x the price of the edgerouter.) One thing these $50 routers lack besides proper software is stability. Most consumer networking equipment has an abysmal track record in terms of reliability.
nly 7y ago
It's times like this i'm glad my home router is a x86 mini PC running Arch Linux + iptables + Unifi (Complete with DNS MITM forcing all DNS out of my apartment over TLS)
- redblacktree 7y ago
  How high-touch is this kind of setup? I have a separate access point and I am using a consumer-grade "wireless router" for DHCP. (and other things?) I'm more of an app developer that does DevOps stuff when I have to. Is this something I can get done in a day or so? Is a Raspberry Pi enough, or do I need something more powerful?
  - somehnguy 7y ago
    If you want a less touchy solution (not completely plug and play though!) I can't recommend Ubiquiti products enough. I run an EdgeRouter X and Unifi AP at home. Not big enterprise gear but way more enterprisey than whatever you'll find on the shelf at Best Buy. Updates are released regularly and once you get your initial configuration done they just chug along, no random 'internet is down, need to reboot something' issues that (used to?) plague mass consumer designed gear.
    - aesclepius 7y ago
      Cheaper and older alternative is the Ubiquity Unifi Security Gateway + 8 port switch + UAC AP-PRO if you don't want the Edgerouter X cost. Less customizeable but if you're buying an EdgeRouter you know what you want.
      - harry8 7y ago
        how does power consumption compare with a setup like this vs some consumer all-in-one thing?
        kazen44 7y ago
        to be honest, most routers like this have very low power usage. I think an edgerouter X has a power consumption of something like 5W under load.
peterwwillis 7y ago
> D-Link last week told Fortinet’s FortiGuard Labs, which first discovered the issue in September, that all four of them are end-of-life and no longer sold or supported by the vendor First released in 2011, EOL in 2018. Can't say I blame 'em, EOL is EOL, but it's also the new planned obsolescence. (Better buy a new router every 7 years or the hackerman'll get ya!)
- eecc 7y ago
  Apple Time Capsules [0] released in 2011 received an update last June 2019 [1] despite being also discontinued in 2018. [0]: https://en.wikipedia.org/wiki/AirPort_Time_Capsule https://en.wikipedia.org/wiki/AirPort_Time_Capsule [1]: https://support.apple.com/kb/DL2008?locale=en_US https://support.apple.com/kb/DL2008?locale=en_US
skwb 7y ago
This is precisely why I chose to install DD-WRT on all my routers. Not only does it give me more fine grain control over all my admin privileges, I know I don't have to rely on some company making the cost-benefit decision over if it's worth patching security bugs.
- Maskawanian 7y ago
  DD-WRT doesn't necessarily provide more security, typically models will get one release and then not get any more updates.
  - simcop2387 7y ago
    I've found OpenWRT to be better in this case, support does get dropped eventually but it's usually longer term even if less polished.
eecc 7y ago
I'm aware of the "but what if the router is connected to an ICU bed? A patient's life depends on it!" straw man but let's be honest, it would only be the ICU's admin fault. Having sorted this out, let me clearly state that the only ethical solution is to brick these devices offline.
- kazen44 7y ago
  i hope an intensive care unit doesn't really on a bottom of the barrel consumer device for their network reliability.
  - eecc 7y ago
    I wasn’t arguing that someone might or should, I was just expecting someone to make the argument. And there you go: https://news.ycombinator.com/item?id=21195759 https://news.ycombinator.com/item?id=21195759
chimi 7y ago
What is the best wifi-router out now for home hackers? I'd like to do a pi-hole type setup but without the pi-hole and I also need a stronger wifi signal than on the box my ISP gives me.
- iagovar 7y ago
  Probably some low tier mikrotik. It's not for dummies though, it requires to know a bit of networking.
  - mtgx 7y ago
    Mikrotik has had quite a bit of security issues, too. https://www.techrepublic.com/article/unpatched-vulnerability-in-mikrotik-routeros-enables-easily-exploitable-denial-of-service-attack/ https://www.techrepublic.com/article/unpatched-vulnerability...
    - iagovar 7y ago
      But they patch stuff, and afaik everyone gets the update.
  - alyandon 7y ago
    I'm generally happy with my RB3011 but you are very much correct that it isn't meant for a typical end user. Many QoL things that a consumer level router + TomatoUSB firmware does for you are either difficult to set properly set up (NAT reflection) or are not available at all (per-IP traffic accounting).
  - MikusR 7y ago
    It really doesn't. The quickset (essentially basic configuration like most home routers) has been a feature for like 7 years.
- mey 7y ago
  It doesn't meet your hackability requirements, but I suggest Ubiquiti for wifi AP's at a price point that home owners can afford. I personally prefer keeping my wifi separate from the router, which this affords you. See this for a crash course in an entire Unifi setup, https://www.youtube.com/watch?v=f_-iuY_xxFY https://www.youtube.com/watch?v=f_-iuY_xxFY I personally run pi-hole on a pi, use an edgerouter x and unifi aps for the house.
hyperman1 7y ago
Sounds like exactly the kind of bug that lets you hack/install dd-wrt on them.
JoshuaMulliken 7y ago
This is unacceptable. Companies that do this stuff should be boycotted.
Natales 7y ago
Since I have an ESX box with multiple NICs running 24x7 at home, I've been using both, pfSense [1] and OPNSense [2] on a VM for years, with excellent performance, stability and top notch features. Combine that with 2 UniFi APs, multiple SSIDs each landing on separate VLANs, all converging on the router VM as separate "interfaces", so you can very selectively do policy-based routing per MAC address, and whitelist/blacklist IoT devices from accessing the Internet or specific sites. It gives you a huge amount of control that is very hard to do otherwise. [1] https://www.pfsense.org/ https://www.pfsense.org/ [2] https://opnsense.org/ https://opnsense.org/
- tombert 7y ago
  I had come into possession of a bunch of thin clients with USB 3.0 and gigabit ethernet about a year ago, and as a result I installed PFSense, which is my router in my house. It has been great...I'm definitely never going back to a crappy commercial router ever again.
chooseaname 7y ago
I tell everyone who will listen don't buy consumer networking gear. Buy from Ubiquity or get the enterprise routers/APs from your favorite brand. They are much more likely to be updated and don't really cost much more. Sure, it takes some know how to set up, but they can call me if they take my recommendations.
- x2f10 7y ago
  Eero is a much better alternative for the average person. Solid features, INCREDIBLY easy to setup, nice app, helpful support, etc. Big fan.
  - kalleboo 7y ago
    They got bought out by Amazon now though, which may worry some people
triangleman 7y ago
Correct me if I'm wrong, but in order to perform this attack you need to be connected to the router's LAN in order to access the admin page, right? So you would need to gain access to the WiFi or attach a computer to the router via Ethernet. This cannot be exploited over the internet, unless perhaps the user enables the admin page via WAN.
- crankylinuxuser 7y ago
  Sadly, wrong. Assuming 192.168.1.1 is your router, you can craft a webpage on the public internet to exploit that IP address, without javascript. With js, it's trivial.. But you have to deal with CORS being set up. Question then becomes - is CORS set up right? If not, pwn3d.
david_draco 7y ago
We need brickerbot to come back https://en.wikipedia.org/wiki/BrickerBot https://en.wikipedia.org/wiki/BrickerBot
dredmorbius 7y ago
The affected routers may be supported by OpenWRT, a free software wireless router project, or similar projects (dd-wrt, Tomato). Looking the OpenWRT Table of Hardware (https://openwrt.org/toh/start?dataflt%5BBrand*~%5D=D-Link https://openwrt.org/toh/start?dataflt%5BBrand*~%5D=D-Link), I find: DIR-655: OpenWRT: not listed. DIR-866L: OpenWRT: not listed. dd-wrt: https://wiki.dd-wrt.com/wiki/index.php/D-Link_DIR-868L https://wiki.dd-wrt.com/wiki/index.php/D-Link_DIR-868L DIR-652: not listed DHP-1565: Present: https://openwrt.org/toh/d-link/dhp-1565 https://openwrt.org/toh/d-link/dhp-1565 Buying well-supported hardware and flashing with OpenWRT (or similar) is strongly recommended. OpenWRT: https://www.openwrt.org/ https://www.openwrt.org/ Tomato: http://www.polarcloud.com/tomato http://www.polarcloud.com/tomato dd-wrt: https://dd-wrt.com https://dd-wrt.com
- milankragujevic 7y ago
  Most DIR-XXX routers are actually Realtek (Lexra), which developers of OpenWRT refuse to support due to the unweildy microarchitecture of the SoC.
  - dredmorbius 7y ago
    Thanks. I thought I'd at least look. Saw some indication that a few of the devices were pretty specifically not supported based on discussions.
jjguy 7y ago
This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, thermostats -- you name it. Michael DeGusta did a great infographic demonstrating this for Android phones in 2011 [1, 2]. Sadly, this hasn't materially changed in the eight years since. Just this year, Google added new terms to the Android license requiring security patches, but even then only for "popular devices." [3] Imagine those dynamics in the secondary and tertiary markets of printers and refrigerators. As an industry, we've been to this rodeo before. The advancements we've made in operating system and core applications security over the last 20 years have more about patching speed and agility than shipping fewer bugs. However, those areas have backing and control from Apple and Microsoft, managing the end to end ecosystem. There is not a similarly equipped manufacturer of embedded operating systems with the scale to provide post-sale/post-deployment patching infrastructure. Since this is Hacker News, I'll point out the enormous opportunity to anyone who can address that problem. Can you provide an "enterprise class embedded OS" to device manufacturers and address post-deployment updates? Can you provide infrastructure device manufacturers can use to manage post-deployment updates themselves? Do you have a better approach to it? There's a burgeoning multi-billion dollar market waiting for a few leaders to take it over. 1 - https://theunderstatement.com/post/11982112928/android-orphans-visualizing-a-sad-history-of https://theunderstatement.com/post/11982112928/android-orpha... 2 - img link is broken in his post, the graphic itself: http://media.theunderstatement.com/016a_android_orphans.png http://media.theunderstatement.com/016a_android_orphans.png 3 - https://www.theverge.com/2018/10/24/18019356/android-security-update-mandate-google-contract https://www.theverge.com/2018/10/24/18019356/android-securit...
- schainks 7y ago
  The Nerves Project is positioning itself to address this well.
- patcheudor 7y ago
  For D-Link this is the normal, normal and has been for years. Check out VU#924307 which they never fixed. It could be triggered either by an attacker or just in the normal course of using the router: https://www.kb.cert.org/vuls/id/924307/ https://www.kb.cert.org/vuls/id/924307/
all_blue_chucks 7y ago
Isn't planned obsolesce illegal in some places? Ending security updates is the very definition of planned obsolesce for an internet-connected device.
theandrewbailey 7y ago
I used a DIR-655 router up until 4 or 5 years ago. I threw it out because there was no new firmware for it, and neither OpenWRT nor DD-WRT supported it. I replaced it with something that did. Looks like I made the right call.
evilsnoopi3 7y ago
I do not own a DLink router but do own a consumer-grade Gateway from Netgear. Is there any mechanism I can use to check for published vulnerabilities against my hardware?
kragen 7y ago
Whoever patches them will be the one who maintains control over them. What organizations are best positioned to do that? I suggest the intelligence agencies of Russia, Israel, and the US. Whether any of them will take the opportunity is anyone’s guess. Of course, the underlying problem here is that users depend on vendors for patching, and their incentives are misaligned. Free software like DD-WRT removes that dependency and thus the incentive misalignment problem. To the extent that educational, legal, and technical measures prevent users from exercising the freedoms of free software in practice, these problems will get worse and worse
H1Supreme 7y ago
I have a D-Link DIR-655 (which is on this list) as my home router. Ironically, I was going to replace it a few months ago, but the speed is still fast enough for my network. A few posts mentioned installing a different (open source) firmware. But, both OpenWrt and DD-Wrt aren't compatible. Am I missing another option? As an aside, can anyone recommend a wifi router that runs either OpenWrt or DD-Wrt well, for $100-$150?
- StreamBright 7y ago
  Works very well for me: https://www.amazon.com/Linksys-AC1900-Source-Wireless-WRT1900AC/dp/B014MIBLSA/ https://www.amazon.com/Linksys-AC1900-Source-Wireless-WRT190...
- theandrewbailey 7y ago
  You aren't missing another option. The 655 is based on an exotic architecture (Ubicom32) that never had the specs released for it to develop 3rd party firmware. Its why I trashed my 655 years ago.
  - milankragujevic 7y ago
    Revision C1 is a standard QCA chip.
jrochkind1 7y ago
> D-Link last week told Fortinet’s FortiGuard Labs, which first discovered the issue in September, that all four of them are end-of-life and no longer sold or supported by the vendor (however, the models are still available as new via third-party sellers). OK, let's say I am someone who actually knows "end-of-lifed" is a thing, and a thing you don't want... How would I check to see if a certain router was end-of-lifed before buying it? If I can figure that out, and I know it's not end-of-lifed, is there any way for me to see how much time is left in it's life before it's end-of-lifed, how would I check to make sure a router I was buying woudln't become end-of-lifed tomorrow, or next week, but has, say, a year or two of supported life left at least. Obviously, what D-Link is counting on is that most customers won't know that this is even a thing, wont' know what questions to ask, won't realize their router is end-of-lifed, won't realize their router is vulnerable, won't realize it if their router gets hacked, and it wont' effect their likelyhood of buying another D-link router or telling others to. It's not that they think this kind of support is going to be considered acceptable to their customers -- it's that they think their customers won't even be able to figure out what kind of support or security they are getting, mostly won't even realize this is even a question to ask. And they're probably right.
- wmf 7y ago
  How would I check to see if a certain router was end-of-lifed before buying it? You should be able to Google "$MODEL_NUMBER support", although D-Link's Web site is pretty bad and doesn't say tha the product is EOL (although since the last firmware update is from 2013 you could guess).
gambiting 7y ago
Linksys routers still ship with Samba 1.0 which has literally been deprecated for like 20 years now. These companies literally don't give a crap what they ship, I can only imagine that the firmware is made by someone who stood next to a building where a talk about internet security was held....a month earlier.
eloff 7y ago
I'll think twice before buying D-link again. They've just tarnished their brand irrevocably for me, even though my router is not affected - I had to turn it over and compare version numbers to be certain, and I don't want to have to track exploits and check version numbers to have peace of mind. What manufacturer can I buy next time with a good security record?
- iforgotpassword 7y ago
  One where you can wipe the original firmware and install OpenWRT.
  - deleted 7y ago
    [deleted]
  - joombaga 7y ago
    Or AsusWRT! I'm pretty happy with my RT-AC3200.
  - josteink 7y ago
    There may be other answers here, but this is really the only guaranteed one. OpenWRT really is the greatest.
- Arnt 7y ago
  Mikrotik or Ubiquiti. My >10yo hardware still receives updates (latest version, not a few backported changes).
  - windexh8er 7y ago
    This. I just decommissioned 5 x AP and 2 x backhaul radios this summer from Ubiquiti at a remote site I manage. These were all purchased and installed in 2011. I replaced them all with newer equivalents, not because they weren't working or weren't receiving updates - but because I'm 4 hours from the site and told the owner they've gotten their ROI and needed to preemptively replace. This happens to be my in-laws place and I don't want to deal with replacing some outdoor radios in the middle of a Midwestern winter. I sold all the gear as a package for about $150 and the buyer was well aware of the age and the fact that 3 of the devices had been outside that entire time. I commend Ubiquiti on the commitment to their line of products and the updates all devices that were in service continue to receive.
elipsey 7y ago
Schneier has recently argued that there is a missing market for IOT security in the sense that devices manufacturers have no incentive to patch impose external costs on society, and that this might be hard to fix without regulation. https://www.eweek.com/security/ibm-s-schneier-it-s-time-to-regulate-iot-to-improve-cyber-security https://www.eweek.com/security/ibm-s-schneier-it-s-time-to-r...
- silvr 7y ago
  Also - his recent book "Click Here to Kill Everybody" discusses the problem of IoT security in depth (ie. that the lack of it will risk increasingly dire consequences). One of his solutions is regulatory: a new federal agency for consumer cybersecurity. One of the particular things he would want mandated is that IoT devices be patchable, at a minimum.
- LilBytes 7y ago
  Canonical's pushing for a change in this space with their own embedded IoT OS. https://techerati.com/news-hub/canonical-releases-ubuntu-core-18-os-for-iot-devices/ https://techerati.com/news-hub/canonical-releases-ubuntu-cor...
etxm 7y ago
Sick
thelazydogsback 7y ago
My experience only, of course, but every D-Link product I've owned has been a nightmare, from config on. I've been sticking with ASUS for a while now and so far all is well...
slavik81 7y ago
A friend is using my old DIR-655. I would like to warn them, but I need to understand this better first. Am I correct that this allows administrator access to the router, but requires connecting to the router's network (either via having the WiFi password or having physical access)? IIRC, the DIR-655 is also stuck on WPA2, which was broken, so the WiFi password doesn't offer any protection either. In which case, anyone within range of the access point could access the admin panel. On one hand, this sucks because aside from these vulnerabilities, the DIR-655 works fine. On the other hand, I think I bought it over a decade ago.
adamc 7y ago
Maybe we need some class-action lawsuits. This is very bad behavior.
achillean 7y ago
For an overview of D-Link devices I created the following page a few years ago: https://dlink-report.shodan.io/ https://dlink-report.shodan.io/
chriscappuccio 7y ago
The users who have this router are not likely to patch it anyways. The patch, if released tomorrow would not affect ... anybody
ga-vu 7y ago
DIR-655 has been EOLed in 2012... what do you people expect. Of course they won't release firmware updates forever.
tzs 7y ago
Two of these were discontinued in 2018 [1]. I'd be pretty pissed off if I bought a router that a vendor was still listing as current, and the next year told that it was EOL and would get no more updates. [1] https://www.tomsguide.com/news/d-link-wont-fix-serious-security-flaw-on-four-wi-fi-routers https://www.tomsguide.com/news/d-link-wont-fix-serious-secur...
pjdemers 7y ago
For what home routers cost, they could probably ship a new one to everyone who complains about the bug for less than it costs to patch all of them. Especially since the set of people who will actually apply a patch is only slightly larger than the set who will complain about a bug.
sekjldfhsfklh 7y ago
I think there is a simple solution: if the seller doesn't support it, then they have to open source it. Own (key word) an old RPG that won't run because the publisher decided the servers were no longer profitable? RPG gets opened sourced. Have a John Deer remote operated tractor that John Deer won't fix a bug that allows attackers to operate remotely? John Deer's tractor software gets open sourced. No support? No legal IP protection.
- crankylinuxuser 7y ago
  Then the problem gets moved to encryption keys, which aren't part of the "open source". All the code's there - you just don't have the right to change it!
  - sekjldfhsfklh 7y ago
    I don't mean that the code is merely published. Full access to the device you own, signing keys and all.
aetherspawn 7y ago
We don’t have cable or a phone line, so I recently bought a D-Link router with a 4G SIM card slot and a massive yearly data plan that corresponds to the approx. amount of data I use yearly at home as a light non-streaming user (400gb at approx. $1 per gb). I’m open to hardware suggestions that are/more open source capable or robust in the first place, but my use case was really niche and the shop(s) had nearly nothing suitable except this one model.
- wmf 7y ago
  Mikrotik has an interesting outdoor LTE router (although I couldn't find anywhere reputable to buy it in the US). You could also get a USB or MiniPCIe modem and put it in whatever Linux box you want.
  - aetherspawn 7y ago
    I would love to build my own that also does proxy server.
hansdieter1337 7y ago
And that's why you should flash your router with an open source firmware, such as https://dd-wrt.com/ https://dd-wrt.com/
opan 7y ago
Another issue that could be avoided by using free software. Ideally D-Link would ship with free software so that the community can keep their gear working well. In practice something like OpenWRT may need to be installed by users, and depending on the hardware, support could be difficult. If you're looking to be more careful in the future, I suggest only buying routers with OpenWRT support.
wethebestcoder 7y ago
Are attacks on home networks really an issue? I mean what percent of home networks have actually seen an intrusion? Does anyone know?
aetherspawn 7y ago
Hey could anyone clarify if this is still an issue if I only use my router as a gateway and not as the wireless (WiFi) device?
philpem 7y ago
My last couple of WiFi routers were bought because they could run OpenWRT... I feel like stories like this support that position. At least if there was a security issue OpenWRT couldn't patch, I have the source code to do so myself. And I haven't bought D-Link kit in a very long time. Their record on a variety of things (reliability, support, ...) means you get better value (in the low-mid market segment at least) from the Chinese vendors e.g. TP-Link.
rajesh-s 7y ago
We live in a society where people upgrade their phones every 6 months but do not think about the routers for years. I wonder if there's any company that's trying to encourage people to upgrade their routers often.
tokzco 7y ago
the more i think about it the more i notice that a lot of 'security' is actually used to verify or 'add value' to the data that gets mined meaning 'verified' traffic holds more value than non verified traffic so that might explain a reason why security protocols on routers and other common devices are not as secure as they could be. you could note that this is also a form of 'security against you' meaning a 'proof' for a court. i don't know what the answer is to this simply because of all the variables i consider, especially the emergence of drones. how will this be secured to a degree that few can interfere with package deliveries, the abuse of surveillance and what space around a property is actually protected. as example you can drive by in a vehicle collect AP information and the average geek can obtain access so it will be with drones. if you really want to get interesting, think about the things drones can do, such as compromise crime scenes with planted evidence.

522 points by LinuxBender 7y ago

dubyabee2 7y ago

D-Link SIRT :: For Accurate and Up-to-Date information please go to: https://bit.ly/2nNawAc https://bit.ly/2nNawAc

willis936 7y ago
The irony of using a shortened link in a comment on cyber security.
- frereubu 7y ago
  Non-shortened link: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10124 https://supportannouncement.us.dlink.com/announcement/public...
  - ape4 7y ago
    "D-Link takes the issues of network security and user privacy very seriously. " ... "These products have entered End of Service Life. There is no support or development for these devices. We recommend replacing the device with an new device that is actively supported."
    - WalterSobchak 7y ago
      Reminds of an old post by Troy Hunt: https://www.troyhunt.com/we-take-security-seriously-otherwise/ https://www.troyhunt.com/we-take-security-seriously-otherwis...

qwerty456127 7y ago

For national security sake all routers should be required to support open firmwares.

pessimizer 7y ago
s/routers/computers/g
pdonis 7y ago
You can install OpenWRT on most D-Link routers. I have one at home that works fine that way.
- tzs 7y ago
  Most, maybe, but not all. Only one of the 4 models in this case is listed as supported on the OpenWRT site.
chatmasta 7y ago
Not exactly what you’re asking for, and it has its own problems [0], but the US military has a “trusted foundry program” [1] for sourcing chips. [0] https://semiengineering.com/a-crisis-in-dods-trusted-foundry-program/ https://semiengineering.com/a-crisis-in-dods-trusted-foundry... [1] https://en.m.wikipedia.org/wiki/Trusted_Foundry_Program https://en.m.wikipedia.org/wiki/Trusted_Foundry_Program
- iagovar 7y ago
  Is there an equivalent of the Trusted program in Europe? I know of a bunch of companies capable of manufacturing chips, like STM, but because of the scattered nature of europe, I don't know how euro militaries handle this issue, specially Airbus.
- ktta 7y ago
  Being open source at the chip level, while an admirable goal isn't really required for open source firmware. Most router firmware is linux, that runs on either ARM or MIPS based SoCs. Opening up that code is more than enough to fix any security flaws like these.
ktta 7y ago
Open source software on routers is a little complicated. FCC requires home router manufacturers to prevent users from modifying transmit settings (primarily to prevent interference with weather systems - which 5G is also going to mess with). While the router manufacturers themselves might not provide features to modify the parameters, allowing third-party open source firmware opens them upto liability, because third-party firmware -- almost all of which are open source, can provide users with features that allow changing the transmit parameters. This is because the radio operation is controlled by the OS (most of these have linux on them), and the parameters are to be included in the same firmware blob as the OS. FCC is not the problem here either. FCC saw the quick-fix that some manufacturers took, like TP-Link, which is to block any third-party firmware. So they required TP-Link to reverse their decision to prevent installation of third-party firmware. Then what's the solution? The best way to prevent allowing consumers to change the transmit settings, while allowing open source firmware meant for the rest of the board (where all of the security issues arise), will require having different flash chips - one for most of the firmware, and a separate on for the storage radio parameters. This route is what Linksys is taking. Personally, I doubt this is a good enough solution. Board designs today use a single SoC that does everything. So I'm not sure how they think storing the transmit settings on a different flash chip will prevent the firmware from using different parameters. Any design that is more complex than the two flash chip solution will require a lot of reworking of designs, because most board designs basically consist of a few components: the SoC, the flash and RAM. Nothing else. Apart from the re-working of existing designs, there's another problem. The problem is the BOM constraints router makers face, since they are always in a race to the bottom price-wise. Adding additional chips, introduces cost and complexity, which they don't want to go through.

pxeboot 7y ago

Until there is some legally required amount of time to provide security updates for connected devices, I would expect the "buy a new one if you want to be protected" response to continue indefinitely.

hackbinary 7y ago
What do you expect from companies that sell kit at $50/£50/€50? You always kind of get what you pay for. If you pay an annual maintenance, then you can expect regular and secure updates, otherwise you are buying the product as is at time of purchase. Then again, I buy stuff that can be flashed with OpenWRT ...
- asdf21 7y ago
  $50 honestly seems expensive considering how long home routers have been around. It's not as if it's novel technology. I'd expect cheap mass-produced routers to be around $15 - $25, like an immersion blender.. I don't quite understand why cheap ones are still $40-$60.
  - core-questions 7y ago
    People pay hundreds for these things on the high end; the market seems to have settled on the price. There may be room to under-cut, but you risk looking like a cheapo option when all the established manufacturers charge more.
  - kazen44 7y ago
    $50 is incredibly cheap for a home-router (which also is a wireless access point, a switch and a firewall). Prosumer or enterprise grade hardware is usually magnitudes more expensive. An edgerouter X is $50 for instance, but doesn't have wifi and lacks serious routing features. It is considered a very low end router compared to more expensive stuff from Juniper or Cisco. (even an entry grade router/firewall like an SRX300 will run you back atleast 4x the price of the edgerouter.) One thing these $50 routers lack besides proper software is stability. Most consumer networking equipment has an abysmal track record in terms of reliability.

nly 7y ago

It's times like this i'm glad my home router is a x86 mini PC running Arch Linux + iptables + Unifi (Complete with DNS MITM forcing all DNS out of my apartment over TLS)

redblacktree 7y ago
How high-touch is this kind of setup? I have a separate access point and I am using a consumer-grade "wireless router" for DHCP. (and other things?) I'm more of an app developer that does DevOps stuff when I have to. Is this something I can get done in a day or so? Is a Raspberry Pi enough, or do I need something more powerful?
- somehnguy 7y ago
  If you want a less touchy solution (not completely plug and play though!) I can't recommend Ubiquiti products enough. I run an EdgeRouter X and Unifi AP at home. Not big enterprise gear but way more enterprisey than whatever you'll find on the shelf at Best Buy. Updates are released regularly and once you get your initial configuration done they just chug along, no random 'internet is down, need to reboot something' issues that (used to?) plague mass consumer designed gear.
  - aesclepius 7y ago
    Cheaper and older alternative is the Ubiquity Unifi Security Gateway + 8 port switch + UAC AP-PRO if you don't want the Edgerouter X cost. Less customizeable but if you're buying an EdgeRouter you know what you want.
    - harry8 7y ago
      how does power consumption compare with a setup like this vs some consumer all-in-one thing?
      - kazen44 7y ago
        to be honest, most routers like this have very low power usage. I think an edgerouter X has a power consumption of something like 5W under load.

peterwwillis 7y ago

> D-Link last week told Fortinet’s FortiGuard Labs, which first discovered the issue in September, that all four of them are end-of-life and no longer sold or supported by the vendor First released in 2011, EOL in 2018. Can't say I blame 'em, EOL is EOL, but it's also the new planned obsolescence. (Better buy a new router every 7 years or the hackerman'll get ya!)

eecc 7y ago
Apple Time Capsules [0] released in 2011 received an update last June 2019 [1] despite being also discontinued in 2018. [0]: https://en.wikipedia.org/wiki/AirPort_Time_Capsule https://en.wikipedia.org/wiki/AirPort_Time_Capsule [1]: https://support.apple.com/kb/DL2008?locale=en_US https://support.apple.com/kb/DL2008?locale=en_US

skwb 7y ago

This is precisely why I chose to install DD-WRT on all my routers. Not only does it give me more fine grain control over all my admin privileges, I know I don't have to rely on some company making the cost-benefit decision over if it's worth patching security bugs.

Maskawanian 7y ago
DD-WRT doesn't necessarily provide more security, typically models will get one release and then not get any more updates.
- simcop2387 7y ago
  I've found OpenWRT to be better in this case, support does get dropped eventually but it's usually longer term even if less polished.

eecc 7y ago

I'm aware of the "but what if the router is connected to an ICU bed? A patient's life depends on it!" straw man but let's be honest, it would only be the ICU's admin fault. Having sorted this out, let me clearly state that the only ethical solution is to brick these devices offline.

kazen44 7y ago
i hope an intensive care unit doesn't really on a bottom of the barrel consumer device for their network reliability.
- eecc 7y ago
  I wasn’t arguing that someone might or should, I was just expecting someone to make the argument. And there you go: https://news.ycombinator.com/item?id=21195759 https://news.ycombinator.com/item?id=21195759

chimi 7y ago

What is the best wifi-router out now for home hackers? I'd like to do a pi-hole type setup but without the pi-hole and I also need a stronger wifi signal than on the box my ISP gives me.

iagovar 7y ago
Probably some low tier mikrotik. It's not for dummies though, it requires to know a bit of networking.
- mtgx 7y ago
  Mikrotik has had quite a bit of security issues, too. https://www.techrepublic.com/article/unpatched-vulnerability-in-mikrotik-routeros-enables-easily-exploitable-denial-of-service-attack/ https://www.techrepublic.com/article/unpatched-vulnerability...
  - iagovar 7y ago
    But they patch stuff, and afaik everyone gets the update.
- alyandon 7y ago
  I'm generally happy with my RB3011 but you are very much correct that it isn't meant for a typical end user. Many QoL things that a consumer level router + TomatoUSB firmware does for you are either difficult to set properly set up (NAT reflection) or are not available at all (per-IP traffic accounting).
- MikusR 7y ago
  It really doesn't. The quickset (essentially basic configuration like most home routers) has been a feature for like 7 years.
mey 7y ago
It doesn't meet your hackability requirements, but I suggest Ubiquiti for wifi AP's at a price point that home owners can afford. I personally prefer keeping my wifi separate from the router, which this affords you. See this for a crash course in an entire Unifi setup, https://www.youtube.com/watch?v=f_-iuY_xxFY https://www.youtube.com/watch?v=f_-iuY_xxFY I personally run pi-hole on a pi, use an edgerouter x and unifi aps for the house.

hyperman1 7y ago

Sounds like exactly the kind of bug that lets you hack/install dd-wrt on them.

JoshuaMulliken 7y ago

This is unacceptable. Companies that do this stuff should be boycotted.

Natales 7y ago

Since I have an ESX box with multiple NICs running 24x7 at home, I've been using both, pfSense [1] and OPNSense [2] on a VM for years, with excellent performance, stability and top notch features. Combine that with 2 UniFi APs, multiple SSIDs each landing on separate VLANs, all converging on the router VM as separate "interfaces", so you can very selectively do policy-based routing per MAC address, and whitelist/blacklist IoT devices from accessing the Internet or specific sites. It gives you a huge amount of control that is very hard to do otherwise. [1] https://www.pfsense.org/ https://www.pfsense.org/ [2] https://opnsense.org/ https://opnsense.org/

tombert 7y ago
I had come into possession of a bunch of thin clients with USB 3.0 and gigabit ethernet about a year ago, and as a result I installed PFSense, which is my router in my house. It has been great...I'm definitely never going back to a crappy commercial router ever again.

chooseaname 7y ago

I tell everyone who will listen don't buy consumer networking gear. Buy from Ubiquity or get the enterprise routers/APs from your favorite brand. They are much more likely to be updated and don't really cost much more. Sure, it takes some know how to set up, but they can call me if they take my recommendations.

x2f10 7y ago
Eero is a much better alternative for the average person. Solid features, INCREDIBLY easy to setup, nice app, helpful support, etc. Big fan.
- kalleboo 7y ago
  They got bought out by Amazon now though, which may worry some people

triangleman 7y ago

Correct me if I'm wrong, but in order to perform this attack you need to be connected to the router's LAN in order to access the admin page, right? So you would need to gain access to the WiFi or attach a computer to the router via Ethernet. This cannot be exploited over the internet, unless perhaps the user enables the admin page via WAN.

crankylinuxuser 7y ago
Sadly, wrong. Assuming 192.168.1.1 is your router, you can craft a webpage on the public internet to exploit that IP address, without javascript. With js, it's trivial.. But you have to deal with CORS being set up. Question then becomes - is CORS set up right? If not, pwn3d.

david_draco 7y ago

We need brickerbot to come back https://en.wikipedia.org/wiki/BrickerBot https://en.wikipedia.org/wiki/BrickerBot

dredmorbius 7y ago

The affected routers may be supported by OpenWRT, a free software wireless router project, or similar projects (dd-wrt, Tomato). Looking the OpenWRT Table of Hardware (https://openwrt.org/toh/start?dataflt%5BBrand*~%5D=D-Link https://openwrt.org/toh/start?dataflt%5BBrand*~%5D=D-Link), I find: DIR-655: OpenWRT: not listed. DIR-866L: OpenWRT: not listed. dd-wrt: https://wiki.dd-wrt.com/wiki/index.php/D-Link_DIR-868L https://wiki.dd-wrt.com/wiki/index.php/D-Link_DIR-868L DIR-652: not listed DHP-1565: Present: https://openwrt.org/toh/d-link/dhp-1565 https://openwrt.org/toh/d-link/dhp-1565 Buying well-supported hardware and flashing with OpenWRT (or similar) is strongly recommended. OpenWRT: https://www.openwrt.org/ https://www.openwrt.org/ Tomato: http://www.polarcloud.com/tomato http://www.polarcloud.com/tomato dd-wrt: https://dd-wrt.com https://dd-wrt.com

milankragujevic 7y ago
Most DIR-XXX routers are actually Realtek (Lexra), which developers of OpenWRT refuse to support due to the unweildy microarchitecture of the SoC.
- dredmorbius 7y ago
  Thanks. I thought I'd at least look. Saw some indication that a few of the devices were pretty specifically not supported based on discussions.

jjguy 7y ago

This is the new normal, folks. Consumer technology is manufactured for six to twelve months, but live in our homes for three to five years. Today's manufacturers cannot afford to update software for hardware devices they have already moved on from. Changing that requires a significant upheaval in their business models. This applies to every "connected device:" printers, cell phones, home routers, refrigerators, thermostats -- you name it. Michael DeGusta did a great infographic demonstrating this for Android phones in 2011 [1, 2]. Sadly, this hasn't materially changed in the eight years since. Just this year, Google added new terms to the Android license requiring security patches, but even then only for "popular devices." [3] Imagine those dynamics in the secondary and tertiary markets of printers and refrigerators. As an industry, we've been to this rodeo before. The advancements we've made in operating system and core applications security over the last 20 years have more about patching speed and agility than shipping fewer bugs. However, those areas have backing and control from Apple and Microsoft, managing the end to end ecosystem. There is not a similarly equipped manufacturer of embedded operating systems with the scale to provide post-sale/post-deployment patching infrastructure. Since this is Hacker News, I'll point out the enormous opportunity to anyone who can address that problem. Can you provide an "enterprise class embedded OS" to device manufacturers and address post-deployment updates? Can you provide infrastructure device manufacturers can use to manage post-deployment updates themselves? Do you have a better approach to it? There's a burgeoning multi-billion dollar market waiting for a few leaders to take it over. 1 - https://theunderstatement.com/post/11982112928/android-orphans-visualizing-a-sad-history-of https://theunderstatement.com/post/11982112928/android-orpha... 2 - img link is broken in his post, the graphic itself: http://media.theunderstatement.com/016a_android_orphans.png http://media.theunderstatement.com/016a_android_orphans.png 3 - https://www.theverge.com/2018/10/24/18019356/android-security-update-mandate-google-contract https://www.theverge.com/2018/10/24/18019356/android-securit...

schainks 7y ago
The Nerves Project is positioning itself to address this well.
patcheudor 7y ago
For D-Link this is the normal, normal and has been for years. Check out VU#924307 which they never fixed. It could be triggered either by an attacker or just in the normal course of using the router: https://www.kb.cert.org/vuls/id/924307/ https://www.kb.cert.org/vuls/id/924307/

all_blue_chucks 7y ago

Isn't planned obsolesce illegal in some places? Ending security updates is the very definition of planned obsolesce for an internet-connected device.

theandrewbailey 7y ago

I used a DIR-655 router up until 4 or 5 years ago. I threw it out because there was no new firmware for it, and neither OpenWRT nor DD-WRT supported it. I replaced it with something that did. Looks like I made the right call.

evilsnoopi3 7y ago

I do not own a DLink router but do own a consumer-grade Gateway from Netgear. Is there any mechanism I can use to check for published vulnerabilities against my hardware?

kragen 7y ago

Whoever patches them will be the one who maintains control over them. What organizations are best positioned to do that? I suggest the intelligence agencies of Russia, Israel, and the US. Whether any of them will take the opportunity is anyone’s guess. Of course, the underlying problem here is that users depend on vendors for patching, and their incentives are misaligned. Free software like DD-WRT removes that dependency and thus the incentive misalignment problem. To the extent that educational, legal, and technical measures prevent users from exercising the freedoms of free software in practice, these problems will get worse and worse

H1Supreme 7y ago

I have a D-Link DIR-655 (which is on this list) as my home router. Ironically, I was going to replace it a few months ago, but the speed is still fast enough for my network. A few posts mentioned installing a different (open source) firmware. But, both OpenWrt and DD-Wrt aren't compatible. Am I missing another option? As an aside, can anyone recommend a wifi router that runs either OpenWrt or DD-Wrt well, for $100-$150?

StreamBright 7y ago
Works very well for me: https://www.amazon.com/Linksys-AC1900-Source-Wireless-WRT1900AC/dp/B014MIBLSA/ https://www.amazon.com/Linksys-AC1900-Source-Wireless-WRT190...
theandrewbailey 7y ago
You aren't missing another option. The 655 is based on an exotic architecture (Ubicom32) that never had the specs released for it to develop 3rd party firmware. Its why I trashed my 655 years ago.
- milankragujevic 7y ago
  Revision C1 is a standard QCA chip.

jrochkind1 7y ago

> D-Link last week told Fortinet’s FortiGuard Labs, which first discovered the issue in September, that all four of them are end-of-life and no longer sold or supported by the vendor (however, the models are still available as new via third-party sellers). OK, let's say I am someone who actually knows "end-of-lifed" is a thing, and a thing you don't want... How would I check to see if a certain router was end-of-lifed before buying it? If I can figure that out, and I know it's not end-of-lifed, is there any way for me to see how much time is left in it's life before it's end-of-lifed, how would I check to make sure a router I was buying woudln't become end-of-lifed tomorrow, or next week, but has, say, a year or two of supported life left at least. Obviously, what D-Link is counting on is that most customers won't know that this is even a thing, wont' know what questions to ask, won't realize their router is end-of-lifed, won't realize their router is vulnerable, won't realize it if their router gets hacked, and it wont' effect their likelyhood of buying another D-link router or telling others to. It's not that they think this kind of support is going to be considered acceptable to their customers -- it's that they think their customers won't even be able to figure out what kind of support or security they are getting, mostly won't even realize this is even a question to ask. And they're probably right.

wmf 7y ago
How would I check to see if a certain router was end-of-lifed before buying it? You should be able to Google "$MODEL_NUMBER support", although D-Link's Web site is pretty bad and doesn't say tha the product is EOL (although since the last firmware update is from 2013 you could guess).

gambiting 7y ago

Linksys routers still ship with Samba 1.0 which has literally been deprecated for like 20 years now. These companies literally don't give a crap what they ship, I can only imagine that the firmware is made by someone who stood next to a building where a talk about internet security was held....a month earlier.

eloff 7y ago

I'll think twice before buying D-link again. They've just tarnished their brand irrevocably for me, even though my router is not affected - I had to turn it over and compare version numbers to be certain, and I don't want to have to track exploits and check version numbers to have peace of mind. What manufacturer can I buy next time with a good security record?

iforgotpassword 7y ago
One where you can wipe the original firmware and install OpenWRT.
- deleted 7y ago
  [deleted]
- joombaga 7y ago
  Or AsusWRT! I'm pretty happy with my RT-AC3200.
- josteink 7y ago
  There may be other answers here, but this is really the only guaranteed one. OpenWRT really is the greatest.
Arnt 7y ago
Mikrotik or Ubiquiti. My >10yo hardware still receives updates (latest version, not a few backported changes).
- windexh8er 7y ago
  This. I just decommissioned 5 x AP and 2 x backhaul radios this summer from Ubiquiti at a remote site I manage. These were all purchased and installed in 2011. I replaced them all with newer equivalents, not because they weren't working or weren't receiving updates - but because I'm 4 hours from the site and told the owner they've gotten their ROI and needed to preemptively replace. This happens to be my in-laws place and I don't want to deal with replacing some outdoor radios in the middle of a Midwestern winter. I sold all the gear as a package for about $150 and the buyer was well aware of the age and the fact that 3 of the devices had been outside that entire time. I commend Ubiquiti on the commitment to their line of products and the updates all devices that were in service continue to receive.

elipsey 7y ago

Schneier has recently argued that there is a missing market for IOT security in the sense that devices manufacturers have no incentive to patch impose external costs on society, and that this might be hard to fix without regulation. https://www.eweek.com/security/ibm-s-schneier-it-s-time-to-regulate-iot-to-improve-cyber-security https://www.eweek.com/security/ibm-s-schneier-it-s-time-to-r...

silvr 7y ago
Also - his recent book "Click Here to Kill Everybody" discusses the problem of IoT security in depth (ie. that the lack of it will risk increasingly dire consequences). One of his solutions is regulatory: a new federal agency for consumer cybersecurity. One of the particular things he would want mandated is that IoT devices be patchable, at a minimum.
LilBytes 7y ago
Canonical's pushing for a change in this space with their own embedded IoT OS. https://techerati.com/news-hub/canonical-releases-ubuntu-core-18-os-for-iot-devices/ https://techerati.com/news-hub/canonical-releases-ubuntu-cor...

etxm 7y ago

Sick

thelazydogsback 7y ago

My experience only, of course, but every D-Link product I've owned has been a nightmare, from config on. I've been sticking with ASUS for a while now and so far all is well...

slavik81 7y ago

A friend is using my old DIR-655. I would like to warn them, but I need to understand this better first. Am I correct that this allows administrator access to the router, but requires connecting to the router's network (either via having the WiFi password or having physical access)? IIRC, the DIR-655 is also stuck on WPA2, which was broken, so the WiFi password doesn't offer any protection either. In which case, anyone within range of the access point could access the admin panel. On one hand, this sucks because aside from these vulnerabilities, the DIR-655 works fine. On the other hand, I think I bought it over a decade ago.

adamc 7y ago

Maybe we need some class-action lawsuits. This is very bad behavior.

achillean 7y ago

For an overview of D-Link devices I created the following page a few years ago: https://dlink-report.shodan.io/ https://dlink-report.shodan.io/

chriscappuccio 7y ago

The users who have this router are not likely to patch it anyways. The patch, if released tomorrow would not affect ... anybody

ga-vu 7y ago

DIR-655 has been EOLed in 2012... what do you people expect. Of course they won't release firmware updates forever.

tzs 7y ago

Two of these were discontinued in 2018 [1]. I'd be pretty pissed off if I bought a router that a vendor was still listing as current, and the next year told that it was EOL and would get no more updates. [1] https://www.tomsguide.com/news/d-link-wont-fix-serious-security-flaw-on-four-wi-fi-routers https://www.tomsguide.com/news/d-link-wont-fix-serious-secur...

pjdemers 7y ago

For what home routers cost, they could probably ship a new one to everyone who complains about the bug for less than it costs to patch all of them. Especially since the set of people who will actually apply a patch is only slightly larger than the set who will complain about a bug.

sekjldfhsfklh 7y ago

I think there is a simple solution: if the seller doesn't support it, then they have to open source it. Own (key word) an old RPG that won't run because the publisher decided the servers were no longer profitable? RPG gets opened sourced. Have a John Deer remote operated tractor that John Deer won't fix a bug that allows attackers to operate remotely? John Deer's tractor software gets open sourced. No support? No legal IP protection.

crankylinuxuser 7y ago
Then the problem gets moved to encryption keys, which aren't part of the "open source". All the code's there - you just don't have the right to change it!
- sekjldfhsfklh 7y ago
  I don't mean that the code is merely published. Full access to the device you own, signing keys and all.

aetherspawn 7y ago

We don’t have cable or a phone line, so I recently bought a D-Link router with a 4G SIM card slot and a massive yearly data plan that corresponds to the approx. amount of data I use yearly at home as a light non-streaming user (400gb at approx. $1 per gb). I’m open to hardware suggestions that are/more open source capable or robust in the first place, but my use case was really niche and the shop(s) had nearly nothing suitable except this one model.

wmf 7y ago
Mikrotik has an interesting outdoor LTE router (although I couldn't find anywhere reputable to buy it in the US). You could also get a USB or MiniPCIe modem and put it in whatever Linux box you want.
- aetherspawn 7y ago
  I would love to build my own that also does proxy server.

hansdieter1337 7y ago

And that's why you should flash your router with an open source firmware, such as https://dd-wrt.com/ https://dd-wrt.com/

opan 7y ago

Another issue that could be avoided by using free software. Ideally D-Link would ship with free software so that the community can keep their gear working well. In practice something like OpenWRT may need to be installed by users, and depending on the hardware, support could be difficult. If you're looking to be more careful in the future, I suggest only buying routers with OpenWRT support.

wethebestcoder 7y ago

Are attacks on home networks really an issue? I mean what percent of home networks have actually seen an intrusion? Does anyone know?

aetherspawn 7y ago

Hey could anyone clarify if this is still an issue if I only use my router as a gateway and not as the wireless (WiFi) device?

philpem 7y ago

My last couple of WiFi routers were bought because they could run OpenWRT... I feel like stories like this support that position. At least if there was a security issue OpenWRT couldn't patch, I have the source code to do so myself. And I haven't bought D-Link kit in a very long time. Their record on a variety of things (reliability, support, ...) means you get better value (in the low-mid market segment at least) from the Chinese vendors e.g. TP-Link.

rajesh-s 7y ago

We live in a society where people upgrade their phones every 6 months but do not think about the routers for years. I wonder if there's any company that's trying to encourage people to upgrade their routers often.

tokzco 7y ago

the more i think about it the more i notice that a lot of 'security' is actually used to verify or 'add value' to the data that gets mined meaning 'verified' traffic holds more value than non verified traffic so that might explain a reason why security protocols on routers and other common devices are not as secure as they could be. you could note that this is also a form of 'security against you' meaning a 'proof' for a court. i don't know what the answer is to this simply because of all the variables i consider, especially the emergence of drones. how will this be secured to a degree that few can interfere with package deliveries, the abuse of surveillance and what space around a property is actually protected. as example you can drive by in a vehicle collect AP information and the average geek can obtain access so it will be with drones. if you really want to get interesting, think about the things drones can do, such as compromise crime scenes with planted evidence.