4 ms·

For national security sake all routers should be required to support open firmwares.

by qwerty456127 7y ago

pessimizer 7y ago
s/routers/computers/g
pdonis 7y ago
You can install OpenWRT on most D-Link routers. I have one at home that works fine that way.
- tzs 7y ago
  Most, maybe, but not all. Only one of the 4 models in this case is listed as supported on the OpenWRT site.
chatmasta 7y ago
Not exactly what you’re asking for, and it has its own problems [0], but the US military has a “trusted foundry program” [1] for sourcing chips. [0] https://semiengineering.com/a-crisis-in-dods-trusted-foundry-program/ https://semiengineering.com/a-crisis-in-dods-trusted-foundry... [1] https://en.m.wikipedia.org/wiki/Trusted_Foundry_Program https://en.m.wikipedia.org/wiki/Trusted_Foundry_Program
- iagovar 7y ago
  Is there an equivalent of the Trusted program in Europe? I know of a bunch of companies capable of manufacturing chips, like STM, but because of the scattered nature of europe, I don't know how euro militaries handle this issue, specially Airbus.
- ktta 7y ago
  Being open source at the chip level, while an admirable goal isn't really required for open source firmware. Most router firmware is linux, that runs on either ARM or MIPS based SoCs. Opening up that code is more than enough to fix any security flaws like these.
ktta 7y ago
Open source software on routers is a little complicated. FCC requires home router manufacturers to prevent users from modifying transmit settings (primarily to prevent interference with weather systems - which 5G is also going to mess with). While the router manufacturers themselves might not provide features to modify the parameters, allowing third-party open source firmware opens them upto liability, because third-party firmware -- almost all of which are open source, can provide users with features that allow changing the transmit parameters. This is because the radio operation is controlled by the OS (most of these have linux on them), and the parameters are to be included in the same firmware blob as the OS. FCC is not the problem here either. FCC saw the quick-fix that some manufacturers took, like TP-Link, which is to block any third-party firmware. So they required TP-Link to reverse their decision to prevent installation of third-party firmware. Then what's the solution? The best way to prevent allowing consumers to change the transmit settings, while allowing open source firmware meant for the rest of the board (where all of the security issues arise), will require having different flash chips - one for most of the firmware, and a separate on for the storage radio parameters. This route is what Linksys is taking. Personally, I doubt this is a good enough solution. Board designs today use a single SoC that does everything. So I'm not sure how they think storing the transmit settings on a different flash chip will prevent the firmware from using different parameters. Any design that is more complex than the two flash chip solution will require a lot of reworking of designs, because most board designs basically consist of a few components: the SoC, the flash and RAM. Nothing else. Apart from the re-working of existing designs, there's another problem. The problem is the BOM constraints router makers face, since they are always in a race to the bottom price-wise. Adding additional chips, introduces cost and complexity, which they don't want to go through.
- msla 7y ago
  The solution is that there is no preemptive solution, any more than there is a preemptive solution to using an axe dangerously. You can build a transmitter out of a Raspberry Pi and a short length of wire; for extra credit, you can buy a cheap amplifier and really go to town, but the simple fact you can strobe a GPIO pin fast enough to transmit on unauthorized frequencies is the final nail in the coffin for any plan to restrict broadcasting by restricting radio sales. The enforcement comes down to this: If you transmit in an obnoxious way and you annoy someone, you get squashed. If you kill someone, you get squashed harder. That doesn't bring the dead back to life, but sending someone to prison for killing someone else with an axe doesn't bring the dead back to life, either.

For national security sake all routers should be required to support open firmwares.

pessimizer 7y ago

s/routers/computers/g

pdonis 7y ago

You can install OpenWRT on most D-Link routers. I have one at home that works fine that way.

tzs 7y ago
Most, maybe, but not all. Only one of the 4 models in this case is listed as supported on the OpenWRT site.

chatmasta 7y ago

Not exactly what you’re asking for, and it has its own problems [0], but the US military has a “trusted foundry program” [1] for sourcing chips. [0] https://semiengineering.com/a-crisis-in-dods-trusted-foundry-program/ https://semiengineering.com/a-crisis-in-dods-trusted-foundry... [1] https://en.m.wikipedia.org/wiki/Trusted_Foundry_Program https://en.m.wikipedia.org/wiki/Trusted_Foundry_Program

iagovar 7y ago
Is there an equivalent of the Trusted program in Europe? I know of a bunch of companies capable of manufacturing chips, like STM, but because of the scattered nature of europe, I don't know how euro militaries handle this issue, specially Airbus.
ktta 7y ago
Being open source at the chip level, while an admirable goal isn't really required for open source firmware. Most router firmware is linux, that runs on either ARM or MIPS based SoCs. Opening up that code is more than enough to fix any security flaws like these.

ktta 7y ago

Open source software on routers is a little complicated. FCC requires home router manufacturers to prevent users from modifying transmit settings (primarily to prevent interference with weather systems - which 5G is also going to mess with). While the router manufacturers themselves might not provide features to modify the parameters, allowing third-party open source firmware opens them upto liability, because third-party firmware -- almost all of which are open source, can provide users with features that allow changing the transmit parameters. This is because the radio operation is controlled by the OS (most of these have linux on them), and the parameters are to be included in the same firmware blob as the OS. FCC is not the problem here either. FCC saw the quick-fix that some manufacturers took, like TP-Link, which is to block any third-party firmware. So they required TP-Link to reverse their decision to prevent installation of third-party firmware. Then what's the solution? The best way to prevent allowing consumers to change the transmit settings, while allowing open source firmware meant for the rest of the board (where all of the security issues arise), will require having different flash chips - one for most of the firmware, and a separate on for the storage radio parameters. This route is what Linksys is taking. Personally, I doubt this is a good enough solution. Board designs today use a single SoC that does everything. So I'm not sure how they think storing the transmit settings on a different flash chip will prevent the firmware from using different parameters. Any design that is more complex than the two flash chip solution will require a lot of reworking of designs, because most board designs basically consist of a few components: the SoC, the flash and RAM. Nothing else. Apart from the re-working of existing designs, there's another problem. The problem is the BOM constraints router makers face, since they are always in a race to the bottom price-wise. Adding additional chips, introduces cost and complexity, which they don't want to go through.

msla 7y ago
The solution is that there is no preemptive solution, any more than there is a preemptive solution to using an axe dangerously. You can build a transmitter out of a Raspberry Pi and a short length of wire; for extra credit, you can buy a cheap amplifier and really go to town, but the simple fact you can strobe a GPIO pin fast enough to transmit on unauthorized frequencies is the final nail in the coffin for any plan to restrict broadcasting by restricting radio sales. The enforcement comes down to this: If you transmit in an obnoxious way and you annoy someone, you get squashed. If you kill someone, you get squashed harder. That doesn't bring the dead back to life, but sending someone to prison for killing someone else with an axe doesn't bring the dead back to life, either.