4 ms·

Well good for them... I think something had to change after this https://openwrt.org/advisory/2020-01-31-1 https://openwrt.org/advisory/2020-01-31-1 After I r

Well good for them... I think something had to change after this https://openwrt.org/advisory/2020-01-31-1 https://openwrt.org/advisory/2020-01-31-1 After I read that, I removed openwrt on an old mips wifi router I had been using for years and moved to a fanless x86_64 running a minimal normal distro, set up via nmcli.

Wowfunhappy 6y ago
Could you expand on why you consider this vulnerability to be such a major indicator of incompetence, versus all the other major vulnerabilities that regularly pop up in software? They all seem obvious in hindsight, but as they say, hindsight is 20/20.
- gamegod 6y ago
  > moved to a fanless x86_64 running a minimal normal distro, which uses apt-get over HTTP by default Fixed that for you.
  - outsomnia 6y ago
    Normal distros have package signatiure pki that works :-)
    - bridgerMic 6y ago
      Ha! apt-get had 17 vulnerabilities in the last few years, two of them with very high severity score, easily exploitable [0]. For example: CVE-2019-3462 Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. [0] https://www.cvedetails.com/vulnerability-list/vendor_id-23/product_id-17236/Debian-APT.html https://www.cvedetails.com/vulnerability-list/vendor_id-23/p... Edit: many of the CVEs for apt-get are in the "bad pki" class, all of them are "severe" as they allow malicious code execution: CVE-2009-1358 apt-get does not check for the correct error code from gpgv CVE-2011-1829 APT does not properly validate inline GPG signatures CVE-2011-3634 APt accepts connections when the certificate host name fails validation CVE-2014-0478 APT does not properly validate source packages, allow installation of Trojan horse packages by removing the Release signature. etc etc. Facts of life: all software contain an uncountable number of severe vulnerabilities. It is unfair to single-out openwrt IMHO.
      - outsomnia 6y ago
        Yes, it's true... for redhat the worst rpm cve I could see from a quick google was back in 2012. The CVE you mention is about the transport part, it's not easy to get right and everything that goes on the network is at some risk of that. Still that seems a different kind of implication than nobody checked if packages could be tampered successfully for 3 years and afterwards nobody changed the infrastructure.
    - yjftsjthsd-h 6y ago
      And so does openwrt, since you'll notice that that CVE was fixed.
      - outsomnia 6y ago
        Yes it was fixed when pointed out to them, after all openwrt users from 18.06+ had been exposed to this for three years. There's no known way to guard against bugs in the end, but... you can empirically test... they didn't check at all if their package signature check could detect tampering after patching it? For 3 years? Then no infrastructure changes as a reaction to what happened? Like I said good for them, the PR mentions they will get some funding this is the kind of thing they can spend it on.
- outsomnia 6y ago
  Sure... 1) Still no dnssec on archive.openwrt.org 2) Still no tls on archive.openwrt.org Those together mean you can poison the dns for it and it will download packages from your fake site. And... 3) Problem was introduced Feb 2017, nobody checked tampered packages were still rejected until 2020. With 3) it means anyone can put whatever they want in the fake packages and the OS will install them. I don't need much from my router but I need it to be secure. So I got rid of openwrt the next week.
  - dastx 6y ago
    If archive.openwrt.org is like any other *nix package management software, it's likely that it doesn't need dnssec or tls. The signature of the packages get verified based on predefined public keys. If the packages aren't signed by openwrt's private keys, the software will reject it. You'll notice many other package management software do the exact same thing. In any case, this is based on what other package management software does. I don't know if this is indeed the case.
    - outsomnia 6y ago
      That is indeed the theory. But the point here is how openwrt broke that "last / only line of defence" package signature check and nobody noticed for three years and two major releases.
      - dastx 6y ago
        I am not aware of this. What happened?
        outsomnia 6y ago
        As I linked above, introduced Feb 2017 found Jan 2020 https://openwrt.org/advisory/2020-01-31-1 https://openwrt.org/advisory/2020-01-31-1 A bug in the package list parse logic of OpenWrt's opkg fork caused the package manager to ignore SHA-256 checksums embedded in the signed repository index, effectively bypassing integrity checking of downloaded .ipk artifacts.
pabs3 6y ago
"Normal distros" have had this sort of vulnerability in the past unfortunately.
- outsomnia 6y ago
  Maybe so, but I have faith RH will generally check it better since they are better funded, and problems more likely to be found quicker since more users.
OneLeggedCat 6y ago
To be clear, a solution like that would not be nearly so easy to set up and modify as OpenWRT is, correct? OpenWRT has so many powers, I'm always thinking of something new to do with it. But I'm not a networking expert, and without OpenWRT, it seems like setting up a normal distro to do that stuff would be overwhelming, and take up many more hours than I have to give. Is there a normal distro that is already set up similar to OpenWRT out of the box?
- outsomnia 6y ago
  Right, it was more trouble and not as cheap as a commodity router, if you paid the same for a commodity router you'd be getting much more modern wifi like 11ax. However for people who considered OpenWRT, there are few equivalents... pfsense but it seemed I would have just moved sideways and the lesson of the CVE was to align with desktop type distros that have infrastructure teams and more eyes. This has two mini PCI cards for wifi, one for 2.4GHz and one for 5GHz, they don't reach comparable speeds but it is very reliable. It also has 128GB msata SSD mini PCI. Once Linux was installed, I was surprised nmcli + firewalld is really powerful now, I could set up a multizone AP with two mini PCI cards and Ethernet routing in a couple of hours googling, and it worked stably and just how I intended. For anything else, it's a normal Linux box with the kind of normal storage and packages you don't get on commodity routers.
  - champtar 6y ago
    I use Fedora on my VPS and up to date Firewalld is really limited compared to OpenWrt firewall3 config. Inter zone forwarding rules are still not a thing, MSS Clamping not sure, and not sure if there are anything close to OpenWrt mwan3. SFC is just legal representation, and joining it will not change anything to the development. As pointed by others, RCE (or equivalent) in package managers affected all of them, so this issue alone to switch seems an overreaction to me.
    - outsomnia 6y ago
      > SFC is just legal representation No, as the article says >> Conservancy will help OpenWrt continue to thrive and grow as its new fiscal sponsor. That's what I think they need, to resolve their security and testing issues. > Inter zone forwarding rules are still not a thing I can believe that firewalld is not there on some things, but for what I wanted to do, including VPN service, it worked out great. I was expecting it to be a much harder ride, it would have been a few years ago. > so this issue alone to switch seems an overreaction to me. When I realized for 3 years there had been no package security on my own box I had thought was in better defensible shape than running manufacturer firmware, I realized I had been living in a fantasy. You're free to make up your own mind.
yjftsjthsd-h 6y ago
> In order to exploit this vulnerability, a malicious actor needs to pose as MITM, serving a valid and signed package index - e.g. one obtained from downloads.openwrt.org - and one or more forged .ipk packages having the same size as specified in the repository index while an `opkg install` command is invoked on the victim system. You switched systems for this? Sure, they could have done defense in depth (not unlike Debian, which also relies on signatures), but this was a bug in signature verification and... Honestly, how would someone even exploit this?
- outsomnia 6y ago
  As I mentioned there is no dnssec or tls on their archive site, with the package signature not being checked interested parties need to run a mirror of the real site with selected packages tampered and poison the dns of their target. And then they can wait for the targets to update. They can do that pretty cheaply and over the 3 years and two major releases the broken opkg shipped on, just collect victims. That's what a lot of people in a lot of different countries are paid to do for a living.

Wowfunhappy 6y ago

Could you expand on why you consider this vulnerability to be such a major indicator of incompetence, versus all the other major vulnerabilities that regularly pop up in software? They all seem obvious in hindsight, but as they say, hindsight is 20/20.

gamegod 6y ago
> moved to a fanless x86_64 running a minimal normal distro, which uses apt-get over HTTP by default Fixed that for you.
- outsomnia 6y ago
  Normal distros have package signatiure pki that works :-)
  - bridgerMic 6y ago
    Ha! apt-get had 17 vulnerabilities in the last few years, two of them with very high severity score, easily exploitable [0]. For example: CVE-2019-3462 Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. [0] https://www.cvedetails.com/vulnerability-list/vendor_id-23/product_id-17236/Debian-APT.html https://www.cvedetails.com/vulnerability-list/vendor_id-23/p... Edit: many of the CVEs for apt-get are in the "bad pki" class, all of them are "severe" as they allow malicious code execution: CVE-2009-1358 apt-get does not check for the correct error code from gpgv CVE-2011-1829 APT does not properly validate inline GPG signatures CVE-2011-3634 APt accepts connections when the certificate host name fails validation CVE-2014-0478 APT does not properly validate source packages, allow installation of Trojan horse packages by removing the Release signature. etc etc. Facts of life: all software contain an uncountable number of severe vulnerabilities. It is unfair to single-out openwrt IMHO.
    - outsomnia 6y ago
      Yes, it's true... for redhat the worst rpm cve I could see from a quick google was back in 2012. The CVE you mention is about the transport part, it's not easy to get right and everything that goes on the network is at some risk of that. Still that seems a different kind of implication than nobody checked if packages could be tampered successfully for 3 years and afterwards nobody changed the infrastructure.
  - yjftsjthsd-h 6y ago
    And so does openwrt, since you'll notice that that CVE was fixed.
    - outsomnia 6y ago
      Yes it was fixed when pointed out to them, after all openwrt users from 18.06+ had been exposed to this for three years. There's no known way to guard against bugs in the end, but... you can empirically test... they didn't check at all if their package signature check could detect tampering after patching it? For 3 years? Then no infrastructure changes as a reaction to what happened? Like I said good for them, the PR mentions they will get some funding this is the kind of thing they can spend it on.
outsomnia 6y ago
Sure... 1) Still no dnssec on archive.openwrt.org 2) Still no tls on archive.openwrt.org Those together mean you can poison the dns for it and it will download packages from your fake site. And... 3) Problem was introduced Feb 2017, nobody checked tampered packages were still rejected until 2020. With 3) it means anyone can put whatever they want in the fake packages and the OS will install them. I don't need much from my router but I need it to be secure. So I got rid of openwrt the next week.
- dastx 6y ago
  If archive.openwrt.org is like any other *nix package management software, it's likely that it doesn't need dnssec or tls. The signature of the packages get verified based on predefined public keys. If the packages aren't signed by openwrt's private keys, the software will reject it. You'll notice many other package management software do the exact same thing. In any case, this is based on what other package management software does. I don't know if this is indeed the case.
  - outsomnia 6y ago
    That is indeed the theory. But the point here is how openwrt broke that "last / only line of defence" package signature check and nobody noticed for three years and two major releases.
    - dastx 6y ago
      I am not aware of this. What happened?
      - outsomnia 6y ago
        As I linked above, introduced Feb 2017 found Jan 2020 https://openwrt.org/advisory/2020-01-31-1 https://openwrt.org/advisory/2020-01-31-1 A bug in the package list parse logic of OpenWrt's opkg fork caused the package manager to ignore SHA-256 checksums embedded in the signed repository index, effectively bypassing integrity checking of downloaded .ipk artifacts.

pabs3 6y ago

"Normal distros" have had this sort of vulnerability in the past unfortunately.

outsomnia 6y ago
Maybe so, but I have faith RH will generally check it better since they are better funded, and problems more likely to be found quicker since more users.

OneLeggedCat 6y ago

To be clear, a solution like that would not be nearly so easy to set up and modify as OpenWRT is, correct? OpenWRT has so many powers, I'm always thinking of something new to do with it. But I'm not a networking expert, and without OpenWRT, it seems like setting up a normal distro to do that stuff would be overwhelming, and take up many more hours than I have to give. Is there a normal distro that is already set up similar to OpenWRT out of the box?

outsomnia 6y ago
Right, it was more trouble and not as cheap as a commodity router, if you paid the same for a commodity router you'd be getting much more modern wifi like 11ax. However for people who considered OpenWRT, there are few equivalents... pfsense but it seemed I would have just moved sideways and the lesson of the CVE was to align with desktop type distros that have infrastructure teams and more eyes. This has two mini PCI cards for wifi, one for 2.4GHz and one for 5GHz, they don't reach comparable speeds but it is very reliable. It also has 128GB msata SSD mini PCI. Once Linux was installed, I was surprised nmcli + firewalld is really powerful now, I could set up a multizone AP with two mini PCI cards and Ethernet routing in a couple of hours googling, and it worked stably and just how I intended. For anything else, it's a normal Linux box with the kind of normal storage and packages you don't get on commodity routers.
- champtar 6y ago
  I use Fedora on my VPS and up to date Firewalld is really limited compared to OpenWrt firewall3 config. Inter zone forwarding rules are still not a thing, MSS Clamping not sure, and not sure if there are anything close to OpenWrt mwan3. SFC is just legal representation, and joining it will not change anything to the development. As pointed by others, RCE (or equivalent) in package managers affected all of them, so this issue alone to switch seems an overreaction to me.
  - outsomnia 6y ago
    > SFC is just legal representation No, as the article says >> Conservancy will help OpenWrt continue to thrive and grow as its new fiscal sponsor. That's what I think they need, to resolve their security and testing issues. > Inter zone forwarding rules are still not a thing I can believe that firewalld is not there on some things, but for what I wanted to do, including VPN service, it worked out great. I was expecting it to be a much harder ride, it would have been a few years ago. > so this issue alone to switch seems an overreaction to me. When I realized for 3 years there had been no package security on my own box I had thought was in better defensible shape than running manufacturer firmware, I realized I had been living in a fantasy. You're free to make up your own mind.

yjftsjthsd-h 6y ago

> In order to exploit this vulnerability, a malicious actor needs to pose as MITM, serving a valid and signed package index - e.g. one obtained from downloads.openwrt.org - and one or more forged .ipk packages having the same size as specified in the repository index while an `opkg install` command is invoked on the victim system. You switched systems for this? Sure, they could have done defense in depth (not unlike Debian, which also relies on signatures), but this was a bug in signature verification and... Honestly, how would someone even exploit this?

outsomnia 6y ago
As I mentioned there is no dnssec or tls on their archive site, with the package signature not being checked interested parties need to run a mirror of the real site with selected packages tampered and poison the dns of their target. And then they can wait for the targets to update. They can do that pretty cheaply and over the 3 years and two major releases the broken opkg shipped on, just collect victims. That's what a lot of people in a lot of different countries are paid to do for a living.