8 ms·

Router Security

114 points by butz 4y ago

tasubotadas 4y ago
Disabling IPv6 is recommended? I thought we are all moving to use IPv6.
- 8organicbits 4y ago
  The link has an interesting justification, I haven't heard that before. > That's because millions of home gateway routers, especially those leased to customers by their internet service providers (ISPs), leak their unique hardware ID numbers through their Internet Protocol (IP) addresses — and those hardware ID numbers can be connected to publicly available maps that show the street locations of Wi-Fi networks.
  - Sakos 4y ago
    https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou-exploiting-leaked-identifiers-in-ipv-for-street-level-geolocation-22889 https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou... It's based on this talk apparently > We assume a weak adversary who is remote to the target and has no privileged access. Our privacy attack lies in IPv6 addresses formed via EUI-64, which embed the interface's hardware MAC address in the IPv6 address. While EUI-64 IPv6 addresses are no longer used by most operating systems, they are commonly found in legacy and low-profit-margin customer premises equipment (CPE), e.g., commodity routers connecting residential and business subscribers. Because IPv6 CPE are routed hops (as opposed to IPv4 NATs), we can discover their MAC address via traceroute if they use EUI-64. > These CPE are frequently all-in-one devices that also provide Wi-Fi. Crucially, the MAC address of the Wi-Fi interface is often related to the MAC address of the wide area interface, e.g., a +/-1 offset. These Wi-Fi MACs are broadcast (the 802.11 BSSID) and captured by wardriving databases that also record their physical location. By correlating the MAC addresses embedded in IPv6 home router addresses with their Wi-Fi address counterpart, we can remotely geolocate them, fusing virtual data with meatspace. They have a tool that lets you check a given IPv6 address: https://github.com/6int/IPvSeeYou https://github.com/6int/IPvSeeYou
    - ikiris 4y ago
      Heh, I was dubious but this is a perfectly valid explanation for why you should not embed phy addresses in IPs. That said, it's absolutely toxic to be telling people to just turn off IPv6. Completely makes me lose trust in the rest of the site's content.
      - Sakos 4y ago
        A source link to a very thorough article at Tom's Guide (https://www.tomsguide.com/news/home-gateway-geolocation-bh21 https://www.tomsguide.com/news/home-gateway-geolocation-bh21) is provided close to the top of the page (in the short list). That guide links to the Black Hat presentation. > For years, turning off IPv6 (IP version 6) was on the long list below, but as of August 2021, I think it belongs here on the short list too. Very very few people need it and it was recently disclosed that there is a possible security issue with it. I think you're being a bit too accusative. Every suggestion has sources to back it up if you want to see why something is recommended.
    - jaclaz 4y ago
      >These Wi-Fi MACs are broadcast (the 802.11 BSSID) and captured by wardriving databases that also record their physical location. I am not sure to understand, while this is in theory doable, do these "captured by wardriving" databases exist? And do they cover "everywhere"?
      - veonik 4y ago
        A long while back now Google came out saying[0] they did use their Google Maps Street View cars to also collect wifi+location information. It wouldn't surprise me if they augmented this info with data they receive through Google services running on Android phones too. So my bet is, yeah, they do exist and they do pretty much cover everywhere. [0]: https://www.theguardian.com/technology/2010/may/15/google-admits-storing-private-data https://www.theguardian.com/technology/2010/may/15/google-ad...
        jaclaz 4y ago
  - stonepresto 4y ago
    I think there's a better justification. Since IPv6 is still new-ish to SOHO, and often is lightly used at best, the firmware devs might not spend as much time building that support into the firmware. When devs get laxidasical, bugs happen.
    - feanaro 4y ago
      I'm not sure that's a better justification. It's definitely an additional justification, making the whole thing that much worse. But street-level geolocation is pretty bad in itself.
  - zekica 4y ago
    This only correct for the router itself. Not for any devices connecting behind it.
- njibhu 4y ago
  There are a lot of shortcomings of IPv6 which prevents it to be widely used (particularly on the consumer network side). First thing to know is that it shifts responsibilities. The router is not responsible anymore for assigning IPs to the network. The devices assign their own IP address using SLAAC. You could use DHCPv6, but many devices simply won't support it (windows and android to begin with). Which brings the following issues: - No support for multi-homing. Example: You have two connections, a slow reliable one, and a fast unreliable one. With IPv4 you can easily setup multiwan in any proper L3 router. The router will ping both routes, and if the fast one is working, using it as main gateway. When it doesn't answer anymore, the router simply change its route. Because of NAT, this is transparent to the devices behind its network. For IPv6, this doesn't work anymore, because the IP prefix is set by the provider, without NAT the second provider will simply refuse to forward any packet which originates from an IP which doesn't have their prefix. The "solution" is to have your own address space, and use BGP to change the routes (which is out of reach for all of private consumers). - ISPs got it wrong ! I'm in Germany, tried 3 different providers, they all assign to my router a /64 subnet instead of /60 or /56 (as recommended by ARIN). The problem is that SLAAC only works with /64, below the devices usually won't assign themselves an IP anymore. So you can only have one network, you can't have a Guest network with a different prefix. - As mentioned by the article, the design is terrible for privacy: SLAAC works by simply taking the prefix from the router and filling the rest with the mac address. Which means that anybody on the internet gets to know your mac address. EDIT: This is wrong. See throw0101a answer below. - Captive portals: SLAAC does not directly support assigning DNS servers. So most captive portals simply break because the network's firewall blocks DNS requests as long as they don't use the proper DNS server, but the device might simply not even be able to receive it. (SLAAC has an extension where it can tell the device to receive the DNS servers from DHCPv6, but many devices simply ignore it and treat DNS like browsers do with DoH). EDIT: This is wrong. See throw0101a answer below. - Security within networks: Because the responsibilities of who assigns IP is shifted to the devices, switches cannot prevent devices to assign themselves IP anymore. So it's very easy for malicious devices to flood routing tables of switches by telling them that they own all IPv6 for the whole /64. Makes the whole network abysmally slow, or completely down. Most of these issues are solved by using NAT6 (or NPT), but the issue with it, is that it breaks some applications. Ipv6 promised to get rid of NAT, so some applications took the liberty to assume that their local IP would always be the same visible on the internet. Not sure if that's this particular case for SIP, but it's usually broken with NAT6.
- tryauuum 4y ago
  if you don't have ipv6 access to internet, makes sense to disable it in router's kernel. It makes the attack surface smaller By default Linux assigns a link-local ipv6 address to each interface, this can be undesirable
- redleader55 4y ago
  The author shows a complete lack of knowledge on IPv6. Yes, you do get a SLAAC address which basically contains you MAC, but if your OS supports it, you will also get a anonymized address which does not leak your MAC on the internet. Windows, Android, Linux, iOS all support MAC address anonymization, so as long as you are using a recent OS you should be fine. Very weird suggestion...
  - whyoh 4y ago
    Right. But isn't it so that each device gets its own IPv6 public address? So that PC1 and PC2 connected through the same modem are identifiable by different IPs, while you can still see that they're from the same modem/household? If that's the case, it can be a privacy concern.
    - tommiegannert 4y ago
      Theoretically, even non-router devices could use more than one address, just to confuse what's listening on the other side. In that scenario, DHCPv6 would be responsible for keeping the assigned subnet filled randomly, rather than being conservative and consistent with address assignments. I don't know if anyone is doing it now, but I don't think we should dismiss IPv6 for this reason.
      - megous 4y ago
        Android doesn't respect/implement DHCPv6. But there are IPv6 privacy extensions that periodically rotate the IPv6 addresses of the device. https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941
        tommiegannert 4y ago
        Thanks for the reference! Doing that directly with SLAAC is of course even nicer.
  - throw0101a 4y ago
julianlam 4y ago
I wonder how router security from a flashed FreshTomato router compare to stock firmware from a large vendor, for example.
- stonepresto 4y ago
  Haven't used it myself, but I'm more keen to trust open source code & communities than vendors.
- ce4 4y ago
  I Dont know if Tomato publishes CVEs. But you could check the release notes for OpenWrt for CVEs over the last couple of years. I would trust OpenWrt more, especially their continued support for old devices, one accesspoint of mine is 11 years old, supported in the 2022 release and still going strong (128MB RAM, 32MB flash)
- zekica 4y ago
  FreshTomato I think uses old kernel versions (2.6.xx) where security fixes are not backported. OpenWRT uses modern kernels (5.10) and mainline or external open source drivers but doesn't work on Broadcom devices.
stonepresto 4y ago
Don't rely on vendors to ship you secure fimware. Use something open source such as OpenWRT. It will make implementing the protections this blog mentions much easier.
- throw0101a 4y ago
  I've found out-of-box Asus to be pretty good, and they sometimes even incorporate features from third-party firmware (see "first debuted"): * https://www.asuswrt-merlin.net/features https://www.asuswrt-merlin.net/features
  - NGRhodes 4y ago
    Merlin firmware is special in a good way. Merlin has a good relationship with the Asus firmware dev team, he gets early access to official firmware, they sometimes ship him unreleased routers. He often finds and fixes bugs and creates/adds new features that Asus pickup. Also very careful to maintain full compatibility with the stock firmware, making it easy to switch between stock and merlin. He has also created an interface to allow 3rd party features to get their UI page. There is probably more, but it really is an excellent project.
    - whateveracct 4y ago
      Merlin is why I got an Asus router when the time came to upgrade.
  - Etheryte 4y ago
    I've had similar experiences. As time goes on I want to spend less and less time configuring things and more on things that actually matter. Asus' defaults are good and whenever I do need to reconfigure something it's always a breeze.
  - teknico 4y ago
    Agreed. It’s also the easiest way to improve latency and fix bufferbloat. Unfortunately not all Merlin-supported routers support the CAKE algorithm. My choices are the RT-AC86U, and the RT-AX68U if you need Wifi 6 support. Don’t get the RT-AC88U though, it has no CAKE. (If you’re lucky enough to have a gigabit connection, you’ll need more expensive stuff.)
watchdogtimer 4y ago
> If the router is administered with a mobile app and a cloud service, disabling remote access to the router is unchartered territory. Lotsa luck. I've noticed some new routers (e.g. the Eero from our ISP) can only be controlled via an app. Does that mean they can be controlled remotely?
- _kbh_ 4y ago
  > I've noticed some new routers (e.g. the Eero from our ISP) can only be controlled via an app. Does that mean they can be controlled remotely? Probably. On top of this a lot of routers will use TR-069 that allows for remote management of your router by your ISP. So even without a app its likely it can be controlled remotely. https://en.wikipedia.org/wiki/TR-069 https://en.wikipedia.org/wiki/TR-069
- Etheryte 4y ago
  For ISP-provided routers, this is a valued feature (for the ISP). It's a lot cheaper to reconfigure a customer's router remotely than it is to send an engineer out when something is not working.
schlipity 4y ago
I read this to find out if my Ubiquiti edge router 4 was secure or not and only saw one statement: "Ubiquiti is not recommended. More on why below." Only Ubiquiti isn't mentioned anywhere else that I can find. Kinda frustrating.
- nonameiguess 4y ago
  They got framed by a disgruntled employee a while back to make it look like an insider had leaked user data. I didn't see any mention of Ubiquiti on this page at all, but that may have been the reason if this guy isn't up to date on what happened. The other thing is their devices are enterprise devices and tend to require remote management capabilities, which this guy appears to always be against for home devices. It's worth understanding the whys of the tradeoffs for these types of enterprise WAPs that are remote-management only. They're often installed in more or less public places like airport lobbies, hotel hallways, stadiums. The ability to gain physical access is trivial and you really don't want anyone who can get physical access to be able to configure the device. Even in corporate settings, you don't want an employee who can get access to a device to be able to configure it, either. So having remote-only management, protected by all of the usual account provisioning that would protect any other critical service, makes a lot of sense. Does it make sense in the home? That depends. This guy, and probably a lot of consumers, really distrust any and all vendors, Ubiquiti included. But do you trust everyone in your home? I had a houseguest almost all of last summer. My wife's friend needed a place to stay after leaving his wife for a few months. I barely know the guy. I have Aruba WAPs, not Ubiquiti, but same idea. They can only be configured via an account-based mobile management app. This meant I could force his devices onto guest WiFi and there was no way for him to get around, even though he was in my house and could plug an ethernet cable into the WAPs if he wanted to. Do you trust all of your kids' friends or house party guests? More or less than the people who develop the mobile management app for your enterprise networking products?
sensiblesec 4y ago
This is classic security overreaction, when talking about home routers. Just to be clear if this is an issue for you, make sure you do not connect to any wifi you have not hardened yourself beforehand! Also articles on the page fail to show any practical implications and what does happen instead on what can happen. Don't get me wrong having your router used for DDoS and C2 is not great but it has 0 practical implications for you. The summaries on the page also omit that most of the nasty sounding issues are directly mitigated by using HTTPS. Delivering malware will have an affect but none of these articles actually mention such cases (other than it can be done) and how prevalent this is compared to other malware delivery methods. I'd say it is safe to assume it isn't. Also notice most of the recommendations have nothing to do with the these threats. That can be summed up to update your router and change password.
- YPPH 4y ago
  I tend to agree. And in terms of being used for DDoS attacks etc., that's really an issue that needs to be addressed by ISPs, who supply routers to the vast majority of non-technical home users. ISPs should be setting appropriate defaults, setting unique passwords, and issuing automatic firmware updates over the air.
  - sensiblesec 4y ago
    Agree. I see an argument about C2 and DDoS from a public good perspective but it is misguided to think this will be addressed by individuals
- nonameiguess 4y ago
  You can possibly get your entire house blocked and/or banned by services, servers, and networks that notice your public IP seems to be part of a botnet. That said, I'd be skeptical and want to see real data if this guy is claiming your router is more likely to be infected and become part of a botnet than your other networked devices.
  - sensiblesec 4y ago
mnd999 4y ago
I’m a big fan of the Turris Omnia. The author seems to write it off because he doesn’t like the UI, not because it’s insecure which is a bit odd to me.
excalibur 4y ago
This freaking site. I bought the pepwave surf soho because they recommended it. It has been such a PITA. I ended up setting it to reboot nightly so it would stop disconnecting us all the time. That helped a bit, it still needs manual reboots sometimes.
noidiocyallowed 4y ago
Security for those who work in IT without physics/RF background is mostly just a layer on top of the fundamentals that only a select few know and can apply. Rest is mostly theatre. If you tighten these here and there, and make sure it's really tight, you are properly protected. All while the standards you must use for Wifi area like an ementaler cheese, a ridiculous shitshow, just like bluetooth and the rest of the terrible standards that are forced on you.
- paulryanrogers 4y ago
  Can't one turn off the most insecure parts of WiFi like b, g, WPS, low bit encryption, etc.?
jeffbee 4y ago
This person seems to think that cloud-based router control is worse but I think it’s better. The router initiates the control connection and never accepts connections of any kind. This is strictly better. If someone wants to take over a cloud-managed router they have to exploit its packet-handling features, DHCP or DNS services and this is far more difficult.
OJFord 4y ago
So you want a non-unique SSID in order not to have your address uniquely identifiable everywhere you take your phone or other device that's trying to connect to it..but not a common one such that it aids cracking the password... How is one supposed to come up with a common enough but not too common SSID? Also, if your phone is trying to connect to your 'Bob's Hotspot' say, but you have it turned off, and someone else (er, Alice, why not) notices this and starts broadcasting 'Bob's Hotspot', does the phone send the passphrase, to Alice (who doesn't know it a priori), or is there some kind of certificate verification that it's the expected seen-before router, that fails in this case so the passphrase isn't sent?
megous 4y ago
My current favorite approach to home routing is a "router in a box" setup. - 1x VLAN capable managed switch - 1x any Linux capable SBC with 1x gbit ehternet port - any systemd based Linux distro (I like Arch Linux ARM for this purpose) Pretty much all the networking aside from firewall, and wifi setup can be configured via systemd-networkd/resolved these days. Once you have your installation and setup done, if your HW gives you trouble you can always replace it with anything else you have at hand. It's very flexible, and you can do a lot of things a typical router GUI would never allow you. It's great if you want to explore Linux networking. HW is cheap, low-power, doesn't need to be a "router" HW with multiple ports, and if anything happens you know you can replace the broken router with pretty much anything that has an ethernet port and can run a Linux distro.
- red369 4y ago
  This setup sounds great - am I understanding correctly, are you describing what is also called a router-on-a-stick? https://en.m.wikipedia.org/wiki/Router_on_a_stick https://en.m.wikipedia.org/wiki/Router_on_a_stick I’ve always been concerned (probably irrationally), that it seems to halve WAN bandwidth (since all traffic has to travel both in and out of the router over the same cable). Do you find this is an issue?
  - megous 4y ago
    Yes, router on a stick. :) I don't have a gigabit internet connection, but it should not be a huge issue for your typical unidirectional download or upload even on a gigabit. Ethernet is full-duplex, so you'll be able to saturate either direction (just not at once).
gumby 4y ago
I don’t see the point of disabling WPS,as every implementation I’ve seen requires pressing a hardware button on the router to switch it on for a minute. I have only one device that requires WPS (a wifi-only printer), but there is no other way to get it onto a wifi network.

Router Security

114 points by butz 4y ago

tasubotadas 4y ago

Disabling IPv6 is recommended? I thought we are all moving to use IPv6.

8organicbits 4y ago
The link has an interesting justification, I haven't heard that before. > That's because millions of home gateway routers, especially those leased to customers by their internet service providers (ISPs), leak their unique hardware ID numbers through their Internet Protocol (IP) addresses — and those hardware ID numbers can be connected to publicly available maps that show the street locations of Wi-Fi networks.
- Sakos 4y ago
  https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou-exploiting-leaked-identifiers-in-ipv-for-street-level-geolocation-22889 https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou... It's based on this talk apparently > We assume a weak adversary who is remote to the target and has no privileged access. Our privacy attack lies in IPv6 addresses formed via EUI-64, which embed the interface's hardware MAC address in the IPv6 address. While EUI-64 IPv6 addresses are no longer used by most operating systems, they are commonly found in legacy and low-profit-margin customer premises equipment (CPE), e.g., commodity routers connecting residential and business subscribers. Because IPv6 CPE are routed hops (as opposed to IPv4 NATs), we can discover their MAC address via traceroute if they use EUI-64. > These CPE are frequently all-in-one devices that also provide Wi-Fi. Crucially, the MAC address of the Wi-Fi interface is often related to the MAC address of the wide area interface, e.g., a +/-1 offset. These Wi-Fi MACs are broadcast (the 802.11 BSSID) and captured by wardriving databases that also record their physical location. By correlating the MAC addresses embedded in IPv6 home router addresses with their Wi-Fi address counterpart, we can remotely geolocate them, fusing virtual data with meatspace. They have a tool that lets you check a given IPv6 address: https://github.com/6int/IPvSeeYou https://github.com/6int/IPvSeeYou
  - ikiris 4y ago
    Heh, I was dubious but this is a perfectly valid explanation for why you should not embed phy addresses in IPs. That said, it's absolutely toxic to be telling people to just turn off IPv6. Completely makes me lose trust in the rest of the site's content.
    - Sakos 4y ago
      A source link to a very thorough article at Tom's Guide (https://www.tomsguide.com/news/home-gateway-geolocation-bh21 https://www.tomsguide.com/news/home-gateway-geolocation-bh21) is provided close to the top of the page (in the short list). That guide links to the Black Hat presentation. > For years, turning off IPv6 (IP version 6) was on the long list below, but as of August 2021, I think it belongs here on the short list too. Very very few people need it and it was recently disclosed that there is a possible security issue with it. I think you're being a bit too accusative. Every suggestion has sources to back it up if you want to see why something is recommended.
  - jaclaz 4y ago
    >These Wi-Fi MACs are broadcast (the 802.11 BSSID) and captured by wardriving databases that also record their physical location. I am not sure to understand, while this is in theory doable, do these "captured by wardriving" databases exist? And do they cover "everywhere"?
    - veonik 4y ago
      A long while back now Google came out saying[0] they did use their Google Maps Street View cars to also collect wifi+location information. It wouldn't surprise me if they augmented this info with data they receive through Google services running on Android phones too. So my bet is, yeah, they do exist and they do pretty much cover everywhere. [0]: https://www.theguardian.com/technology/2010/may/15/google-admits-storing-private-data https://www.theguardian.com/technology/2010/may/15/google-ad...
      - jaclaz 4y ago
- stonepresto 4y ago
  I think there's a better justification. Since IPv6 is still new-ish to SOHO, and often is lightly used at best, the firmware devs might not spend as much time building that support into the firmware. When devs get laxidasical, bugs happen.
  - feanaro 4y ago
    I'm not sure that's a better justification. It's definitely an additional justification, making the whole thing that much worse. But street-level geolocation is pretty bad in itself.
- zekica 4y ago
  This only correct for the router itself. Not for any devices connecting behind it.
njibhu 4y ago
There are a lot of shortcomings of IPv6 which prevents it to be widely used (particularly on the consumer network side). First thing to know is that it shifts responsibilities. The router is not responsible anymore for assigning IPs to the network. The devices assign their own IP address using SLAAC. You could use DHCPv6, but many devices simply won't support it (windows and android to begin with). Which brings the following issues: - No support for multi-homing. Example: You have two connections, a slow reliable one, and a fast unreliable one. With IPv4 you can easily setup multiwan in any proper L3 router. The router will ping both routes, and if the fast one is working, using it as main gateway. When it doesn't answer anymore, the router simply change its route. Because of NAT, this is transparent to the devices behind its network. For IPv6, this doesn't work anymore, because the IP prefix is set by the provider, without NAT the second provider will simply refuse to forward any packet which originates from an IP which doesn't have their prefix. The "solution" is to have your own address space, and use BGP to change the routes (which is out of reach for all of private consumers). - ISPs got it wrong ! I'm in Germany, tried 3 different providers, they all assign to my router a /64 subnet instead of /60 or /56 (as recommended by ARIN). The problem is that SLAAC only works with /64, below the devices usually won't assign themselves an IP anymore. So you can only have one network, you can't have a Guest network with a different prefix. - As mentioned by the article, the design is terrible for privacy: SLAAC works by simply taking the prefix from the router and filling the rest with the mac address. Which means that anybody on the internet gets to know your mac address. EDIT: This is wrong. See throw0101a answer below. - Captive portals: SLAAC does not directly support assigning DNS servers. So most captive portals simply break because the network's firewall blocks DNS requests as long as they don't use the proper DNS server, but the device might simply not even be able to receive it. (SLAAC has an extension where it can tell the device to receive the DNS servers from DHCPv6, but many devices simply ignore it and treat DNS like browsers do with DoH). EDIT: This is wrong. See throw0101a answer below. - Security within networks: Because the responsibilities of who assigns IP is shifted to the devices, switches cannot prevent devices to assign themselves IP anymore. So it's very easy for malicious devices to flood routing tables of switches by telling them that they own all IPv6 for the whole /64. Makes the whole network abysmally slow, or completely down. Most of these issues are solved by using NAT6 (or NPT), but the issue with it, is that it breaks some applications. Ipv6 promised to get rid of NAT, so some applications took the liberty to assume that their local IP would always be the same visible on the internet. Not sure if that's this particular case for SIP, but it's usually broken with NAT6.
tryauuum 4y ago
if you don't have ipv6 access to internet, makes sense to disable it in router's kernel. It makes the attack surface smaller By default Linux assigns a link-local ipv6 address to each interface, this can be undesirable
redleader55 4y ago
The author shows a complete lack of knowledge on IPv6. Yes, you do get a SLAAC address which basically contains you MAC, but if your OS supports it, you will also get a anonymized address which does not leak your MAC on the internet. Windows, Android, Linux, iOS all support MAC address anonymization, so as long as you are using a recent OS you should be fine. Very weird suggestion...
- whyoh 4y ago
  Right. But isn't it so that each device gets its own IPv6 public address? So that PC1 and PC2 connected through the same modem are identifiable by different IPs, while you can still see that they're from the same modem/household? If that's the case, it can be a privacy concern.
  - tommiegannert 4y ago
    Theoretically, even non-router devices could use more than one address, just to confuse what's listening on the other side. In that scenario, DHCPv6 would be responsible for keeping the assigned subnet filled randomly, rather than being conservative and consistent with address assignments. I don't know if anyone is doing it now, but I don't think we should dismiss IPv6 for this reason.
    - megous 4y ago
      Android doesn't respect/implement DHCPv6. But there are IPv6 privacy extensions that periodically rotate the IPv6 addresses of the device. https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941
      - tommiegannert 4y ago
        Thanks for the reference! Doing that directly with SLAAC is of course even nicer.
- throw0101a 4y ago

julianlam 4y ago

I wonder how router security from a flashed FreshTomato router compare to stock firmware from a large vendor, for example.

stonepresto 4y ago
Haven't used it myself, but I'm more keen to trust open source code & communities than vendors.
ce4 4y ago
I Dont know if Tomato publishes CVEs. But you could check the release notes for OpenWrt for CVEs over the last couple of years. I would trust OpenWrt more, especially their continued support for old devices, one accesspoint of mine is 11 years old, supported in the 2022 release and still going strong (128MB RAM, 32MB flash)
zekica 4y ago
FreshTomato I think uses old kernel versions (2.6.xx) where security fixes are not backported. OpenWRT uses modern kernels (5.10) and mainline or external open source drivers but doesn't work on Broadcom devices.

stonepresto 4y ago

Don't rely on vendors to ship you secure fimware. Use something open source such as OpenWRT. It will make implementing the protections this blog mentions much easier.

throw0101a 4y ago
I've found out-of-box Asus to be pretty good, and they sometimes even incorporate features from third-party firmware (see "first debuted"): * https://www.asuswrt-merlin.net/features https://www.asuswrt-merlin.net/features
- NGRhodes 4y ago
  Merlin firmware is special in a good way. Merlin has a good relationship with the Asus firmware dev team, he gets early access to official firmware, they sometimes ship him unreleased routers. He often finds and fixes bugs and creates/adds new features that Asus pickup. Also very careful to maintain full compatibility with the stock firmware, making it easy to switch between stock and merlin. He has also created an interface to allow 3rd party features to get their UI page. There is probably more, but it really is an excellent project.
  - whateveracct 4y ago
    Merlin is why I got an Asus router when the time came to upgrade.
- Etheryte 4y ago
  I've had similar experiences. As time goes on I want to spend less and less time configuring things and more on things that actually matter. Asus' defaults are good and whenever I do need to reconfigure something it's always a breeze.
- teknico 4y ago
  Agreed. It’s also the easiest way to improve latency and fix bufferbloat. Unfortunately not all Merlin-supported routers support the CAKE algorithm. My choices are the RT-AC86U, and the RT-AX68U if you need Wifi 6 support. Don’t get the RT-AC88U though, it has no CAKE. (If you’re lucky enough to have a gigabit connection, you’ll need more expensive stuff.)

watchdogtimer 4y ago

> If the router is administered with a mobile app and a cloud service, disabling remote access to the router is unchartered territory. Lotsa luck. I've noticed some new routers (e.g. the Eero from our ISP) can only be controlled via an app. Does that mean they can be controlled remotely?

_kbh_ 4y ago
> I've noticed some new routers (e.g. the Eero from our ISP) can only be controlled via an app. Does that mean they can be controlled remotely? Probably. On top of this a lot of routers will use TR-069 that allows for remote management of your router by your ISP. So even without a app its likely it can be controlled remotely. https://en.wikipedia.org/wiki/TR-069 https://en.wikipedia.org/wiki/TR-069
Etheryte 4y ago
For ISP-provided routers, this is a valued feature (for the ISP). It's a lot cheaper to reconfigure a customer's router remotely than it is to send an engineer out when something is not working.

schlipity 4y ago

I read this to find out if my Ubiquiti edge router 4 was secure or not and only saw one statement: "Ubiquiti is not recommended. More on why below." Only Ubiquiti isn't mentioned anywhere else that I can find. Kinda frustrating.

nonameiguess 4y ago
They got framed by a disgruntled employee a while back to make it look like an insider had leaked user data. I didn't see any mention of Ubiquiti on this page at all, but that may have been the reason if this guy isn't up to date on what happened. The other thing is their devices are enterprise devices and tend to require remote management capabilities, which this guy appears to always be against for home devices. It's worth understanding the whys of the tradeoffs for these types of enterprise WAPs that are remote-management only. They're often installed in more or less public places like airport lobbies, hotel hallways, stadiums. The ability to gain physical access is trivial and you really don't want anyone who can get physical access to be able to configure the device. Even in corporate settings, you don't want an employee who can get access to a device to be able to configure it, either. So having remote-only management, protected by all of the usual account provisioning that would protect any other critical service, makes a lot of sense. Does it make sense in the home? That depends. This guy, and probably a lot of consumers, really distrust any and all vendors, Ubiquiti included. But do you trust everyone in your home? I had a houseguest almost all of last summer. My wife's friend needed a place to stay after leaving his wife for a few months. I barely know the guy. I have Aruba WAPs, not Ubiquiti, but same idea. They can only be configured via an account-based mobile management app. This meant I could force his devices onto guest WiFi and there was no way for him to get around, even though he was in my house and could plug an ethernet cable into the WAPs if he wanted to. Do you trust all of your kids' friends or house party guests? More or less than the people who develop the mobile management app for your enterprise networking products?

sensiblesec 4y ago

This is classic security overreaction, when talking about home routers. Just to be clear if this is an issue for you, make sure you do not connect to any wifi you have not hardened yourself beforehand! Also articles on the page fail to show any practical implications and what does happen instead on what can happen. Don't get me wrong having your router used for DDoS and C2 is not great but it has 0 practical implications for you. The summaries on the page also omit that most of the nasty sounding issues are directly mitigated by using HTTPS. Delivering malware will have an affect but none of these articles actually mention such cases (other than it can be done) and how prevalent this is compared to other malware delivery methods. I'd say it is safe to assume it isn't. Also notice most of the recommendations have nothing to do with the these threats. That can be summed up to update your router and change password.

YPPH 4y ago
I tend to agree. And in terms of being used for DDoS attacks etc., that's really an issue that needs to be addressed by ISPs, who supply routers to the vast majority of non-technical home users. ISPs should be setting appropriate defaults, setting unique passwords, and issuing automatic firmware updates over the air.
- sensiblesec 4y ago
  Agree. I see an argument about C2 and DDoS from a public good perspective but it is misguided to think this will be addressed by individuals
nonameiguess 4y ago
You can possibly get your entire house blocked and/or banned by services, servers, and networks that notice your public IP seems to be part of a botnet. That said, I'd be skeptical and want to see real data if this guy is claiming your router is more likely to be infected and become part of a botnet than your other networked devices.
- sensiblesec 4y ago

mnd999 4y ago

I’m a big fan of the Turris Omnia. The author seems to write it off because he doesn’t like the UI, not because it’s insecure which is a bit odd to me.

excalibur 4y ago

This freaking site. I bought the pepwave surf soho because they recommended it. It has been such a PITA. I ended up setting it to reboot nightly so it would stop disconnecting us all the time. That helped a bit, it still needs manual reboots sometimes.

noidiocyallowed 4y ago

Security for those who work in IT without physics/RF background is mostly just a layer on top of the fundamentals that only a select few know and can apply. Rest is mostly theatre. If you tighten these here and there, and make sure it's really tight, you are properly protected. All while the standards you must use for Wifi area like an ementaler cheese, a ridiculous shitshow, just like bluetooth and the rest of the terrible standards that are forced on you.

paulryanrogers 4y ago
Can't one turn off the most insecure parts of WiFi like b, g, WPS, low bit encryption, etc.?

jeffbee 4y ago

This person seems to think that cloud-based router control is worse but I think it’s better. The router initiates the control connection and never accepts connections of any kind. This is strictly better. If someone wants to take over a cloud-managed router they have to exploit its packet-handling features, DHCP or DNS services and this is far more difficult.

OJFord 4y ago

So you want a non-unique SSID in order not to have your address uniquely identifiable everywhere you take your phone or other device that's trying to connect to it..but not a common one such that it aids cracking the password... How is one supposed to come up with a common enough but not too common SSID? Also, if your phone is trying to connect to your 'Bob's Hotspot' say, but you have it turned off, and someone else (er, Alice, why not) notices this and starts broadcasting 'Bob's Hotspot', does the phone send the passphrase, to Alice (who doesn't know it a priori), or is there some kind of certificate verification that it's the expected seen-before router, that fails in this case so the passphrase isn't sent?

megous 4y ago

My current favorite approach to home routing is a "router in a box" setup. - 1x VLAN capable managed switch - 1x any Linux capable SBC with 1x gbit ehternet port - any systemd based Linux distro (I like Arch Linux ARM for this purpose) Pretty much all the networking aside from firewall, and wifi setup can be configured via systemd-networkd/resolved these days. Once you have your installation and setup done, if your HW gives you trouble you can always replace it with anything else you have at hand. It's very flexible, and you can do a lot of things a typical router GUI would never allow you. It's great if you want to explore Linux networking. HW is cheap, low-power, doesn't need to be a "router" HW with multiple ports, and if anything happens you know you can replace the broken router with pretty much anything that has an ethernet port and can run a Linux distro.

red369 4y ago
This setup sounds great - am I understanding correctly, are you describing what is also called a router-on-a-stick? https://en.m.wikipedia.org/wiki/Router_on_a_stick https://en.m.wikipedia.org/wiki/Router_on_a_stick I’ve always been concerned (probably irrationally), that it seems to halve WAN bandwidth (since all traffic has to travel both in and out of the router over the same cable). Do you find this is an issue?
- megous 4y ago
  Yes, router on a stick. :) I don't have a gigabit internet connection, but it should not be a huge issue for your typical unidirectional download or upload even on a gigabit. Ethernet is full-duplex, so you'll be able to saturate either direction (just not at once).

gumby 4y ago

I don’t see the point of disabling WPS,as every implementation I’ve seen requires pressing a hardware button on the router to switch it on for a minute. I have only one device that requires WPS (a wifi-only printer), but there is no other way to get it onto a wifi network.