6 ms·

Ask HN: Are there any hardware manufacturers that can be relied upon not to have big security problems?

hwbunny 3y ago
D-Link always was an almost trash kinda company.
wepple 3y ago
Amazon, Apple, Google tend to ship hardware that at least doesn’t having gaping 1997 style vulnerabilities everywhere. Cisco have had some doozies but overall aren’t terrible. Everything else is probably bad.
- jwells89 3y ago
  I wish Apple hadn’t dropped out of the router business. The only good replacements all seem to be considerably more involved, e.g. a full Ubiquiti setup or one of the more mainstream routers with third party firmware. AirPorts were excellent for shoving into a corner and not having to think about aside from the odd firmware update every few years.
rfoo 3y ago
What kind of hardware? For home networking? Ubiquiti is okay. As bugs in these enterprise/SMB networking gear worth a little $$$ so there's at least people looking for low hanging fruits. The best option however, is to find a recent MediaTek-based (because they are currently the most upstream-friendly WiFi AP SoC vendor) home router with vulnerable firmware (for easier flash lol) and replace the firmware with OpenWRT. For NAS just build your own, or buy used rack-mount servers off eBay and leave them in basement.
candiddevmike 3y ago
Use generic hardware or build your own, and install an OS you can manage yourself
mtlynch 3y ago
These problems all go away if you don't expose crappy management software directly to the Internet. Don't allow anonymous inbound traffic on your firewall to hit your NAS (or any other interface that you're not updating and monitoring rigorously). If you need remote access to your NAS, install a VPN (e.g., Tailscale, ZeroTier) on the NAS or a different host on your internal network, and then access it remotely over an SSH tunnel. I understand that the casual home user doesn't know how to install a VPN or do SSH tunneling, so they end up exposing their NAS through the firewall, and that's why these issues are widespread. But for people who are a bit more technically savvy, you can massively reduce your attack surface by denying any inbound connections through your home firewall.
- kevincox 3y ago
  While "don't let any possible attacker see the device" is good defence in depth it is a pretty shitty only level of security. Even if it is protected outside of your local network many people have crappy IoT devices or even just laptops with malware on their network. In top of that this won't even really prevent this vulnerability as it can be triggered by a GET request. This means that if you are connected to the VPN any site you visit can trigger it. (If they can guess the hostname or IP)
  - Dalewyn 3y ago
    >crappy IoT devices Those should all go on their own vlan, or for a more Joe Average(tm) approach the guest network. >laptops with malware on their network. At that point you've got bigger fish to fry than shitty firmware, all bets are off.
    - kevincox 3y ago
      Why are all bets off if you have malware on my network. My devices are hardened with the expectation of being on hostile networks. My computers, phone and home server all assume that they are exposed to malicious actors. Of course defence in depth is also important, but there is no reason that all bets should be off if an attacker can access your device over the network.
panja 3y ago
Use your own hardware and something like Unraid
tomaskafka 3y ago
Mikrotik seems to be pretty regularly updated, even old devices - assuming they're not NSA frontend :)
deleted 3y ago
[deleted]
arp242 3y ago
To the best of my knowledge there has never been a remote exploit for a Commodore 64.
- basementcat 3y ago
  Morning standup at a state sponsored hacking organization. Bob: I hope everyone had a good weekend. I’d like to start out by giving some kudos to Fred and Jane for the D-Link NAS back door! A round of polite clapping. Bob: Let’s start with Igor, how's it going? Igor: Bah, my target is running web server on Commodore 64 so I spend all weekend to write 6502 remote exploit for Contiki OS. Unfortunately, I found out target keeps secrets on ZX81 but I don’t know Z80 assembly. Bob: Fortunately we’re a state sponsored hacking organization so we have considerable resources. Federico, do you think you could give Igor a hand? Federico: Certamente!
aaron695 3y ago
[dead]
deleted 3y ago
[deleted]
jqpabc123 3y ago
Short answer --- no. The key term here is *hardware manufacturers*. They have no financial incentive to worry too much about software. The solution to every problem is to buy new hardware. Software bugs are just added incentive.

D-Link always was an almost trash kinda company.

Amazon, Apple, Google tend to ship hardware that at least doesn’t having gaping 1997 style vulnerabilities everywhere. Cisco have had some doozies but overall aren’t terrible. Everything else is probably bad.

jwells89 3y ago
I wish Apple hadn’t dropped out of the router business. The only good replacements all seem to be considerably more involved, e.g. a full Ubiquiti setup or one of the more mainstream routers with third party firmware. AirPorts were excellent for shoving into a corner and not having to think about aside from the odd firmware update every few years.

rfoo 3y ago

What kind of hardware? For home networking? Ubiquiti is okay. As bugs in these enterprise/SMB networking gear worth a little $$$ so there's at least people looking for low hanging fruits. The best option however, is to find a recent MediaTek-based (because they are currently the most upstream-friendly WiFi AP SoC vendor) home router with vulnerable firmware (for easier flash lol) and replace the firmware with OpenWRT. For NAS just build your own, or buy used rack-mount servers off eBay and leave them in basement.

candiddevmike 3y ago

Use generic hardware or build your own, and install an OS you can manage yourself

mtlynch 3y ago

These problems all go away if you don't expose crappy management software directly to the Internet. Don't allow anonymous inbound traffic on your firewall to hit your NAS (or any other interface that you're not updating and monitoring rigorously). If you need remote access to your NAS, install a VPN (e.g., Tailscale, ZeroTier) on the NAS or a different host on your internal network, and then access it remotely over an SSH tunnel. I understand that the casual home user doesn't know how to install a VPN or do SSH tunneling, so they end up exposing their NAS through the firewall, and that's why these issues are widespread. But for people who are a bit more technically savvy, you can massively reduce your attack surface by denying any inbound connections through your home firewall.

kevincox 3y ago
While "don't let any possible attacker see the device" is good defence in depth it is a pretty shitty only level of security. Even if it is protected outside of your local network many people have crappy IoT devices or even just laptops with malware on their network. In top of that this won't even really prevent this vulnerability as it can be triggered by a GET request. This means that if you are connected to the VPN any site you visit can trigger it. (If they can guess the hostname or IP)
- Dalewyn 3y ago
  >crappy IoT devices Those should all go on their own vlan, or for a more Joe Average(tm) approach the guest network. >laptops with malware on their network. At that point you've got bigger fish to fry than shitty firmware, all bets are off.
  - kevincox 3y ago
    Why are all bets off if you have malware on my network. My devices are hardened with the expectation of being on hostile networks. My computers, phone and home server all assume that they are exposed to malicious actors. Of course defence in depth is also important, but there is no reason that all bets should be off if an attacker can access your device over the network.

panja 3y ago

Use your own hardware and something like Unraid

tomaskafka 3y ago

Mikrotik seems to be pretty regularly updated, even old devices - assuming they're not NSA frontend :)

deleted 3y ago

[deleted]

arp242 3y ago

To the best of my knowledge there has never been a remote exploit for a Commodore 64.

basementcat 3y ago
Morning standup at a state sponsored hacking organization. Bob: I hope everyone had a good weekend. I’d like to start out by giving some kudos to Fred and Jane for the D-Link NAS back door! A round of polite clapping. Bob: Let’s start with Igor, how's it going? Igor: Bah, my target is running web server on Commodore 64 so I spend all weekend to write 6502 remote exploit for Contiki OS. Unfortunately, I found out target keeps secrets on ZX81 but I don’t know Z80 assembly. Bob: Fortunately we’re a state sponsored hacking organization so we have considerable resources. Federico, do you think you could give Igor a hand? Federico: Certamente!

aaron695 3y ago

[dead]

deleted 3y ago

[deleted]

jqpabc123 3y ago

Short answer --- no. The key term here is *hardware manufacturers*. They have no financial incentive to worry too much about software. The solution to every problem is to buy new hardware. Software bugs are just added incentive.