3 ms·

>While "don't let any possible attacker see the device" is good defence in depth it is a pretty shitty only level of security. If we're talking about a company

>While "don't let any possible attacker see the device" is good defence in depth it is a pretty shitty only level of security. If we're talking about a company, I agree. For a home, I think VPN + firewall is sufficient security against insecure management software on network devices. >Even if it is protected outside of your local network many people have crappy IoT devices or even just laptops with malware on their network. If there's a malicious laptop within your network, what difference does it make if your NAS has a security vulnerability? If your laptop is compromised, it's game over anyway because the attacker can steal your cookies or install a keylogger. If it's a housemate's laptop that doesn't have access to the NAS, they can do ARP poisoning[0] and MitM your NAS to steal your credentials (unless you're also vigorous about managing your own TLS CA). >In top of that this won't even really prevent this vulnerability as it can be triggered by a GET request. This means that if you are connected to the VPN any site you visit can trigger it. (If they can guess the hostname or IP) Other websites can trigger the behavior, but they can't read any responses because of same origin policy, so they can't exploit anything.[1] Correction: I overlooked in the writeup that the GET request allows RCE. So, you're right is that malicious websites can exploit this despite SOP. Still, firewall + VPN reduces your risk by many orders of magnitude. Instead of the attacker trivially scanning for your device or looking it up on Shodan, they have to trick you into visiting a malicious site. [0] https://en.wikipedia.org/wiki/ARP_spoofing https://en.wikipedia.org/wiki/ARP_spoofing [1] https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...

kevincox 3y ago
> they can do ARP poisoning[0] and MitM your NAS to steal your credentials (unless you're also vigorous about managing your own TLS CA) All traffic to my NAS is secured, even over the local network. I don't trust the network and I don't think it should be game-over for my NAS because my housemate installs some malware. I use SSH with pinned keys and TLS (thanks Let's Encrypt). I think if any NAS appliance doesn't provide some basic security like this it is a failing of that vendor. Even a self-signed TLS cert to provide TOFU validation would go a long way. (And actually in many ways be more secure than a public CA issued certificate.)
- mtlynch 3y ago
  I guess I'm not really sure what you're advocating. These measures sound good for you, but what percentage of HN readers can do that? How many threats does it eliminate in practice beyond what you'd get from basic VPN + firewall? There's always additional security measures you can take, but the costs go up and the marginal benefits go down. It's a bit like saying it's not sufficient for other HN users to deadbolt their doors because it's weaker than the armed guards that patrol your property 24/7.
  - kevincox 3y ago
    Well what are you advocating? It seems like you are suggesting that device security isn't important because it is hard to do and a firewall will solve most problems. But at the same time we are looking at a vulnerability that works through a firewall. I am just suggesting that even in a presence of a firewall we should expect appliances to be secure on a hostile network. That is the standard we should hold vendors to. Much like Android, iOS, Windows and macOS hold themselves to this standard. I'm also not saying that you should test this standard, defence in depth is very valuable. But I don't think saying "it is hard and a firewall solves many issues" is a good reason to forgive these vendors for shit security.
    - mtlynch 3y ago
      >Well what are you advocating? It seems like you are suggesting that device security isn't important because it is hard to do and a firewall will solve most problems. I'm advocating firewall with no inbound traffic + VPN for remote access. It mitigates most of the risk of devices on your network having security vulnerabilities. My original comment in this thread was that it's more important to firewall + VPN your network than it is to pick a network appliance with a good security record. I agree that there certainly are additional precautions you can take, but I think firewall + VPN defends against most practical attacks the average HN user would encounter. Firewall + VPN is something a large proportion of HN (40%?) is capable of doing with about an hour of effort. I think it's a pretty small segment of HN that's even capable of the precautions you're talking about (separate VLANs, custom certificates, hardening every host), and it would take person-days of effort to replicate. >But I don't think saying "it is hard and a firewall solves many issues" is a good reason to forgive these vendors for shit security. I don't forgive vendors for shit security. I agree with you that we should hold vendors accountable. RCE on an unauthenticated GET request is absurdly incompetent and irresponsible, and D-Link deserves punishment. That said, I'm not in a position to influence D-Link, but I am in a position to help users protect themselves if appliances on their network have mistakes like this.
asveikau 3y ago
> For a home, I think VPN + firewall is sufficient security against insecure management software on network devices. If you have some iot devices which phone home on the same network, then this theoretically could be a vector. It can be hard to know if that's the case. On the more paranoid side, be sure your guest wifi can't access these devices.

kevincox 3y ago

> they can do ARP poisoning[0] and MitM your NAS to steal your credentials (unless you're also vigorous about managing your own TLS CA) All traffic to my NAS is secured, even over the local network. I don't trust the network and I don't think it should be game-over for my NAS because my housemate installs some malware. I use SSH with pinned keys and TLS (thanks Let's Encrypt). I think if any NAS appliance doesn't provide some basic security like this it is a failing of that vendor. Even a self-signed TLS cert to provide TOFU validation would go a long way. (And actually in many ways be more secure than a public CA issued certificate.)

mtlynch 3y ago
I guess I'm not really sure what you're advocating. These measures sound good for you, but what percentage of HN readers can do that? How many threats does it eliminate in practice beyond what you'd get from basic VPN + firewall? There's always additional security measures you can take, but the costs go up and the marginal benefits go down. It's a bit like saying it's not sufficient for other HN users to deadbolt their doors because it's weaker than the armed guards that patrol your property 24/7.
- kevincox 3y ago
  Well what are you advocating? It seems like you are suggesting that device security isn't important because it is hard to do and a firewall will solve most problems. But at the same time we are looking at a vulnerability that works through a firewall. I am just suggesting that even in a presence of a firewall we should expect appliances to be secure on a hostile network. That is the standard we should hold vendors to. Much like Android, iOS, Windows and macOS hold themselves to this standard. I'm also not saying that you should test this standard, defence in depth is very valuable. But I don't think saying "it is hard and a firewall solves many issues" is a good reason to forgive these vendors for shit security.
  - mtlynch 3y ago
    >Well what are you advocating? It seems like you are suggesting that device security isn't important because it is hard to do and a firewall will solve most problems. I'm advocating firewall with no inbound traffic + VPN for remote access. It mitigates most of the risk of devices on your network having security vulnerabilities. My original comment in this thread was that it's more important to firewall + VPN your network than it is to pick a network appliance with a good security record. I agree that there certainly are additional precautions you can take, but I think firewall + VPN defends against most practical attacks the average HN user would encounter. Firewall + VPN is something a large proportion of HN (40%?) is capable of doing with about an hour of effort. I think it's a pretty small segment of HN that's even capable of the precautions you're talking about (separate VLANs, custom certificates, hardening every host), and it would take person-days of effort to replicate. >But I don't think saying "it is hard and a firewall solves many issues" is a good reason to forgive these vendors for shit security. I don't forgive vendors for shit security. I agree with you that we should hold vendors accountable. RCE on an unauthenticated GET request is absurdly incompetent and irresponsible, and D-Link deserves punishment. That said, I'm not in a position to influence D-Link, but I am in a position to help users protect themselves if appliances on their network have mistakes like this.

asveikau 3y ago

> For a home, I think VPN + firewall is sufficient security against insecure management software on network devices. If you have some iot devices which phone home on the same network, then this theoretically could be a vector. It can be hard to know if that's the case. On the more paranoid side, be sure your guest wifi can't access these devices.