5 ms·
How are router manufacturers so incompetent? They’ve been in the biz long enough to know that a security through obscurity back doors don’t hold. And yet this
by Havoc 2y ago
How are router manufacturers so incompetent?
They’ve been in the biz long enough to know that a security through obscurity back doors don’t hold. And yet this keeps happening.
- Hackbraten 2y agoHome routers aren’t exactly a high-margin industry. Manufacturers may not be willing to pay for developers who know what they’re doing.
- nickpeterson 2y agoThat or they get developers who know exactly what they’re doing…
- toyg 2y ago* codemonkey takes low salary from router manufacturer * codemonkey integrates it with low salary from $state_actor * codemonkey be happy, manufacturer be happy, state actor be happy - win-win!
- nickpeterson 2y agoI’m pretty sure you missed a step where “he gets up gets coffee”
- ahazred8ta 2y agoState actor have many banana.
- Havoc 2y agoDon’t leave mystery backdoors exposed internet side isn’t exactly advanced knowledge though
- arp242 2y agoIt's LAN side only. Not that this excuses things, but it's not internet side.
- dagw 2y agoProbably a temporary hack someone did to facilitate some internal testing and no one remembered to comment it out before building the release version.
- sgc 2y agoI tend to think this type of failure is from utter lack of caring. They know it's there, they know it's a security hole, but are just too lazy to deal with it until it comes back to bite them.
- repelsteeltje 2y agoHow would hn community feel about government intervention into this obvious market failure? For instance: mandate all firmware on home routers be open source. (Either by selling hardware only and give guidance on installing openwrt or disclosing the source to their existing proprietary crap) Is that a good idea? Is it realistic?
- tenebrisalietum 2y agoI would bet such intervention results in it no longer being allowed to use GPL-style open source code that lets you rebuild/customize firmware, and no longer being allowed/able to use firmware not signed by the manufacturer.
- repelsteeltje 2y agoDo you mean vendors would try to subvert/work around such legislation?
- tenebrisalietum 2y agoNo. This concrete example illustrates my intended meaning: Asus has a couple of Wi-Fi access point/switch/router combos with their own Tomato derived firmware named AsusWRT. It's nice. Because it's GPL, the source is required to be available, and a project for a derivative firmware named Merlin exists. Merlin provides additional features. One can choose to flash this firmware if desired. If these devices must only accept signed firmware then the above becomes practically impossible and you cannot control the software running on your own device.
- repelsteeltje 2y agoAh. So essentially, malicious compliance with the open source requirement, using DRM/tpm. Probably under the gise of SECURITAHH... Yeah, I can see that. Might be remediated using legislation as well - mandate free access to third parties. The point being that (open) software development can continue maintenance beyond vendor support for the hardware. But yeah, that would still need some story - and clever thoughts - about authenticity and trustworthiness of the firmware and how to technically enforce them.
- GordonS 2y agoIt could have been deliberate, at the behest of a 3-letter US agency for example.
- steelbrain 2y agoIsn't D-Link Chinese? Why would they compromise their firmware for a US agency?
- dagw 2y agoPretty sure D-Link is Taiwanese. And Taiwan has reasons to want to be on good terms with the US. That being said, my money is still on incompetence.
- toyg 2y agoD-Link the company is one thing, but a company is made of individual people - each with their own needs and motivations. Intelligence work is so much easier when one stops reasoning in terms of groups.
- GordonS 2y agoAren't they Taiwanese?
- ZaoLahma 2y agoI doubt any of the famous three letter US agencies would need (or want!) such a wide open door as a "specific URL" and logging in with an administrator account acquired from the firmware itself. I would think that they would want a door that couldn't be opened by someone who happened to spot it, to not give anyone else the same advantage. No, this is more likely the result of a test or some annoying procedure during development that needed more access than the device would normally provide - I've seen it before, and I think most people who work with embedded systems at least at some point in their career have done something that would be bad if it ended up in production units.
- throwaway984393 2y ago[dead]
- HumblyTossed 2y agoThey all really should use OpenWrt and put a Luci alt on it if they want a new skin. It would probably save them money to do this...
- nicce 2y agoThen they have nothing of value to sell when customers notice that can get the same for free and demand lower prices. Not saying that it would be a bad thing.
- tracker1 2y agoMany home routers are in the sub-$200 price range. I've seen low end devices under $50/usd. There's not much more to squeeze out. And many won't be paying more, or installing OpenWRT, OpnSense or anything else on their own. I wish more open options were supported from vendors, but they have to lock down and make sure you can't run on frequencies or wattages not allowed in $COUNTRY, less they see massive fines. I'm using an OpnSense device with a commercial AP myself.. it does cost a bit more, but works great and will be updated beyond what any home router will. Most seem to want a discreet all in one box.
- nativeit 2y agoHow would they sell a back door then? We keep talking like this was some kind of negligence and/or oversight. Who’s to say this isn’t all according to plan?
- Grimeton 2y agoAnd then they'd patch the telnet backdoor into their custom image. Nothing won, but a lot lost for OpenWRT.
- dagw 2y agoThey’ve been in the biz long enough This is only relevant if they have a way of passing institutional knowledge from one 'generation' of developers to another. If churn is high enough and internal processes bad enough it is quite likely that entirely new teams are relearning the same lessons from the same mistakes over and over again every couple of years.
- kalleboo 2y agoBecause they have no reason to be competent. This security report will have no impact on their profits.