6 ms·
IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely co
by selinkocalar 1y ago
IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning.
Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.
- teaearlgraycold 1y agoThe solution is pfsense
- arminiusreturns 1y agoThe soulutions is iptables. The solution is nftables. The solution is bpf. The solution is emacs-m-x-butterfly-bpf.
- baby_souffle 1y agoOr openWRT. The bsd based distributions sure are powerful, but with the power/heat budget to match.
- bmurphy1976 1y agoI love me some OpenWRT but updating it has always been a risky chore.
- fignews 1y agoCheck out attended sysupgrade
- nuker 1y agoBetter go OPNsense
- drnick1 1y agoActually, pfsense kind of has a shitty reputation in the FOSS community and opnSense is preferred. But I don't like the limitations of BSD systems in terms of hardware compatibility and performance, so I build my router using a plain Linux distro (Debian).
- the_biot 1y agoThat's the first I've heard of pfsense having a bad reputation, can you explain? (I haven't used it, genuinely want to know)
- Eisenstein 1y agohttps://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
- red-iron-pine 1y agowild read. sounds like the core of the issue was that Netgate hired a weirdo, and then botched how they handled it when the weirdo got -- go figure -- weird. and it showed how FreeBSD does commits badly and may not have any (or few) code reviews honestly makes me feel bad about using netgate boxes -- what else needs to be fixed?
- Joe_Cool 1y agoThey also did this: https://web.archive.org/web/20160314132836/http://www.opnsense.com/ https://web.archive.org/web/20160314132836/http://www.opnsen... And WIPO had to take the domain away from them: https://en.wikipedia.org/wiki/PfSense#OPNsense https://en.wikipedia.org/wiki/PfSense#OPNsense
- java-man 1y agoIOT - "S" stands for "Security"!
- BLKNSLVR 1y agoThe password for my IoT wifi is "TheSInIoT" ;)
- briHass 1y agoThe stuff on the shelf, sure, but you can always go 'prosumer-grade' like Ubiquiti or Mikrotik for hardware that actually receives timely updates and has competently written firmware.
- drnick1 1y agoUbiquiti is awful, it's a cloud-centric ecosystem. The best "prosumer-grade" stuff is probably OpenWrt. If you need more power, opnSense or a plain Linux distro on an x86 machine.
- gradstudent 1y agoNot entirely true. There's a local admin option, where your Ubiquiti devices never see the internet (well, except your gateway). You can then connect and admin the whole thing remotely via your own VPN. It's quite nice, actually.
- 31337Logic 1y ago100% this.
- omcnoe 1y agoOpenWRT is trading money for time. It's fine to recommend to someone interested in setting up their own custom router, but for most "prosumers" Ubiquiti will provide a better experience. It's worth noting that Ubiquiti provides local admin support, and that the Ubiquiti Cloud data breach was actually a false story spread by a disgruntled internal engineer in an attempt to extort his employer.
- ThatMedicIsASpy 1y agoAs a MikroTik user. Do not start unless you know your ways around networking. And if you do prepare some time to get used to it. Once you do it isn't hard but the onboarding and having 20-40 options for everything you can do is confusing.
- cortesoft 1y agoMost people are using routers given to them (and configured by) their ISP... so really they are blackboxes connected to an upstream blackbox for most people. I am always surprised by how many people give me their ISP chosen router name and ISP chosen password when I connect to their WiFi. I don't want to give my ISP that much control.
- tharkun__ 1y agoAre you really surprised though or are you talking about the HN reading subset of your "many people"? Coz I would absolutely 100% not be surprised for your average consumer. For your average HN reader I would hope they treat whatever their ISP gave them as just some dumb "switch" type device that sits outside their trusted network and handles nothing but encrypted traffic. Like my ISPs device definitely does have a WiFi and such, which I disabled. I treat it as a bridge / modem and it's definitely not part of my "inner circle". Hasn't been in 25 years.
- Gigachad 1y agoThere are countless routers in between you and your destination which you can't audit anyway. End devices long since consider the routers to be compromised and have everything verified and encrypted in transit. So unless your router is participating in a DDoS or mining bitcoins it doesn't really matter how secure it is.
- johncolanduoni 1y agoMany IoT devices (or Windows when the LAN network location is set to “Private”) expose a wider surface area to local network addresses. Having a competent firewall on your residential router is still useful, especially for those that have no idea how to configure their endpoints securely. Comparing a residential router to a network operator’s router is spurious: those routers don’t perform any sort of filtering for the public internet traffic flowing through them.
- dracotomes 1y agoIs there any residential router that exposes internal endpoints be default? I've yet to come across one that does not have a deny-any policy on it's WAN interface and has incoming destination NATs setup up. What use is reducing the attack surface of a device which only ever initiates connections? Edit: also there are network operators that block customer traffic on certain ports liike NetBIOS, SMB or SMTP to name a few.
- lazide 1y agoMany happily do Network PNP, etc. which allows them to open ports on the public facing side of the router.
- johncolanduoni 1y agoIf your home router is compromised (which is what the parent comment was talking about, considering it mentioned CVEs) the attacker who now controls it can easily make connections to devices on your network via the router’s local address. As for how the router that is theoretically not accepting incoming connections from the internet itself gets compromised in the first place: among other issues some routers can be RCEd by a webpage visited by someone inside the LAN[1]. That’s just one example, you can find tons of these if you search for router vulnerabilities. In practice out of date routers end up in botnets frequently. It has nothing to do with network operators blocking SMB traffic; the attacker can communicate with the router via whatever C2 mechanism they put in the malware, which probably won’t even involve opening a port on the router. The SMB or what have you to the endpoint would be entirely within the LAN. [1]: https://www.malwarebytes.com/blog/news/2023/02/arris-vulnerability-found-in-commonly-used-router-could-result-in-complete-take-over https://www.malwarebytes.com/blog/news/2023/02/arris-vulnera...
- protocolture 1y ago>IoT security is generally terrible I think IoT demands a rethink of security. Like sometimes I want IoT devices to just bloody connect, and if I have to use a published exploit that circumvents online only requirements I will do it. But some people do genuinely have use cases for cloud speaking IoT stuff. Really I think the device should ask at first run, and then burn in your response and act only in the selected mode. If you want it to require Cloud MFA, thats an option, if you want to piss python at your lightbulb to make it blink, then thats where it lives permanently.
- ByteDrifter 1y agoMost people only care about how strong the signal is when buying a router, but almost no one checks if the firmware is outdated, or bothers to change the default password or disable remote access. And manufacturers rarely remind you either, so over time it just becomes a hidden risk.
- t-3 1y agoMost people don't buy routers, they get them from the ISP and never think about them again unless the wifi goes out, in which case they unplug and plug back in.
- johnisgood 1y agoExactly. This really is the reality of it.
- abustamam 1y agoYup, that's definitely me. After reading this I was like, oh shit, I better check for firmware updates for my ISPs router, but as it turns out, I have no idea how to, and there's no information online about how to do it.
- pabs3 1y agoA lot of them violate the GPL and BSD licenses too.
- fulafel 1y agoNitpick but "known CVEs" doesn't mean a vulnerable device. The majority of CVEs in your NAT box sw (aside: NAT is not routing) are going to be things like "insecure temp file handling". Your point of course stands, the situation is terrible.
- lazide 1y agoPersonally I treat any ISP provided (or big box store) router as compromised anyway. I install my own router as a replacement, or if not possible, just as the sole device downstream of it, and connect all my stuff to my own router. And I use Tailscale + other routing DNS servers, etc.
- lo0dot0 1y agoFritzbox brand and possibly others updates itself automatically by default. ISPs often also control the devices they ship to clients and install updates as part of a "fleet management".