5 ms·

fun fact, part of the reason this botnet exists is because europe required the ability to install security updates unattended that you cannot disable and they c

fun fact, part of the reason this botnet exists is because europe required the ability to install security updates unattended that you cannot disable and they compromised one of the servers that had the capability to push these updates compromising hundreds of thousands of routers.

Razengan 11mo ago
Wait when was this?? Did it fly under the news??
- kachapopopow 11mo ago
  it's one of the (i believe) hundreds (at this point) of zero-days that is used to build this botnet, at this point they are using funds that they get from selling this botnet to purchase new zero days
cyberpunk 11mo ago
That's really impressive finger pointing. If the vendor can't even secure their update server; how long do you think it would be until some RCE on these 100k un-patchable routers gets exploited? The only people to blame for this is the vendor, and they failed on multiple levels here. It's not hard to sign a firmware, or even just fetch checksums from a different site than you serve the files from...
- kachapopopow 11mo ago
  the problem is that these laws just make the problem bigger - instead of having to compromise 100 thousand routers they can just compromise a single update server from a vendor that doesn't care about security. the fallout is some companies losing their revenue: https://status.neoprotect.net/ https://status.neoprotect.net/ and other headaches for people all over the world
  - mmooss 11mo ago
    Or the law makes the problem smaller, by making the routers secure, and makes outcomes just, by penalizing the responsible companies.
    - kachapopopow 11mo ago
      ok, let's redo this: instead of routers it's an IoT device. The router protects the IoT device from direct access so it is secure from majority of attack vectors - now an IoT device provider gets their server compromised and hundreds of thousands of IoT devices are now bots in a botnet due to the ability to forcefully push a security update.
      - mmooss 11mo ago
        I understand the risk, but the existance of risks doesn't mean they outweigh the benefits. Everything has risks.
        kachapopopow 11mo ago
        I don't think it does outweigh the benefits, the real benefits would be punishing or/and banning vendors that do not secure their devices since using laws such as "timely updates" just promotes them to include sloppy (insecure) implementations for pushing said updates just to do bare minimum to comply with the law. relevant law here: EU Cyber Resilience Act (CRA).
        mmooss 11mo ago
        > I don't think it does outweigh the benefits Fine, but that is the real discussion to have. Not 'it has this risk and therefore is bad'. > banning vendors that do not secure their devices I think the goal is to encourage positive behavior, not try to monitor everyone and evaluate their updates. > promotes them to include sloppy (insecure) implementations for pushing said updates just to do bare minimum to comply with the law I imagine the law is more than just one clause ?
alphager 11mo ago
That's just not true. I'm in Europe and all of my routers allow me to disable unattended updates and most don't enable it by default.
- kachapopopow 11mo ago
  might be too old, my asus router updated and I could no longer disable updates and you could just look up the relevant law here: EU Cyber Resilience Act (CRA) 2024. While it doesn't make it mandatory, it does require patching devices in a timely fasion which in other terms: requires forced updates - pushing updated firmware is not enough if you read between the lines. Even stronger requirements come into effect at the end of 2027.

Razengan 11mo ago

Wait when was this?? Did it fly under the news??

kachapopopow 11mo ago
it's one of the (i believe) hundreds (at this point) of zero-days that is used to build this botnet, at this point they are using funds that they get from selling this botnet to purchase new zero days

cyberpunk 11mo ago

That's really impressive finger pointing. If the vendor can't even secure their update server; how long do you think it would be until some RCE on these 100k un-patchable routers gets exploited? The only people to blame for this is the vendor, and they failed on multiple levels here. It's not hard to sign a firmware, or even just fetch checksums from a different site than you serve the files from...

kachapopopow 11mo ago
the problem is that these laws just make the problem bigger - instead of having to compromise 100 thousand routers they can just compromise a single update server from a vendor that doesn't care about security. the fallout is some companies losing their revenue: https://status.neoprotect.net/ https://status.neoprotect.net/ and other headaches for people all over the world
- mmooss 11mo ago
  Or the law makes the problem smaller, by making the routers secure, and makes outcomes just, by penalizing the responsible companies.
  - kachapopopow 11mo ago
    ok, let's redo this: instead of routers it's an IoT device. The router protects the IoT device from direct access so it is secure from majority of attack vectors - now an IoT device provider gets their server compromised and hundreds of thousands of IoT devices are now bots in a botnet due to the ability to forcefully push a security update.
    - mmooss 11mo ago
      I understand the risk, but the existance of risks doesn't mean they outweigh the benefits. Everything has risks.
      - kachapopopow 11mo ago
        I don't think it does outweigh the benefits, the real benefits would be punishing or/and banning vendors that do not secure their devices since using laws such as "timely updates" just promotes them to include sloppy (insecure) implementations for pushing said updates just to do bare minimum to comply with the law. relevant law here: EU Cyber Resilience Act (CRA).
        mmooss 11mo ago
        > I don't think it does outweigh the benefits Fine, but that is the real discussion to have. Not 'it has this risk and therefore is bad'. > banning vendors that do not secure their devices I think the goal is to encourage positive behavior, not try to monitor everyone and evaluate their updates. > promotes them to include sloppy (insecure) implementations for pushing said updates just to do bare minimum to comply with the law I imagine the law is more than just one clause ?

alphager 11mo ago

That's just not true. I'm in Europe and all of my routers allow me to disable unattended updates and most don't enable it by default.

kachapopopow 11mo ago
might be too old, my asus router updated and I could no longer disable updates and you could just look up the relevant law here: EU Cyber Resilience Act (CRA) 2024. While it doesn't make it mandatory, it does require patching devices in a timely fasion which in other terms: requires forced updates - pushing updated firmware is not enough if you read between the lines. Even stronger requirements come into effect at the end of 2027.