9 ms·
Asusgate: A story about thousands of crimeless victims
- baldfat 13y agoI love my RT-AC router and I do not use Ai Cloud and I have FTP turned off. I check all the time. People that buy $200+ routers should be the ones to turn things off. My name wasn't on the list.
- pixl97 13y ago>People that buy $200+ routers should be the ones to turn things off. The price of an object says nothing about the cluefullness or cluelessness of the end user. A tech illiterate soccer mom could easily buy one of these because their child told them they need 'extreme performance' to play BF4. Releasing products with poor security, then not fixing it when released to the public is unacceptable in this day and age.
- baldfat 13y agoKey word is "Should"
- vacri 13y agoA tech naif that doesn't know how to turn off a service is certainly not going to be reflashing a wifi AP.
- pixl97 13y agoThat's why you don't release terrible security flaws in the first place. The second problem of the illiterate flashing ones router is more difficult, but not completely impossible to deal with. It's not optimal, but you could force redirect all http connections to the router from inside the network to a page where the user has to log in and click flash for the router to download and update the flash itself. Auto-updates are possible, but not without risk either.
- joseflavio 13y agoChuck Palahniuk?
- bitwize 13y agoDuke Igthorn?!? Calling yourself the Dread Pirate Roberts I can understand, but a Gummi Bears villain?
- at-fates-hands 13y agoHackers these days pick some interesting names. Just like "pinkie pie" who hacked Chrome with three zero-day exploits back in 2012: http://www.wired.com/threatlevel/2012/03/zero-days-for-chrome/ http://www.wired.com/threatlevel/2012/03/zero-days-for-chrom...
- thekaleb 13y agoI was wondering the same thing. His website[1] and the Wikipedia article[2] about him don not mention anything about his interest in network security. But he does seem to closely guard his personal life. [1]: http://chuckpalahniuk.net/ http://chuckpalahniuk.net/ [2]: https://en.wikipedia.org/wiki/Chuck_Palahniuk https://en.wikipedia.org/wiki/Chuck_Palahniuk
- eli 13y agoThat's not very nice. They won't remain crimeless for long.
- trynumber9 13y agoAsusgate? How about 'Asus RT-series router vulnerabilities'? Asusgate is a less informative headline .
- smsm42 13y agoEverything is gate nowdays. I hope some politician would mess up something with some gate somewhere, and we'd have a Gategate.
- deleted 13y ago[deleted]
- sliverstorm 13y agoThen we'll uncover a coverup relating to gategate, and we'll have gategate-gate.
- CrazedGeek 13y agoBelieve it or not, basically exactly that happened. http://en.wikipedia.org/wiki/Plebgate http://en.wikipedia.org/wiki/Plebgate
- smsm42 13y agoI should have searched. Fascinating story, thanks.
- BerislavLopac 13y agoAnd if a bunch of politicians mess up with some bills (which they do all the time), that would collectively be called BillGates... :-P
- andybak 13y agoI give you Watergategate: http://www.youtube.com/watch?v=vB9JgxhXW5w http://www.youtube.com/watch?v=vB9JgxhXW5w
- anon4 13y agoLook on the bright side. It's a router made by Asus that has its gates wide open. It could have been Asusgateisopengate.
- ohfunkyeah 13y agoI am rather bored by the specifics of Asusgate, but I do think the story has one very interesting conundrum. If change has to be driven by impassioned masses. And the masses only become impassioned when directly affected. Does it become OK for the good guys to accelerate exposure of the masses to the risks in order to prevent harm happening at a larger scale in the future?
- emhart 13y agoThat is a question researchers have been asking for decades. Rain Forest Puppy, with the help of some smart, invested colleagues, put together a good framework for Full Disclosure a long time ago: http://dl.packetstormsecurity.net/papers/general/rfpolicy-2.0.txt http://dl.packetstormsecurity.net/papers/general/rfpolicy-2.... When I first found myself involved in disclosures in the mechanical security world, I turned to that document to orient myself, though mechanical security has some different challenges that make following that framework perfectly fairly hard.
- Symmetry 13y agoI'm glad I took this[1] advice and installed the Tomato firmware on my router. [1]http://www.codinghorror.com/blog/2012/06/because-everyone-still-needs-a-router.html http://www.codinghorror.com/blog/2012/06/because-everyone-st...
- BigTuna 13y ago"We are sorry for exposing innocents in this manner." Quit lying you pricks.
- r00fus 13y agoMy RT-AC66u died a month ago (trying to factory reset, and it never woke up), and I just plugged my 5-year old Apple Wifi-N router and never looked back. Looks like there isn't really a good AC router - most AC routers have poor reliability reviews everywhere (even the new Apple one).
- jethro_tell 13y agoThat's usually because the spec wasn't finished at release time so your card might be following one set of rule and your WAP another. I'm always leary about a company who wants to be first to market before everyone has agreed on how things should work. You can see that pattern in their security audit too. EDIT: Asus' security audit, The apple one should work if you don't leave their eco system since the card and WAP probably have the same specs.
- nothxbro 13y agoThis was patched 6 months ago, what is the author going on about? http://reviews.cnet.com/8301-3132_7-57594003-98/asus-patches-its-wi-fi-routers-aicloud-vulnerabilities/ http://reviews.cnet.com/8301-3132_7-57594003-98/asus-patches...
- mattgreenrocks 13y agoAnother failing in consumer-grade routers. It's depressing how bad many consumer-targeted products there are in the tech space. Printers (seriously, why do we still have printer drivers), routers, operating systems, even software. Even non-techie users take notice of this! Is there space for a competitively priced consumer router of high quality?
- zokier 13y agoTP-links have been long-standing favorites of hacker community. They might not be the highest specced and you need to be careful about which model you pick, but there are some good (value) devices there. Of course assuming you are going to run OpenWRT or something equivalent. Running some OEM crap on routers is just madness.
- pera 13y agoYes! TP-Link is awesome :D TL-MR3020+OpenWRT = <333
- snuxoll 13y agoBuffalo makes some great hardware with DD-WRT preinstalled at a reasonable price ($50-90 depending on what you want).
- malandrew 13y agoI would definitely fund a kickstarter campaign for a fully open-source AC router designed for OpenWRT. I would imagine that the OpenWRT community (and related open-source firmwares like Tomato and DD-WRT) are sufficiently large enough that there is a market for a piece of hardware that is optimal for open-source router firmware.
- SwellJoe 13y agoFor quite a long time, there was a Linksys WRT model that remained in production long after its useful life (because it had old radio standards and was slow and because newer devices were much cheaper with greater capabilities) because it ran Linux, and could be hacked very easily and could use all Open Source drivers and such. It's even where "OpenWRT" got the WRT in its name. So, there's definitely a market for it. But, I don't know that it's comparable to the market for consumer oriented devices. It'd be nice if consumers were smarter and knew enough to demand this kind of thing. It'd be really nice if one could go to the store and buy a router running OpenWRT or Tomato or whatever, like you can go to the store and ask for an Android phone or a Windows PC. As operating systems go, many current routers are probably more complex than DOS or early Windows versions and certainly more complex than many early phone operating systems. Not sure why nobody has thought to make the OS a competitive factor for routers.
- pcunite 13y agoIf you are serious about your SOHO router, I suggest you use a MikroTik.
- da_maire 13y agoIf you're serious about your equipment, avoid MikroTik.
- thelambentonion 13y agoI would personally recommend Ubiquiti or some ALIX-based pfSense router over MikroTik. They seem like a better value for the money to me.
- jlgaddis 13y agoOnly if it has OpenWRT installed.
- freiheit 13y agoBruce Schneier did an interesting writeup about a month ago about the fundamental problems behind router (and other embedded device) security: > The problem with this process is that no one entity has any incentive, expertise, or even ability to patch the software once it's shipped. https://www.schneier.com/blog/archives/2014/01/security_risks_9.html https://www.schneier.com/blog/archives/2014/01/security_risk...
- xorbyte 13y agoSimilarly echoed in the OpenWRT talk from 30C3 https://www.youtube.com/watch?v=Y-OlUxeS57E https://www.youtube.com/watch?v=Y-OlUxeS57E
- malandrew 13y agoTBH the only moderately safe way forward is open source firmware that is autoupdated via signed packages made by individuals with impeccable reputations and verified/audited by others with impeccable reputations.
- ARothfusz 13y agoSomeone needs to make a Rocket Surgeon t-shirt.
- avtar 13y agoI came here to comment about that but it looks like you have everything under control.
- dredmorbius 13y agoCafePress. I mean, it's not exactly rocket surgery
- loginwhence 13y agoDoes anyone have a non-torrent link to this?
- hrkristian 13y agohttps://dl.dropboxusercontent.com/u/30902737/ASUSGATE.A.STORY.ABOUT.THOUSANDS.OF.CRIMELESS.VICTIMS.rar https://dl.dropboxusercontent.com/u/30902737/ASUSGATE.A.STOR...
- loginwhence 13y agoThank you!
- simon_vetter 13y agoOpenWRT or other OpenWRT-based firmwares are really easy to get up and running these days. Trusting consumer electronics manufacturers running on razon-thin margins for your security is pure madness, not advisable at best.
- mcfly69 13y agodownload-link?