7 ms·

> home routers get hacked and wiped in a mass attack against a country Who would want to do that, I wonder. I mean, it's not a one-click process, on that scale

> home routers get hacked and wiped in a mass attack against a country Who would want to do that, I wonder. I mean, it's not a one-click process, on that scale, diversity will be an important factor (FW and HW versions, manufacturers, OpenWRT and stuff). It seems to me that this would require a lot of effort and the result will be questionable. What will be achieved by this? I think if someone cares about security, they've already flashed DD-WRT by now and those who don't... well, router (in)security will not stop their systems from being overtaken.

watty 12y ago
Some people just want to watch the world burn. But you're right, it'd be an extremely difficult task on that kind of scale. It's like saying someone could just brick every PC in existing using some magical Windows 0-days.
- thisGuysAccount 12y ago
  yeah, they'd need something like a botnet spread out over multiple branches of the internet, to prevent backbone-level shutoffs of the attack, and a metasploit-like framework that could extend the attack vehicle as the number of known vulnerabilities grow leading up to the attack. ... I'm pretty sure the infrastructure exists for organized crime to do this, just going by what I've read in the news.
  - ezrathesleepy 12y ago
    I would not be surprised if the various cyber-warfare teams for government players have contingency plans in place for doing exactly what you describe. Except they might have more strategic plans in mind than merely bricking the owned devices. I wonder if there might already be sleeper code in place for this purpose? Botnet zombies seems to be the most obvious use-case, though. Or create your own TOR-type network to obscure the origin of criminal activity. With sufficient density of vulnerable devices, you could setup your own mesh network to send your nefarious packets through someone else's Internet gateway miles away.
kbenson 12y ago
A foreign power. A crippling of non-military communications and the work economy would be very useful in some wartime scenarios.
dmix 12y ago
> I think if someone cares about security, they've already flashed DD-WRT by now and those who don't... well, router (in)security will not stop their systems from being overtaken. Nonsense. a) People shouldn't have to flash their firmware to have an adequate level of security. If we're creating software we should hold some at least responsibility to provide basic security. Engineers in other fields take safety extremely seriously, why should software only provide it to a small percentage of people with technical knowledge? b) Using up-to-date operating systems with update processes and security-conscious decision-making when packaging 3rd-party software is not a huge cost to these companies. c) The goal of any security is to significantly increase costs and complexities of attacks. No solution will completely eliminate possibilities for attack but that doesn't negate need for security.
- gear54rus 12y ago
  > Nonsense. a) People shouldn't have to flash their firmware to have an adequate level of security. If we're creating software we should hold some at least responsibility to provide basic security. Engineers in other fields take safety extremely seriously, why should software only provide it to a small percentage of people with technical knowledge? I think you are comparing fundamentally different threat levels. Say you're designing a car. A cool, safe car in which passengers survive head-on collision with a wall at 100km/h with 100% chance. That's a nice car, but it can't save you if someone shoots you in the head with a 9mm through the windshield, unfortunately. You want that kind of protection? You go and buy special car with bulletproof glass and additional security measures. Your router may save you against someone typing 192.168.0.1 in browser and getting full rights without password. But it won't (and probably can't) save you from someone with enough tech knowledge and determination by default. > b) Using up-to-date operating systems with update processes and security-conscious decision-making when packaging 3rd-party software is not a huge cost to these companies. Well they won't want to spend it. People will buy them anyway like they do now.
  - Karunamon 12y ago
    I think the difference here is that your hypothetical gunman taking potshots at passing cars/routers (i.e. random hackers) is a lot more of a clear and present danger in the post-Snowden world than real gunmen in the real world. In other words, that armor glass should come standard, and there's no excuse for it not to. Microsoft learned this lesson - you either design for security up front or you design for security after the fact, the hard way, breaking things as you go and annoying users.
MichaelGG 12y ago
>Who would want to do that, I wonder. I think it'd be fun, so that's one reason a lot of people may share. And, it's not hard to see it as a good thing: By bricking these routers, you're bringing light to a serious issue, before it gets even more serious (more reliance on the Internet).
diminoten 12y ago
Fortunately for us, the folks who would want to do that (hacktivists) lack the skills necessary to execute. The threat here would come in the form of an opposing nation-state, and from their perspective you're right -- there's not a lot of incentive to actually perform this attack.

watty 12y ago

Some people just want to watch the world burn. But you're right, it'd be an extremely difficult task on that kind of scale. It's like saying someone could just brick every PC in existing using some magical Windows 0-days.

thisGuysAccount 12y ago
yeah, they'd need something like a botnet spread out over multiple branches of the internet, to prevent backbone-level shutoffs of the attack, and a metasploit-like framework that could extend the attack vehicle as the number of known vulnerabilities grow leading up to the attack. ... I'm pretty sure the infrastructure exists for organized crime to do this, just going by what I've read in the news.
- ezrathesleepy 12y ago
  I would not be surprised if the various cyber-warfare teams for government players have contingency plans in place for doing exactly what you describe. Except they might have more strategic plans in mind than merely bricking the owned devices. I wonder if there might already be sleeper code in place for this purpose? Botnet zombies seems to be the most obvious use-case, though. Or create your own TOR-type network to obscure the origin of criminal activity. With sufficient density of vulnerable devices, you could setup your own mesh network to send your nefarious packets through someone else's Internet gateway miles away.

kbenson 12y ago

A foreign power. A crippling of non-military communications and the work economy would be very useful in some wartime scenarios.

dmix 12y ago

> I think if someone cares about security, they've already flashed DD-WRT by now and those who don't... well, router (in)security will not stop their systems from being overtaken. Nonsense. a) People shouldn't have to flash their firmware to have an adequate level of security. If we're creating software we should hold some at least responsibility to provide basic security. Engineers in other fields take safety extremely seriously, why should software only provide it to a small percentage of people with technical knowledge? b) Using up-to-date operating systems with update processes and security-conscious decision-making when packaging 3rd-party software is not a huge cost to these companies. c) The goal of any security is to significantly increase costs and complexities of attacks. No solution will completely eliminate possibilities for attack but that doesn't negate need for security.

gear54rus 12y ago
> Nonsense. a) People shouldn't have to flash their firmware to have an adequate level of security. If we're creating software we should hold some at least responsibility to provide basic security. Engineers in other fields take safety extremely seriously, why should software only provide it to a small percentage of people with technical knowledge? I think you are comparing fundamentally different threat levels. Say you're designing a car. A cool, safe car in which passengers survive head-on collision with a wall at 100km/h with 100% chance. That's a nice car, but it can't save you if someone shoots you in the head with a 9mm through the windshield, unfortunately. You want that kind of protection? You go and buy special car with bulletproof glass and additional security measures. Your router may save you against someone typing 192.168.0.1 in browser and getting full rights without password. But it won't (and probably can't) save you from someone with enough tech knowledge and determination by default. > b) Using up-to-date operating systems with update processes and security-conscious decision-making when packaging 3rd-party software is not a huge cost to these companies. Well they won't want to spend it. People will buy them anyway like they do now.
- Karunamon 12y ago
  I think the difference here is that your hypothetical gunman taking potshots at passing cars/routers (i.e. random hackers) is a lot more of a clear and present danger in the post-Snowden world than real gunmen in the real world. In other words, that armor glass should come standard, and there's no excuse for it not to. Microsoft learned this lesson - you either design for security up front or you design for security after the fact, the hard way, breaking things as you go and annoying users.

MichaelGG 12y ago

>Who would want to do that, I wonder. I think it'd be fun, so that's one reason a lot of people may share. And, it's not hard to see it as a good thing: By bricking these routers, you're bringing light to a serious issue, before it gets even more serious (more reliance on the Internet).

diminoten 12y ago

Fortunately for us, the folks who would want to do that (hacktivists) lack the skills necessary to execute. The threat here would come in the form of an opposing nation-state, and from their perspective you're right -- there's not a lot of incentive to actually perform this attack.