The verbosity of this vs. actual information makes my flag-finger itch. It also, apparently, keeps getting killer on /r/netsec[1]. <TLDR>"The affected software

The verbosity of this vs. actual information makes my flag-finger itch. It also, apparently, keeps getting killer on /r/netsec[1]. <TLDR>"The affected software is the embedded web server RomPager from AllegroSoft." "AllegroSoft issued a fixed version to address the Misfortune Cookie vulnerability in 2005 [...]" but it's complicated. TR-069 is mentioned because it makes it sound cooler, and also uses the RomPager in certain implementations.</TLDR> Yeah, Home Gateway security is almost as nonexistent as their release/update cycle. TR-069 is a blasphemy and an anathema in the first place[2]. This is an attempt to 'heartbleed'-ize a much broader issue. It is one of many, and they are known, and they never get patched. Maybe make this into a crowd-type-movement to take back our routers, intending to put pressure on manufacturers to be more responsible with security and the intermediates for pushing the updates (since they've provided themselves the functionality to do that/TR-069/The Irony), but do not try to heartbleed-ize it, kinda comes off cheap. In the meantime, for those that can (Hello Friends!), we already know the available patches: * OpenWRT * DD-WRT * Tomato It's tricky though, because you may have to spend $20/$60 for a new router. EDIT: Also, dupe. https://news.ycombinator.com/item?id=8767193 https://news.ycombinator.com/item?id=8767193 Hrm. [1] https://www.reddit.com/r/netsec/comments/2poyp6/misfortune_cookie_cve20149222_12_million_routers/ https://www.reddit.com/r/netsec/comments/2poyp6/misfortune_c... https://www.reddit.com/r/netsec/comments/2polm6/the_misfortune_cookie_vulnerability/ https://www.reddit.com/r/netsec/comments/2polm6/the_misfortu... [2] "So my ISP can just flash my router with a new firmware, remotely, and then flash back the original, at any time? Or anyone with my ISP's private keys/credentials* , for that matter, but let's not open that can of worms. And you say that, despite this being active (and sometimes partly hidden and un-killable cough BTHomeHub cough) our routers are still running archaic software that hasn't received a 9-year-old patch? Then... ugh.. what is this used for, exactly? Why is it there?" * Oh God I hope it is at least private keys and not 'admin:P@ssword1' :S