6 ms·

Read the actual rule here: https://apps.fcc.gov/kdb/GetAttachment.html?id=1UiSJRK869RsyQddPi5hpw%3D%3D&desc=594280%20D02%20U-NII%20Device%20Security%20v01r02&tr

Read the actual rule here: https://apps.fcc.gov/kdb/GetAttachment.html?id=1UiSJRK869RsyQddPi5hpw%3D%3D&desc=594280%20D02%20U-NII%20Device%20Security%20v01r02&tracking_number=39498 https://apps.fcc.gov/kdb/GetAttachment.html?id=1UiSJRK869Rsy... Look at item #2 under "Third-Party Access Control" which states a home router manufacturer must answer this question: "What prevents third parties from loading non-US versions of the software/firmware on the device? Describe in detail how the device is protected from “flashing” and the installation of third-party firmware such as DD-WRT." What they're doing is requiring home router manufacturers to claim their device cannot be flashed to gain FCC approval. Theoretically, the FCC could penalize router manufacturers that allow their routers to be flashed. These manufacturers would then no longer be allowed to sell their devices in the USA.

ac29 11y ago
The word "home" does not appear anywhere in that document. I assume this document applies to all WiFi routers sold in the United States capable of U-NII frequency use.
- AndyMcConachie 11y ago
  You're correct. I used the word "home" because that's typically where these devices are used and the market that will be most effected. The FCC makes no distinction between devices meant for home use vs. other markets.
x5n1 11y ago
So the FCC is very interested in reducing the security of routers and getting all users of routers hacked. Good job FCC, you are the best. I guess they are concerned about the router firmware letting you configure routers in such a way as to cause interference. The proper way to address that is to inform the makers of router firmware and force them to comply, I am sure the US government is more than capable of doing that, even if the FCC is not.
- GigabyteCoin 11y ago
  I can think of another three letter agency that might very well have suggested this new "security measure" be implemented. /tinfoilhat
  - plaguuuuuu 11y ago
    To be fair, you're talking about an agency that provably intercepted deliveries of Cisco hardware and installed backdoors in them. I don't think it's particularly far fetched.
    - JoshTriplett 11y ago
      > To be fair, you're talking about an agency that provably intercepted deliveries of Cisco hardware and installed backdoors in them. I'm unsurprised, but do you have a link for that? I'd like to read more about it.
      - GigabyteCoin 11y ago
        http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-...
      - MichaelApproved 11y ago
        http://www.engadget.com/2014/05/16/nsa-bugged-cisco-routers/ http://www.engadget.com/2014/05/16/nsa-bugged-cisco-routers/ More here https://www.google.com/search?q=intercept+cisco+routers&ie=utf-8&oe=utf-8 https://www.google.com/search?q=intercept+cisco+routers&ie=u...
      - abrichr 11y ago
        HN submission from 440 days ago: https://news.ycombinator.com/item?id=7737648 https://news.ycombinator.com/item?id=7737648
ajross 11y ago
Unbelievable that it actually calls out community firmware as a threat, and DD-WRT by name. There has to be a story behind the genesis of this rule. I mean, these ROMs have been around for well over a decade now with no ill effects I'm aware of. That's not something that the FCC is going to be inclined to spontaneously regulate if someone weren't pushing for it. So who pushed?
- sliverstorm 11y ago
  Does that really say DD-WRT in particular is a threat? I take it simply as saying DD-WRT is the poster child. While I like DD-WRT, if you can flash DD-WRT you can flash anything, and arbitrary code breaks all possible chain-of-trust models. The FCC has a long history of moving for more restricted hardware as a way of regulating the airwaves, one of its chief jobs. As a ham & commercial radio operator it drives me up the wall, but I understand why they do it.
  - rando3826 11y ago
    > arbitrary code breaks all possible chain-of-trust models No. The code I get on my router from the store is an arbitrary closed source buggy crap. The code I load from debian, openwrt, etc. is far more trusted.
    - sliverstorm 11y ago
      I hate HN's tendency to be perfectly intelligent and rational most of the time, yet become infuriatingly obtuse and cultish any time we brush near ideology. Obviously the FCC does not care about who you trust.
      - esaym 11y ago
        I trust GPL code only.
      - makomk 11y ago
        The code that ships in consumer routers is really awful security-wise compared to something like OpenWRT, though, and that's not ideology - it's the commercial reality of the consumer router market. Security costs money and it's not visible to the consumers buying the routers, so the manufacturers don't bother.
Spivak 11y ago
Is there any actual merit to "impossible to flash" when you can open up the box and start replacing parts?
- sounds 11y ago
  Yes. Signed bootloader loading signed kernel, etc.
- vidarh 11y ago
  How large a proportion of people are able to de-solder surface mounted components and replace them? I'm not asking how many can learn to do so and get the equipment, but how many who knows how to do it and have the equipment. No policies like this are made with the expectation they'll stop everyone. They just want to raise the barrier sufficiently.
  - dogma1138 11y ago
    If you open most SOHO routers today (mid-to high end ones) the baseband processor and the RF stuff will be on a daughter board, in many cases it will be the same or very similar mini-PCIE cards that you find in most laptops.
    - vidarh 11y ago
      > the baseband processor and the RF stuff will be on a daughter board Which doesn't help you all that much in replacing the firmware.
CamperBob2 11y ago
Keep in mind, these are the same idiots at the FCC who (forcibly) gave us the RP-SMA connector, on the grounds that if the user can't buy a compatible connector at Radio Shack, they won't be able to install a better antenna. It's the bureaucratic equivalent of Apple's habit of inventing new proprietary Torx screws, which keep users out of their gadgets for the 2-3 weeks it takes the Chinese to come up with new screwdrivers.
- givinguflac 11y ago
  Have you ever actually done extensive repair of mobile devices? I'm actually glad they changed the screws; Phillips screws that small strip pretty easily and then you're actually locked out of the device. the newer style screw allows for more torque and lower chance of stripping by far.
  - CamperBob2 11y ago
    Nothing wrong with Torx screws. I'm talking about "security features" added to them at various times by various vendors (Apple's not the only guilty party) that serve no purpose but to keep owners, hobbyists, and independent repair shops out of their devices.
whoopdedo 11y ago
The part that worries me is: > To whom is the UI accessible? (Professional installer, end user, other.) What professional installer? Consumer routers are all set up so the user configures it. Making the distinction between the end user and the installer sounds like the way DOCSIS locks the firmware of cable modems so the network operator has complete control over it. I also wonder if this is the part of the FCC's plan to put data in the white space of other bands. The argument has always been that it's too difficult to coordinate all the different radios to prevent one accidentally transmitting where it isn't supposed to. But sending out frequency maps is easier when you can limit the number of different radios to just a few authorized vendors.

ac29 11y ago

The word "home" does not appear anywhere in that document. I assume this document applies to all WiFi routers sold in the United States capable of U-NII frequency use.

AndyMcConachie 11y ago
You're correct. I used the word "home" because that's typically where these devices are used and the market that will be most effected. The FCC makes no distinction between devices meant for home use vs. other markets.

x5n1 11y ago

So the FCC is very interested in reducing the security of routers and getting all users of routers hacked. Good job FCC, you are the best. I guess they are concerned about the router firmware letting you configure routers in such a way as to cause interference. The proper way to address that is to inform the makers of router firmware and force them to comply, I am sure the US government is more than capable of doing that, even if the FCC is not.

GigabyteCoin 11y ago
I can think of another three letter agency that might very well have suggested this new "security measure" be implemented. /tinfoilhat
- plaguuuuuu 11y ago
  To be fair, you're talking about an agency that provably intercepted deliveries of Cisco hardware and installed backdoors in them. I don't think it's particularly far fetched.
  - JoshTriplett 11y ago
    > To be fair, you're talking about an agency that provably intercepted deliveries of Cisco hardware and installed backdoors in them. I'm unsurprised, but do you have a link for that? I'd like to read more about it.
    - GigabyteCoin 11y ago
      http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-...
    - MichaelApproved 11y ago
      http://www.engadget.com/2014/05/16/nsa-bugged-cisco-routers/ http://www.engadget.com/2014/05/16/nsa-bugged-cisco-routers/ More here https://www.google.com/search?q=intercept+cisco+routers&ie=utf-8&oe=utf-8 https://www.google.com/search?q=intercept+cisco+routers&ie=u...
    - abrichr 11y ago
      HN submission from 440 days ago: https://news.ycombinator.com/item?id=7737648 https://news.ycombinator.com/item?id=7737648

ajross 11y ago

Unbelievable that it actually calls out community firmware as a threat, and DD-WRT by name. There has to be a story behind the genesis of this rule. I mean, these ROMs have been around for well over a decade now with no ill effects I'm aware of. That's not something that the FCC is going to be inclined to spontaneously regulate if someone weren't pushing for it. So who pushed?

sliverstorm 11y ago
Does that really say DD-WRT in particular is a threat? I take it simply as saying DD-WRT is the poster child. While I like DD-WRT, if you can flash DD-WRT you can flash anything, and arbitrary code breaks all possible chain-of-trust models. The FCC has a long history of moving for more restricted hardware as a way of regulating the airwaves, one of its chief jobs. As a ham & commercial radio operator it drives me up the wall, but I understand why they do it.
- rando3826 11y ago
  > arbitrary code breaks all possible chain-of-trust models No. The code I get on my router from the store is an arbitrary closed source buggy crap. The code I load from debian, openwrt, etc. is far more trusted.
  - sliverstorm 11y ago
    I hate HN's tendency to be perfectly intelligent and rational most of the time, yet become infuriatingly obtuse and cultish any time we brush near ideology. Obviously the FCC does not care about who you trust.
    - esaym 11y ago
      I trust GPL code only.
    - makomk 11y ago
      The code that ships in consumer routers is really awful security-wise compared to something like OpenWRT, though, and that's not ideology - it's the commercial reality of the consumer router market. Security costs money and it's not visible to the consumers buying the routers, so the manufacturers don't bother.

Spivak 11y ago

Is there any actual merit to "impossible to flash" when you can open up the box and start replacing parts?

sounds 11y ago
Yes. Signed bootloader loading signed kernel, etc.
vidarh 11y ago
How large a proportion of people are able to de-solder surface mounted components and replace them? I'm not asking how many can learn to do so and get the equipment, but how many who knows how to do it and have the equipment. No policies like this are made with the expectation they'll stop everyone. They just want to raise the barrier sufficiently.
- dogma1138 11y ago
  If you open most SOHO routers today (mid-to high end ones) the baseband processor and the RF stuff will be on a daughter board, in many cases it will be the same or very similar mini-PCIE cards that you find in most laptops.
  - vidarh 11y ago
    > the baseband processor and the RF stuff will be on a daughter board Which doesn't help you all that much in replacing the firmware.

CamperBob2 11y ago

Keep in mind, these are the same idiots at the FCC who (forcibly) gave us the RP-SMA connector, on the grounds that if the user can't buy a compatible connector at Radio Shack, they won't be able to install a better antenna. It's the bureaucratic equivalent of Apple's habit of inventing new proprietary Torx screws, which keep users out of their gadgets for the 2-3 weeks it takes the Chinese to come up with new screwdrivers.

givinguflac 11y ago
Have you ever actually done extensive repair of mobile devices? I'm actually glad they changed the screws; Phillips screws that small strip pretty easily and then you're actually locked out of the device. the newer style screw allows for more torque and lower chance of stripping by far.
- CamperBob2 11y ago
  Nothing wrong with Torx screws. I'm talking about "security features" added to them at various times by various vendors (Apple's not the only guilty party) that serve no purpose but to keep owners, hobbyists, and independent repair shops out of their devices.

whoopdedo 11y ago

The part that worries me is: > To whom is the UI accessible? (Professional installer, end user, other.) What professional installer? Consumer routers are all set up so the user configures it. Making the distinction between the end user and the installer sounds like the way DOCSIS locks the firmware of cable modems so the network operator has complete control over it. I also wonder if this is the part of the FCC's plan to put data in the white space of other bands. The argument has always been that it's too difficult to coordinate all the different radios to prevent one accidentally transmitting where it isn't supposed to. But sending out frequency maps is easier when you can limit the number of different radios to just a few authorized vendors.