Schneier on Security

Clive Robinson • March 14, 2025 10:59 AM

@ Bruce, ALL,

As noted in the article,

“Regularly patching your router and making sure the firmware is up-to-date will keep your device as secure as possible which is important as routers are often one of the most frequently hacked technologies in the home.“

The other most frequently hacked technology is “CCTV cameras”.

The reason these are targeted is three fold,

1, They have a high bandwidth.
2, They are “always on”.
3, They are in effect infrastructure not user devices.

So these devices are almost ideal for anyone who can get “past the front door”.

But there is another issue,

4, Untill recently the devices had no patches or updates.

That is they were designed, built, manufactured, and sold “warts and all”. Importantly with no patching or security updates considered as part of the design as “on going support” was not a consideration.

There are multiple issues with,

“On-line patching and updating.”

Not least is that increases both complexity and vulnerability, as well as decreasing software quality.

But it also creates a quite vulnerable “supply chain” even when done to “best practice” standards.

The simple fact is the industry management has created these sorts of vulnerabilities,

“As standard practice ”

And actually do not want to fix them unless forced to do so.

Worse they mostly don’t take sufficient care any more due to the “we can patch it tomorrow” mentality, that actually encourages products to be shipped with known vulnerabilities in them.

Whilst their are a limited number of mitigations they mostly have down sides.

Such as the mitigation strategy of “segregation”, which would keep the devices “safely isolated” is quite deliberately prevented for profit reasons (something pushed by Amazon if not deliberately encouraged by them.) And in many cases the devices will not function at all let alone in reduced capacity if “securely segregated”.

I suspect not even draconian legislation will fix these issues, suggesting we has a problem that is not easily going to be resolved even in part…

Clive Robinson • March 16, 2025 7:25 AM

@ Someguy,

With regards,

“Now I agree that auto-update can introduce a different kind of vulnerability, but it’s a less worse option than the general alternative of never updating. Most people don’t know how to log into their router, let alone update it regularly manually.”

To address those two points in reverse.

Firstly by far the majority of people do not own “their router”. Nor is “their router” configured in a way that would easily allow them to address your first point. Worse often “their router” is configured in a way that makes it way more vulnerable than it could be. And if they were to change the configuration of “their router” they get into a whole world of trouble.

The reason for this is “their router” is put in by the “Service Provider” and they set it up for “minimum cost” to themselves.

@ Bob, ALL,

“Is aftermarket firmware an option? I kept a router running on (I believe) updated DD-WRT well past its prime back in the day.”

The “Open Source” upgrades were going great untill the FCC got on it’s “high horse” and made hardware manufacturers “lock down firmware” so users could not upgrade to “Open Source”…

Like many things in the ICT/Sec industry this sort of thing gets “lost from memory” so fast you would think the whole industry had terminal dementia.

The reason…

Nearly all routers have “WiFi” or similar and have done since RC4 was the “Industry Expert Organisation” designated encryption to give “Wired Equivalent Privacy” (another thing that has been “lost from memory”)…

Thus all routers very quickly used “standard chip sets”, which was a little problematic for “inventory” reasons. Because “The World” is split up into different “radio frequency allocation” regions by the UN “International Telecommunications Union”(ITU). This ment that the “Industrial Scientific and Medical”(ISM) frequency bands were different in different ITU regions. The major users of Wifi were the US and EU at the time and they had quite different ISM frequency allocations that lacked a lot of “commonality”. Oh and the rapidly rising “Asian Market” was on it’s way to surpassing both the US and EU and guess what? Yup yet another ITU Region…

What happened was a typical multi-step Supply Chain boondoggle that always happens with “trade embargo” tactics are employed by politicians to “protect home markets”… Everyone along it turns it into a “hot potato” game and passes the problem along the supply chain as “Somebody Elses Problem” aptly named by Douglas Addams –who would have been 73 a couple of days ago had he lived– along with “Bistro Mathematics” and a couple of other terms that describe “political stupidity”.

So what happened was “textbook” of what has been happening since the end of WWII, and making everyone’s life difficult, and way beyond reasonable.

So the chip makers to cut their manufacturing and inventory costs significantly made chip sets that covered all ITU Regions. Thus passed the problem down to the end user market manufacturers… Who to cut their licencing and inventory costs significantly, put “in the firmware” only the “subset” of common frequencies for users to be able to select.

This created an “artificial resource limitation” on the users as you would expect… Thus WiFi was failing to significant usage congestion and instead of 300m range uncontested you’ld be lucky to get even 10m in many homes, offices etc.

Now “Open Source” removed that “artificial resource limitation” from more capable “users”. So they went for it like “rabid piranhas”. Many of whom put their WiFi systems “Out of Band” for the region they were in…

The FCC to keep their costs down, basically wanted the problem to just “go away” so went with the SEP option. So threatened the end user market manufacturers with “action” like “licence forfeiture”, “customs embargoes”, “significant fines” and other “unspecified actions”…

The problem was they could not push any of this onto “Open Source” because “Open Source” is covered by “The First Amendment”…

Thus although the FCC did not say so directly they indicated a “full lockdown” on “Firmware” was an acceptable compliance route…

As that was the least expensive route for manufacturers guess what they did…

So ever since untill fairly recently most router manufactures went down the “make it bot an option for users” path and ISP’s as it cuts their costs and risks have gone along with it…

What has changed is “Chinese Manufacturers” who basically don’t give a “Flying F4ck” about the FCC or any other “Regulatory Body” or the significant costs of it. Many of them have just gone down the “fake certificate” route or found a regulatory loop hole.

Because of the way they “play the supply chain” there is next to nothing the Regulatory Agencies can do… With politicians doubling down on stupidity at every turn this is not a problem that is going to go away, in fact it’s just going to get worse, a whole lot worse…

Oh guess what it’s one of the reasons “right to tinker” legislation and repeal of legislation like the DMCA is not going to happen any time soon if ever in our life times.

But the end result of this political nonsense is you can buy powerful radio equipment –that can be harmful for your health– for less than a fast food take out burger meal…