SoylentNews is people
SoylentNews
Netgear has quietly decided not to patch more than 40 home routers to plug a remote code execution vulnerability – despite security researchers having published proof-of-concept exploit code.
The vuln was revealed publicly in June by Trend Micro's Zero Day Initiative (ZDI) following six months spent chivvying Netgear behind the scenes to take it seriously.
Keen-eyed Reg readers, however, noticed that Netgear quietly declared 45 of the affected products as "outside the security support period" – meaning those items won't be updated to protect them against the vuln.
America's Carnegie-Mellon University summarised the vuln in a note from its Software Engineering Institute: "Multiple Netgear devices contain a stack buffer overflow in the httpd web server's handling of upgrade_check.cgi, which may allow for unauthenticated remote code execution with root privileges."
[...] With today's revelation that 45 largely consumer and SME-grade items will never be patched, Netgear faces questions over its commitment to older product lines. Such questions have begun to be addressed in Britain by calls from government agencies for new laws forcing manufacturers to reveal devices' design lifespans at the point of purchase.
Brian Gorenc, Trend Micro's senior director of vulnerability research and head of ZDI, told The Register in a statement: "Consumers should always ensure their devices are still supported by their manufacturers. They should also check the available support before purchasing a device. Unfortunately, there are too many examples of vendors abandoning devices that are still in wide use – sometimes even when they are still available to purchase. We hope vendors clearly communicate their support and lifecycle policies so that consumers can make educated choices."
(Score: 0) by Anonymous Coward on Friday July 31 2020, @08:43PM (1 child)
Planned obsolescence!! It's a feature!
(Score: 0) by Anonymous Coward on Friday July 31 2020, @08:55PM
Not only Netgear
My Archer C5 has never had an update available. Build 20160201 is the OE firmware.
(Score: 3, Insightful) by Anonymous Coward on Friday July 31 2020, @09:09PM (1 child)
Replace it
(Score: 2) by driverless on Sunday August 02 2020, @02:44AM
Or don't buy the cheapest crap available. Not being paid to say this but I chose to pay a bit more for Draytek gear and they support their stuff more or less forever, or at least until the hardware is so obsolete you can't use it any more (ADSL1 routers and the like). If you're buying absolutely the cheapest crap you can get then you kinda need to expect that the way to get it updated is to buy a newer model of the same crap. When I do put in cheap disposable crap I expect to drop it in, expect no updates ever, and throw it away and get another if it fails (this is for situations where environmental conditions mean it probably won't last, so no point in spending extra on good-quality gear).
(Score: 5, Informative) by Runaway1956 on Friday July 31 2020, @09:09PM (4 children)
I will note that most (if not all) of Netgear's routers are upgradeable with Tomato and the various WRT firmwares.
MOST modems cannot be upgraded with these, however, the 2200V1 will work. Don't just grab any firmware willy-nilly and install it - read the documentation, to ensure that you are getting the correct version for your device. Double check and triple check the version numbers!! Installing the wrong firmware will brick your device!
And, no, it isn't difficult. Plan on spending an hour or more reading, to be sure you know what you're doing. Once you've decided which firmware, and you've downloaded that firmware, it takes about five minutes to install it. After installation, you might spend five minutes to an hour configuring. There's more stuff in the menus than you ever dreamed of - all of it useful.
(Score: 3, Informative) by Runaway1956 on Friday July 31 2020, @09:23PM (3 children)
Should have provided a link above.
https://www.myopenrouter.com/ [myopenrouter.com]
This site gets support from Netgear, to some degree. Pretty much every question you could ask about opensource firmware and Netgear has been answered here.
(Score: 5, Informative) by MostCynical on Friday July 31 2020, @09:53PM
for OpenWRT supported netgear devices, check here [openwrt.org]
"I guess once you start doubting, there's no end to it." -Batou, Ghost in the Shell: Stand Alone Complex
(Score: 2) by JoeMerchant on Saturday August 01 2020, @03:07AM (1 child)
I've been a Netgear customer since forever because their routers are re-flashable with OpenWRT - however, in practice, I have always chosen to use the Netgear firmware instead.
Thanks to a lucky lightning strike, I upgraded my router a month ago, so the new one isn't on that list. However, I think the 2 generations back standby is... What's shocking is how much better the new routers perform than the outdated ones - you quickly start to take for granted things like: it works across the whole house and yard, and can stream video to three clients simultaneously.
🌻🌻 [google.com]
(Score: 0) by Anonymous Coward on Saturday August 01 2020, @01:20PM
It's all about the MIMO. It's only going to get better as they figure out more ways to fit more antennas in a smaller package.
(Score: 4, Interesting) by Mojibake Tengu on Friday July 31 2020, @10:36PM (1 child)
What would Huawei do?
Never mind, that's a rhetorical question.
Well, actually I have at least 5 Netgear switches (24, 8, 5 ports) in my household, mainly because they support CAT6 and jumbo frames, which is good thing for my servers.
But since I always expect either backdoors or exploits in all consumer or enterprise products, I never buy managed routers of any brand.
Gateways and firewalls is something everyone should build on their own.
Bridging a modem and putting your own firewall behind it is the best of possible. The same with separate wifi APs.
With network, every money saved on gear means pain. All-in-one consumer devices are the worst, all-in-one enterprise devices catch them up in evility.
Respect Authorities. Know your social status. Woke responsibly.
(Score: 2, Interesting) by Anonymous Coward on Friday July 31 2020, @11:04PM
Agreed. However, I will plug Netgate here. For $179 they have pretty darn decent set of hardware, and the whole thing runs on pfSense. So if you like BSD based firewalls using PF, they're something you should look at.
IIRC, they only concentrate on the router/firewall part of it. I have 4 different wireless networks VLAN'd through a single OPT port using a Ubiquity access point that allows creating multiple SSIDs and networks using VLANs.
The modem is in bridge mode with public hotspots turned off, and the router/firewall is separate from the access point. You compromise the modem and you're still in front of the router/firewall anyways
--Ed 791
(Score: 0) by Anonymous Coward on Friday July 31 2020, @11:26PM
I still use Linksys router with tomato firmware. Had it for more than a decade, and absolutely no issue.
Fuck - best not jinx myself - guess it was made with quality components (i.e. capacitors) unlike the modern garbage that gives out after coupla years.
(Score: 0) by Anonymous Coward on Friday July 31 2020, @11:43PM (5 children)
Are you really expecting greater than 3 year support? Go put the damn free software package on that thing.
(Score: 4, Insightful) by Runaway1956 on Saturday August 01 2020, @12:06AM (4 children)
Yes, I do expect greater than 3 years of support. At 3 years, the shine is just wearing off. I have multiple devices that are ten years old and more. I don't expect a lot of new features and such to be developed after 3 years, but I do expect security patches, right on out to ten years.
(Score: 0) by Anonymous Coward on Saturday August 01 2020, @12:19AM
You're in for disappointment then.
(Score: 1, Touché) by Anonymous Coward on Saturday August 01 2020, @07:08AM (1 child)
Yes, I do expect greater than 3 years of support. At 3 years, the shine is just wearing off.
You must be European. Fucking the customer is the American way.
(Score: 0) by Anonymous Coward on Saturday August 01 2020, @01:23PM
That's probably an insult to Runaway, but even more shocking to everyone else!
(Score: 0) by Anonymous Coward on Saturday August 01 2020, @07:47PM
Agreed. If the thing has a security hole then, as far as I am concerned, the company sold me a defective product to begin with and it is their responsibility to fix it. Even if the defect manifests itself ten years later.
(Score: 2) by Snotnose on Saturday August 01 2020, @12:45AM (1 child)
People who know of the issue (maybe 10%) have already solved it.
People who think a router is a woodworking tool (90%) will never even hear of the issue.
When the dust settled America realized it was saved by a porn star.
(Score: 2) by JoeMerchant on Saturday August 01 2020, @03:10AM
People who think a router is a woodworking tool (90%) will never even hear of the issue, until every device in their house starts mining Dogecoin.
🌻🌻 [google.com]
(Score: 3, Interesting) by Opportunist on Saturday August 01 2020, @01:40AM (2 children)
Let's be honest here, how many "normal" (read: Non-geek) people do you think even knew that they could update their router? How many of them care? And of those, how many will even know about this?
In the SOHO market, and netgear is definitely targeting that, my guess would be that less than 1% of the users actually know, care and do something about it. And that percent already runs openWRT.
So... tell me why Netgear should do anything. Nobody would download&use their patch. Either the people don't know and care, then it's moot to hand them the patch even though they need it. And those that know&care already don't need the patch...
(Score: 0) by Anonymous Coward on Saturday August 01 2020, @03:03AM (1 child)
Start making Netgear liabble for the losses. Make it the law that if a security vulnerability was found, that you can send the Geeksquad bill to Netgear to be paid. Better yet, make it so Geeksquad can send the bill. Similar to non-voluntary recalls in the auto industry. Netgear doesn't want to fix it? Zero immunity to lawsuits.
At some point, security is going to have to be mandated, certified, and regulated. We are so well past the point where we need a National Algorithm Repository, and groups like DD-WRT, Openrouter, Tomatoe, pfSense, should be getting subsidies from the government. Personally, the NSA needs to stop with the fucking mass surveillance, and start acting like a National Pen Tester.
Netgear, et al, should be in the hardware business only. If the only exception for liability is to be a FOSS company that utilizes a National Algorithm Repository, then that will make it exceptionally fucking serious to be running a security firm for profit. When the possible repair fees could rack up into the hundreds of millions of dollars, I'm betting that the state of security will go up. Meaning, instead of hookers and blow, those executives will be heavily incentivized to spend 10 million dollars on various pen testing groups.
That would be the last exception to the rule; Security budgets in excess of 20% Gross Revenue (NOT net profits which can be gamed), that are spent on outside independent pen testing groups, grants you immunity from lawsuits. You demonstrate meaningful peer review of code, and good faith effort, you get rewarded for it.
(Score: 2) by Opportunist on Saturday August 01 2020, @10:42AM
Yeah, let's make someone else pay for you being too lazy to keep your equipment secure. That will teach them... to not sell that equipment to you, mostly. Because if you hold me liable for your own stupidity, I will refuse to do business with you, simply because it's a guaranteed loss for me.
(Score: -1, Troll) by Anonymous Coward on Saturday August 01 2020, @02:55AM
WTF is a nigger device, & why do I gottta replace it?
(Score: -1, Spam) by Anonymous Coward on Saturday August 01 2020, @12:39PM
See subject: So "that was NOT me posting" https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985641#commentwrap [soylentnews.org] which YES, you said when you LIBELED me publicly BEFORE it with YOU saying "So that's a "yes" to schizophrenia/schizoaffective disorder and a "no" to "am taking meds for said disorder" LIBELING ME then...?" per YOUR https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=982854#commentwrap [soylentnews.org] you stupid pitiful FAKENAME fuck online LIAR piece of fucking SHIT?
OR
Was it when I GOT YOUR REAL NAME & found you are a satanist/anti-god HERE https://redeeminggod.com/sermons/luke/luke_7_36-50/#comment-269796 [redeeminggod.com] also which most ALL you "LEFTIST" LOSER weirdos usually are (which YES, in THIS other exchange "Why do you assume that you finding discussion threads on other sites with me in them will scare me?" quoted from https://soylentnews.org/comments.pl?noupdate=1&sid=38720&page=1&cid=1028402#commentwrap [soylentnews.org] you DID admit FINALLY to saying it was you - ESPECIALLY AFTER dozens of doctors RECENTLY seconded me on Hydroxychloroquin + Zinc (& Vitamin D3 imo along w/ other things I noted that are anti-viral + antibacterial like RAW GARLIC too)).
Do me a favor - DENY ANY OF THOSE, please & I will continue PROVING YOU ARE A SHITBAG LOSER, devil... as I already DID here https://soylentnews.org/comments.pl?noupdate=1&sid=38720&page=1&cid=1028211#commentwrap [soylentnews.org]
The TRUE BEAUTY of SATANIST FUCKS like YOU (antigod assholes)? TRUTH & FACT DESTROYS LIBELOUS DEVILS LIKE YOU - just like I did you & OTHER AHOLES who doubted what I wrote on what is NOW PROVEN TRUE by DOCTORS, admitted in mainstream media etc. (as I showed in those links' exchanges above easily) & especially LATELY by DOZENS of doctors (I have proof from pros - NOT LIBEL like you did to me PUBLICLY & I can still FRY YOU FOR IT FUCKER, live in fear fuck) MINUS any psych pros backing you.
SAY 1 THING, YOU STINKING LIBELOUS FUCK & I will CONTINUE LEVELLING YOU PUBLICLY with facts - not libel as you tried on me, stupid "Marissa von DUMBO", lol - please, say 1 thing & the BEATING on you, PUBLICLY will continue in this thread where you will have a HELL of a TIME "downmod burying it" via downmod brigades doubtless ONLY yourself via multiple sockpuppet accounts etc. (downodding to HIDE it? FORGET IT vs. me - everyone sees you @ it now, lol - thanks, just as I SAID "your kind", demonic SWINE/antigod LOSERS, always do).
WHY SHOULD YOU FEAR LIBELING ME PROJECTING IT NOW, TRYING TO HIDE IT TOO?
TOUGH HIDING YOU LIED about LIBELING ME, especially via INHERENTLY DAMAGING STATEMENTS libeling me as you did see GOLDWATER RULE below too fuckface CUNT you are (wikipedia proof https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985366#commentwrap [soylentnews.org] & you said "No jury or judge would back it" here https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985353#commentwrap? [soylentnews.org] Ok - like I said earlier here which you TRIED TO DOWNMOD HIDE as I knew you HAVE to (everyone sees it anyhow) - TRY ME FUCKER - say 1 thing you COWARDLY STUPID LITTLE FUCK & we'll SEE what happens to you, fuckface CUNT you are).
As I said "DO YOU WANT TO BE SUED" for breaking the GOLDWATER RULE? See here again https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985329#commentwrap [soylentnews.org] for YOUR (& everyone else's) reference of YOUR LIBEL of myself
APK
P.S.=> Oh, I am going to have a FIELDDAY on YOUR ASS fucker - catching you not ONLY IN LIES above, but also in the fact you are a GODLESS fucking LOSER - come on, say something, question the above where you LIED fucker ("it was not me saying it" but it WAS in those links calling me a nutcase essentially when YOU SAID YOU DID NOT (because it IS grounds for SUING THE LIFE OUT OF YOUR WORTHLESS ASS because your statements are NOT BACKED BY actual psychiatric pros in professional psychiatric grounds LIBELING ME)) - oh, you are NEVER going to LIVE THIS DOWN & believe you me - I am going to MAKE SURE you don't - live with your HUMILIATION loser... apk
(Score: -1, Troll) by Anonymous Coward on Saturday August 01 2020, @01:07PM
See subject: So "that was NOT me posting" https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985641#commentwrap [soylentnews.org] which YES, you said when you LIBELED me publicly BEFORE it with YOU saying "So that's a "yes" to schizophrenia/schizoaffective disorder and a "no" to "am taking meds for said disorder" LIBELING ME then...?" per YOUR https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=982854#commentwrap [soylentnews.org] you stupid pitiful FAKENAME fuck online LIAR piece of fucking SHIT?
OR
Was it when I GOT YOUR REAL NAME & found you are a satanist/anti-god HERE https://redeeminggod.com/sermons/luke/luke_7_36-50/#comment-269796 [redeeminggod.com] also which most ALL you "LEFTIST" LOSER weirdos usually are (which YES, in THIS other exchange "Why do you assume that you finding discussion threads on other sites with me in them will scare me?" quoted from https://soylentnews.org/comments.pl?noupdate=1&sid=38720&page=1&cid=1028402#commentwrap [soylentnews.org] you DID admit FINALLY to saying it was you - ESPECIALLY AFTER dozens of doctors RECENTLY seconded me on Hydroxychloroquin + Zinc (& Vitamin D3 imo along w/ other things I noted that are anti-viral + antibacterial like RAW GARLIC too)).
Do me a favor - DENY ANY OF THOSE, please & I will continue PROVING YOU ARE A SHITBAG LOSER, devil... as I already DID here https://soylentnews.org/comments.pl?noupdate=1&sid=38720&page=1&cid=1028211#commentwrap [soylentnews.org]
The TRUE BEAUTY of SATANIST FUCKS like YOU (antigod assholes)? TRUTH & FACT DESTROYS LIBELOUS DEVILS LIKE YOU - just like I did you & OTHER AHOLES who doubted what I wrote on what is NOW PROVEN TRUE by DOCTORS, admitted in mainstream media etc. (as I showed in those links' exchanges above easily) & especially LATELY by DOZENS of doctors (I have proof from pros - NOT LIBEL like you did to me PUBLICLY & I can still FRY YOU FOR IT FUCKER, live in fear fuck) MINUS any psych pros backing you.
SAY 1 THING, YOU STINKING LIBELOUS FUCK & I will CONTINUE LEVELLING YOU PUBLICLY with facts - not libel as you tried on me, stupid "Marissa von DUMBO", lol - please, say 1 thing & the BEATING on you, PUBLICLY will continue in this thread where you will have a HELL of a TIME "downmod burying it" via downmod brigades doubtless ONLY yourself via multiple sockpuppet accounts etc. (downodding to HIDE it? FORGET IT vs. me - everyone sees you @ it now, lol - thanks, just as I SAID "your kind", demonic SWINE/antigod LOSERS, always do).
WHY SHOULD YOU FEAR LIBELING ME PROJECTING IT NOW, TRYING TO HIDE IT TOO?
TOUGH HIDING YOU LIED about LIBELING ME, especially via INHERENTLY DAMAGING STATEMENTS libeling me as you did see GOLDWATER RULE below too fuckface CUNT you are (wikipedia proof https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985366#commentwrap [soylentnews.org] & you said "No jury or judge would back it" here https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985353#commentwrap? [soylentnews.org] Ok - like I said earlier here which you TRIED TO DOWNMOD HIDE as I knew you HAVE to (everyone sees it anyhow) - TRY ME FUCKER - say 1 thing you COWARDLY STUPID LITTLE FUCK & we'll SEE what happens to you, fuckface CUNT you are).
As I said "DO YOU WANT TO BE SUED" for breaking the GOLDWATER RULE? See here again https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985329#commentwrap [soylentnews.org] for YOUR (& everyone else's) reference of YOUR LIBEL of myself
APK
P.S.=> Oh, I am going to have a FIELDDAY on YOUR ASS fucker - catching you not ONLY IN LIES above, but also in the fact you are a GODLESS fucking LOSER - come on, say something, question the above where you LIED fucker ("it was not me saying it" but it WAS in those links calling me a nutcase essentially when YOU SAID YOU DID NOT (because it IS grounds for SUING THE LIFE OUT OF YOUR WORTHLESS ASS because your statements are NOT BACKED BY actual psychiatric pros in professional psychiatric grounds LIBELING ME)) - oh, you are NEVER going to LIVE THIS DOWN & believe you me - I am going to MAKE SURE you don't - live with your HUMILIATION loser... apk
(Score: -1, Spam) by Anonymous Coward on Saturday August 01 2020, @07:43PM
Marissa Van Eck FAKENAME CUNT Azuma Hazuki: So "that was NOT me posting" https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985641#commentwrap [soylentnews.org] which YES, you said when you LIBELED me publicly BEFORE it with YOU saying "So that's a "yes" to schizophrenia/schizoaffective disorder and a "no" to "am taking meds for said disorder" LIBELING ME then...?" per YOUR https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=982854#commentwrap [soylentnews.org] you stupid pitiful FAKENAME fuck online LIAR piece of fucking SHIT?
OR
Was it when I GOT YOUR REAL NAME & found you are a satanist/anti-god HERE https://redeeminggod.com/sermons/luke/luke_7_36-50/#comment-269796 [redeeminggod.com] also which most ALL you "LEFTIST" LOSER weirdos usually are (which YES, in THIS other exchange "Why do you assume that you finding discussion threads on other sites with me in them will scare me?" quoted from https://soylentnews.org/comments.pl?noupdate=1&sid=38720&page=1&cid=1028402#commentwrap [soylentnews.org] you DID admit FINALLY to saying it was you - ESPECIALLY AFTER dozens of doctors RECENTLY seconded me on Hydroxychloroquin + Zinc (& Vitamin D3 imo along w/ other things I noted that are anti-viral + antibacterial like RAW GARLIC too)).
Do me a favor - DENY ANY OF THOSE, please & I will continue PROVING YOU ARE A SHITBAG LOSER, devil... as I already DID here https://soylentnews.org/comments.pl?noupdate=1&sid=38720&page=1&cid=1028211#commentwrap [soylentnews.org]
The TRUE BEAUTY of SATANIST FUCKS like YOU (antigod assholes)? TRUTH & FACT DESTROYS LIBELOUS DEVILS LIKE YOU - just like I did you & OTHER AHOLES who doubted what I wrote on what is NOW PROVEN TRUE by DOCTORS, admitted in mainstream media etc. (as I showed in those links' exchanges above easily) & especially LATELY by DOZENS of doctors (I have proof from pros - NOT LIBEL like you did to me PUBLICLY & I can still FRY YOU FOR IT FUCKER, live in fear fuck) MINUS any psych pros backing you.
SAY 1 THING, YOU STINKING LIBELOUS FUCK & I will CONTINUE LEVELLING YOU PUBLICLY with facts - not libel as you tried on me, stupid "Marissa von DUMBO", lol - please, say 1 thing & the BEATING on you, PUBLICLY will continue in this thread where you will have a HELL of a TIME "downmod burying it" via downmod brigades doubtless ONLY yourself via multiple sockpuppet accounts etc. (downodding to HIDE it? FORGET IT vs. me - everyone sees you @ it now, lol - thanks, just as I SAID "your kind", demonic SWINE/antigod LOSERS, always do).
WHY SHOULD YOU FEAR LIBELING ME PROJECTING IT NOW, TRYING TO HIDE IT TOO?
TOUGH HIDING YOU LIED about LIBELING ME, especially via INHERENTLY DAMAGING STATEMENTS libeling me as you did see GOLDWATER RULE below too fuckface CUNT you are (wikipedia proof https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985366#commentwrap [soylentnews.org] & you said "No jury or judge would back it" here https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985353#commentwrap? [soylentnews.org] Ok - like I said earlier here which you TRIED TO DOWNMOD HIDE as I knew you HAVE to (everyone sees it anyhow) - TRY ME FUCKER - say 1 thing you COWARDLY STUPID LITTLE FUCK & we'll SEE what happens to you, fuckface CUNT you are).
As I said "DO YOU WANT TO BE SUED" for breaking the GOLDWATER RULE? See here again https://soylentnews.org/comments.pl?noupdate=1&sid=37033&page=1&cid=985329#commentwrap [soylentnews.org] for YOUR (& everyone else's) reference of YOUR LIBEL of myself
APK
P.S.=> Oh, I am going to have a FIELDDAY on YOUR ASS fucker - catching you not ONLY IN LIES above, but also in the fact you are a GODLESS fucking LOSER - come on, say something, question the above where you LIED fucker ("it was not me saying it" but it WAS in those links calling me a nutcase essentially when YOU SAID YOU DID NOT (because it IS grounds for SUING THE LIFE OUT OF YOUR WORTHLESS ASS because your statements are NOT BACKED BY actual psychiatric pros in professional psychiatric grounds LIBELING ME)) - oh, you are NEVER going to LIVE THIS DOWN & believe you me - I am going to MAKE SURE you don't - live with your HUMILIATION loser... apk