Every consumer router-wirelessAP I've seen runs linux.
I never see security upgrades for the kernels they use. Not one. Not ever.
Is this something that should be a cause for concern? Even if you don't run a consumer-grade tplink, netgear, asus, whatever router yourself.
Update: The context which I should have said is that I think LLMs are giving script kids nation state level tools and expertise. This known bug is always less interesting than the next twenty.
Every consumer router-wirelessAP I've seen runs linux.
I never see security upgrades for the kernels they use. Not one. Not ever.
10G looks a little less consumer-y. I'd imagine cisco, arista, etc do security updates if you want to go down that path.
AFAIK, none of them supports WPA Enterprise, which I'd consider necessary for enterprise-grade equipment.
OTOH, they are Open Source and Open Hardware, are still pretty powerful, and are much cheaper than enterprise HW.
PS. The proper link to their site in English is https://www.turris.com/en/ .
We're talking about the 500 million? A billion? more? Households with a consumer internet wirelessAP/Router with a public IP. Turris may be wonderful and i wish you the best of luck but in its present form it appears to be no part of the solution, sadly.
There are different kinds of consumer products. Some are simplistic and some have lots of features. Some are cheap and some are not. Some are slow and some are fast. Some are mass-produced and some are not.
For instance, there are Asus ROG routers with 25G, Samba, network drive, WireGuard etc. for over €700 and they're still consumer products. And I'm pretty sure those are not used in that many households either.
All of the Turris' product pages mention home usage. They also mention small business and office, which is expected for SOHO products.
To be frank, until today I thought that SOHO is a category of consumer products, but apparently it is not, so it looks like they target both.
I agree that this kind of devices is out of reach for many people, but it was not the topic until now.
I'm not affiliated with Turris in any way, so no need to wish me luck on this matter, but thanks anyway!
I'd love for that to be true. Unfortunately, a lot of consumer routers are fairly straightforward Linux systems with no particular attempts at hardening.
I haven’t had problems upgrading in at least 4 years. There’s a screen where you click a button to auto-upgrade.
Just get it installed.
Granted they are pro-sumer devices, not strictly consumer.
I hope that most of these devices actually do update themselves automatically, and people just aren't noticing. (Whether the updates are any good is another matter!)
Their features (Glinet's mesh) are not compatible but it does seem better than just drop support totally.
There also seems to be some involvement in the upbringing of openwrt support -- so it's not a hands-off approach, but on the other hand I'm only looking at Flint 2 firmware/OS development.
Additionally, their Flint 3e uses Qualcomm so the route it takes may be different -- though I hope not!!!
Now, if we are talking about my ISP router/modem....... I'd rather not think about it.
PS: Gl.inet also has a router with fiber optic. Not sure how that would work if I wanted to throw my ISP's router/modem out the window.
But FWIW I run my AP in bridge mode. Wifi drivers and chip firmware seem to be riddled with exploits. I don't want my router & firewall on the same system as the AP.
full disclosure: they're my employer
Most consumer routers run ancient stacks with all kinds of weird proprietary vendor patches that are tied to a specific kernel version. Looking at you Qualcomm!
However they generally also drop all traffic by default so from the WAN side they look like a black hole. I guess that's "safe" enough for most consumers.
For fun, take a look at the open PRs in the OpenWRT repos. Those people are doing some amazing work but it's also frustrating to see them struggle with things that _could_ be easy if the vendor made some slightly better choices.
I would strongly prefer something like OpenWRT though. Call me paranoid but after the last few weeks I'm increasingly less comfortable with connecting my devices to a blackbox.
There are plenty of out of support systems still in the wild and while I'm not arguing they are completely secure I was under the impression that kernel vulnerabilities generally make a minor exploit in something else worse (chained priv escalation for example) and generally are difficult to exploit on their own. If I'm mistaken I'd love to know
That includes the one port your LAMP stack uses.
Or, the attacker might be originating from the other side of a device, like within a LAN. Malicious employees/house guests/what-have-you could target devices from inside your network where most devices (not just servers) don't have as much protection and often have other open ports accessible, like file sharing/SMB, SSH, SMTP, RDP, databases etc.
How about forwarding a port for wireguard or ssh?
AFAIK all the backdoors which have been found in some models are only accessible from the LAN side, and if you have an attacker inside the network, it's already too late.
Disagree, I think it's still a good idea to try to mitigate e.g. root escalations via this bug from devices within your network as well, as they could become compromised at any moment via other means and then promote themselves to root.
It shouldn't be though. Just because my smart lightbulb has an RCE and is isolated on its own VLAN with the router doesn't mean it should be able to attack the router and escalate to access my devices on other VLANs. It should only be able to do damage limited within its own vlan.
I'm thinking of what to do myself.
The ghost of android releasing 6 month old patches every month is going to come home to roost.
That would be a bold claim and one I've never heard before. Hard not to be suspicious of it.
This security flaw is unlikely to be the only security flaw that ever happens to a kernel used by routers.
The point: Consumer routers do not seem to get updates. Ever.
Is that a worry or what?
But what do I know about it beyond that?
Some more commercial ones (pfsense is commercial) use it too like juniper junos.
Any router/switch is going to be running an ancient Linux kernel, which isn't patched. EdgeOS for example, won't be patched. The old Brocade/Ruckus switches I got here, won't have this patched. I'm holding my breath for my Unifi APs.
Of course it does. But it was not affected in this particular case.
unfortunately most lack SSH access or a real ability to test the kernel patch version.
MIPS and Arm have no security issues ever so never need patching which is an x86 only thing? Or maybe this comment is no more relevant than pointing out not all Arm patches apply to x86?
LLMs are giving script kids nation state level tools and expertise.
Defintely seems potentially better than no updates at all.
How do you know if you have a wide open CVE they're ignoring, like it's claimed ubuntu are doing?
Perhaps better characterized as "buy your own device". Cable ISPs will only support a limited set of modems on their network, and they're fully managed by the ISP, both in terms of software and configuration.
I've had probably at least about 5 routers supplied by 5 different ISPs over the past couple of decades and not one of them has ever got a security update. Is that an usual experience?
at least with an open source os there are more paths forward.