>Remember when you were able to take over any Instagram account by asking the helpful support AI to send a password reset to an email address of your choice?
Wow, first I've heard of that. Damages must have been immense for that level of incompetence occasioning financial harm. Or do those laws only apply if you can't hire very expensive lawyers to blame a computer?
Fair question. IP options in the header are generally not used due to performance degredation in parsing extended headers in hardware based packet filters. So they are part of the spec but generally not used due to this. I have worked in CDNs and large
internet facing networks for over 20 years and we implicitly drop any IP headers over 20 bytes (meaning they have options set).
Why the actual F%$K haven't they been deprecated and packets using them dropped by literally every tcp/ip stack if their only function is to get you f%$king pwned?
That might be a very dumb question for all I know. Maybe i shouldn't be cranky. It all seems like there are some very blase attitudes to this kind of thing, that should not even exist anymore, creating massive security holes, with zero upside tradeoff.
The seeming asymmetry offends me.
On the one hand it increases the attack surface and so the security risk. On the other, nothing. Yeah, let's take /that/ tradeoff on behalf of the entire internet.
Because TCP/IP is used for more than just the internet. For pretty much all of these weird features someone is using them somewhere on their own networks. (And these things are frequently blocked on the internet or on firewalls).
> Because TCP/IP is used for more than just the internet.
So I'm so stupid & ignorant of security I think I would define "Internet tcp/ip" which conformant stacks block this rubbish by default like they do any other non-conforming packet. Thus reducing the attack surface essentially with no tradeoff. Weird uses can use customised lwip or whatever for these uses where we don't know the who, the what or the why (or perhaps even the IF).
Seems like nobody is shipping these firewall rules by default on internet routers. We get the vulnerability and as a tradeoff we get nothing of any value to us. Who do we thank for that?
What is the rationale, the justification for not paring away the garbage that does nothing but create vulnerabilities?
The internet is a loose connection of people and organisations that is very difficult to coordinate. A lot of people do block these packets, which is why they're basically vestigial, but it's not something that's really worth spending co-ordination effort on when it's something that's easily implementable by those who want to and there still isn't universal support for things like standards that prevent BGP hijacking.
Every consumer router-wirelessAP I've seen runs linux.
I never see security upgrades for the kernels they use. Not one. Not ever.
Is this something that should be a cause for concern? Even if you don't run a consumer-grade tplink, netgear, asus, whatever router yourself.
Update:
The context which I should have said is that I think
LLMs are giving script kids nation state level tools and expertise. This known bug is always less interesting than the next twenty.
500+ Euros, 10G, Linux containers, that just is not targeted at consumers. My guess the number of people who have one of these in their home is very few indeed.
We're talking about the 500 million? A billion? more? Households with a consumer internet wirelessAP/Router with a public IP. Turris may be wonderful and i wish you the best of luck but in its present form it appears to be no part of the solution, sadly.
Enthusiasts and self-hosters, or just demanding users, are consumers too.
There are different kinds of consumer products. Some are simplistic and some have lots of features. Some are cheap and some are not. Some are slow and some are fast. Some are mass-produced and some are not.
For instance, there are Asus ROG routers with 25G, Samba, network drive, WireGuard etc. for over €700 and they're still consumer products. And I'm pretty sure those are not used in that many households either.
All of the Turris' product pages mention home usage. They also mention small business and office, which is expected for SOHO products.
To be frank, until today I thought that SOHO is a category of consumer products, but apparently it is not, so it looks like they target both.
I agree that this kind of devices is out of reach for many people, but it was not the topic until now.
I'm not affiliated with Turris in any way, so no need to wish me luck on this matter, but thanks anyway!
Mosty probably: not. Traffic passes throught the ASIC, usually it is not processed on CPU or custom code. Unlike typical web servers, that reduces the attack surface as there aren't software parsers (a common place where vulnerabilities hide). Additionally the OS may have additional protection measures, such as signing each binary, signing the booting image and limiting which syscalls can be done by any binary.
> Additionally the OS may have additional protection measures, such as signing each binary, signing the booting image and limiting which syscalls can be done by any binary.
I'd love for that to be true. Unfortunately, a lot of consumer routers are fairly straightforward Linux systems with no particular attempts at hardening.
I'm not sure. Maybe it would; maybe the IP options would make the packet bypass offload and get processed by the kernel. Either way, I wouldn't want to rely on hardware NAT offloading as a security feature.
The bug in question is not mitigated by any userspace actions (like signing binaries or boot images) or even by limiting syscalls, and all it takes is a listening socket on the device from either direction (inside or outside the network) to get root since router-destined packets are always processed by the CPU.
All traffic? In particular, I'd expect new connection establishment to go through a software path, looking up port forwarding and firewall rules etc. and creating hardware forwarding table entries if applicable.
This is one of the biggest benefits of using OpenWRT. They update the entire stack like every other month or so you’re never on an ancient kernel or utils.
The downside is it warns me if I update things will probably break and to take a backup, I've always been wary of updating my openwrt router because of that.
According to its logs, my bargain basement Huawei 4G router from 2019 got an update last week.
I hope that most of these devices actually do update themselves automatically, and people just aren't noticing. (Whether the updates are any good is another matter!)
You may want to try to look at Gl.inet routers. I'm not sure yet what is their modus operandi, but at least Flint 2 has both their official firmware (with Mediatek's SDK, I guess) and a vanilla Openwrt version -- on their company page.
Their features (Glinet's mesh) are not compatible but it does seem better than just drop support totally.
There also seems to be some involvement in the upbringing of openwrt support -- so it's not a hands-off approach, but on the other hand I'm only looking at Flint 2 firmware/OS development.
Additionally, their Flint 3e uses Qualcomm so the route it takes may be different -- though I hope not!!!
Now, if we are talking about my ISP router/modem....... I'd rather not think about it.
PS: Gl.inet also has a router with fiber optic. Not sure how that would work if I wanted to throw my ISP's router/modem out the window.
Google Wifi used to be good about that. I even got a notification for when my AP was being EOL'd and would no longer receive automatic firmware updates. I don't know if Google is still on the ball there. The Nest acquisition was confusing. Have the Google Wifi and Nest Wifi teams been merged?
But FWIW I run my AP in bridge mode. Wifi drivers and chip firmware seem to be riddled with exploits. I don't want my router & firewall on the same system as the AP.
While it's certainly not the right product for the openwrt crowd wanting to flash their own firmware and look under the covers, I wouldn't work here if we were obviously doing such things to the degree your comment implies.
Is it a cause of concern? Yes. Will you get hacked? Most likely not.
Most consumer routers run ancient stacks with all kinds of weird proprietary vendor patches that are tied to a specific kernel version. Looking at you Qualcomm!
However they generally also drop all traffic by default so from the WAN side they look like a black hole. I guess that's "safe" enough for most consumers.
For fun, take a look at the open PRs in the OpenWRT repos. Those people are doing some amazing work but it's also frustrating to see them struggle with things that _could_ be easy if the vendor made some slightly better choices.
I would strongly prefer something like OpenWRT though. Call me paranoid but after the last few weeks I'm increasingly less comfortable with connecting my devices to a blackbox.
I know the context here is consumer routers, but for those reading who might be running a server, or a homelab, or anything that does accept connections from outside, I want to make it clear that "most likely not" turns into "likely trivial if targeted" for servers.
Can you give examples of kernel bugs that can be targeted on an otherwise locked down system? Let's say something running just LAMP and all other ports closed off with a software firewall. Even the one in this article seems very tricky to actually exploit.
There are plenty of out of support systems still in the wild and while I'm not arguing they are completely secure I was under the impression that kernel vulnerabilities generally make a minor exploit in something else worse (chained priv escalation for example) and generally are difficult to exploit on their own. If I'm mistaken I'd love to know
Any TCP packet (with IP options) you can send to a Linux kernel that doesn't get DROP'd by netfilter makes you technically vulnerable.
That includes the one port your LAMP stack uses.
Or, the attacker might be originating from the other side of a device, like within a LAN. Malicious employees/house guests/what-have-you could target devices from inside your network where most devices (not just servers) don't have as much protection and often have other open ports accessible, like file sharing/SMB, SSH, SMTP, RDP, databases etc.
AFAIK all the backdoors which have been found in some models are only accessible from the LAN side, and if you have an attacker inside the network, it's already too late.
> if you have an attacker inside the network, it's already too late.
It shouldn't be though. Just because my smart lightbulb has an RCE and is isolated on its own VLAN with the router doesn't mean it should be able to attack the router and escalate to access my devices on other VLANs. It should only be able to do damage limited within its own vlan.
> if you have an attacker inside the network, it's already too late.
Disagree, I think it's still a good idea to try to mitigate e.g. root escalations via this bug from devices within your network as well, as they could become compromised at any moment via other means and then promote themselves to root.
Any wireless AP is going to run Linux because BSD has had a tough time with anything better than 802.11n
Any router/switch is going to be running an ancient Linux kernel, which isn't patched. EdgeOS for example, won't be patched. The old Brocade/Ruckus switches I got here, won't have this patched. I'm holding my breath for my Unifi APs.
i admit they don't enumerate their patches well, but the major residential router vendors do regular updates , usually indicated with "security fixes" .
unfortunately most lack SSH access or a real ability to test the kernel patch version.
MIPS and Arm have no security issues ever so never need patching which is an x86 only thing? Or maybe this comment is no more relevant than pointing out not all Arm patches apply to x86?
LLMs are giving script kids nation state level tools and expertise.
I'm on Comcast in USA, I BYOD for the router and it's a Netgear C3500 (I think). It gets new firmware pushed to it from Comcast. Can't even load your own manually.
> BYOD = bring your own device? And yet your isp pushes updates to it?
Perhaps better characterized as "buy your own device". Cable ISPs will only support a limited set of modems on their network, and they're fully managed by the ISP, both in terms of software and configuration.
Correct, and they are limited in features. I'm going to swap out this combo-modem+WiFi and get a dedicated -modem and then have a different device as my "edge" router/NAT
So comcast in the USA do it. Unclear how well. Assuming very well, what portion of the consumer market's home connections are covered? In the usa? In the world? This is the general issue beyond today's unpatched bug.
I've had probably at least about 5 routers supplied by 5 different ISPs over the past couple of decades and not one of them has ever got a security update. Is that an usual experience?
It should be unsurprising if comments here, made in public, capable of being challenged are far higher quality than official "peer review" which has really become a bit of a joke. Has been for quite a long time, to be fair. (And unsurprising if not, it's a web forum).
Peer reviewed and published means precisely excrement in a world where papers are not retracted and failures to replicate are refused publication by the "prestigious" "peer-reviewed" journals that published the original.
Intelligent, reasoned, knowledgeable review going back and forth with the author in public makes "peer review" seem just as silly as it usually is. Review by peer professor's indentured servants aka PhD students is often actually higher quality, if wildly dishonest and quite frankly disgraceful.
We now live in a world where LLMs can produce papers. Actual research is a little more interesting, with or without LLM. The journal peer review system doesn't seem to be helping.
I am not against some kind of "public review" and I really like arxiv.org. But I do not see it as a replacement for a peer review. It may start after a peer review when the paper is published, which IMHO should almost always be in an Open Access way.
For AI, the borders seem to have blurred a bit between academic scientists (e.g. at universities) and external scientists at companies or even private people). The problem with the latter is that it is much harder to enforce good scientific practice. Think only about the time it takes to write the state of the art of an ordinary conference paper.
I am also a bit drawn between giving everyone the chance to contribute to research and ensuring good scientific practice. Just writing down your latest ideas and successes is not the same as writing a scientific paper that shows the research in the context of past research and needs, for instance, to be much more mathematically rigorous.
You can write the above and I can respond. The quality of each response is visible to everyone. Your ideas and mine are actually getting reviewed here, now, at least to some degree. Or it can be seen that they are not getting reviewed or indeed there's a non-zero chance that it can be seen that one or both of us is a muppet. Anyone else can chime in and be ignored, or celebrated or anything else.
This is nothing like academic journal peer review, where you can't see the failed submissions for the paper and why. You have no clue if the reviewers were interested in the topic, diligent, drunk or playing politics "support papers from these institutions because they're the good guys, undermine those because they are or aren't from Europe." You have no idea if the paper has since failed to replicate on multiple occasions. You have no idea if you are the first person to actually read the paper and when you have you thoughts, no matter how insightful, well articulated and supported by evidence, those thoughts do not matter to the publication process of that paper, which has been peer reviewed.
Public review by the knowledgeable who care is a very different thing to so called "peer review."
Peer review and scrutiny out in the public is more valuable than only done by a couple of paid guys from a journal.
It's fairly basic. For a work published on a public platform, the same guys paid by the journal can also review it if they so choose to in addition to those people in the public who were not paid by anyone.
It’s always funny to read general-public takes on academic peer review, because they almost always betray a complete misunderstanding of how peer review works. Academic reviewers for the vast majority of journals notoriously do not get paid; in fact, paying peer reviewers is one of the most frequently suggested approaches to peer review reform.
Most still get benefits. I concede that many don't get "direct" remuneration. Some journals do pay.
But many do get vouchers, discounts, free access, early access, etc. which amounts to a form of payment and thus compensated in kind. This effectively is "paid" as far as I am concerned.
The logic stands. A reviewer, even those who get zero compensation, can always review publicly published papers just like others.
At least as many as the number of times I've tried to claim someone else's words and phrases as my exclusive intellectual property in order to profit, because I believe the latter is zero.
Trademarking words is common. "Apple" is one. It doesn't mean you can't use the word apple, it only means you can't name a computer company "Apple". There is still Apple Corps, Apple Bank, and tons of bakeries, cafes, donut shops, restaurants etc named things like "Apple Cafe", "Apple Donuts", "Apple Tree Diner", etc..
Or one can be like Apple, and just sort of ignore trademarks till you own them. Apple is kind of famous for taking over a significant portion of the music industry, despite a pre-existing agreement with Apple Corp never to do so. Not to mention launching the iPhone while Cisco still held the 'iPhone' trademark.
Wow, first I've heard of that. Damages must have been immense for that level of incompetence occasioning financial harm. Or do those laws only apply if you can't hire very expensive lawyers to blame a computer?
reply