News for hackers. Stuff that matters.

A comment on Ubiquity hardware sends telemetry and it cannot be turned off. Parent comment

Re:Ubiquity hardware sends telemetry and it cannot be turned... by BubRoss on Monday November 11, 2019 @10:07AM (#21505381)
Once I flashed my router with tomato I never had any problems with it again. It just works and needs nothing. Now that I set up a pi-hole I have to worry a lot less about telemetry from TVs and rogue devices.

Good technology doesn't need to be updated all the time.

[ Parent | on HN ]
Re:Ubiquity hardware sends telemetry and it cannot be turned... by 0b0001 on Monday November 11, 2019 @10:39AM (#21505670)
Do you know if the ancient Linux kernel on your router has any security issues?

Do you receive any notification if there's ever an issue found? Is there even a centralised tracker for security issues affecting the router software?

Sometimes, things need to be updated. And consumers can't be bothered to flash a firmware image.

[ Parent | on HN ]
Re:Ubiquity hardware sends telemetry and it cannot be turned... by AnIdiotOnTheNet on Monday November 11, 2019 @10:53AM (#21505779)
It's a home router, who cares. Chances are any security issue it has can only be realistically exploited on the local network. Is it really worth the trouble of constant software updates to bother to prevent? I don't think it is.
[ Parent | on HN ]
Re:Ubiquity hardware sends telemetry and it cannot be turned... by chopin on Monday November 11, 2019 @11:10AM (#21505934)
It's not that easy:

There could be a XSS vulnerability in the management interface.

There could be a vulnerability in any component which is internet facing.

The router is handling packets. There might be a vulnerability in that logic allowing for maliciously crafted packets (in the answer of a request).

[ Parent | on HN ]
Re:Ubiquity hardware sends telemetry and it cannot be turned... by BubRoss on Monday November 11, 2019 @10:31PM (#21511304)
There -could- be a lot of things. Pfsense and ddwrt were some of the very first router software packages to address DNS rebind attacks.

I think saying tomato is more secure and refined than some router that updates itself constantly to secretly bait and switch the user's expectations is an understatement.

[ Parent | on HN ]
Re:Ubiquity hardware sends telemetry and it cannot be turned... by JohnFen on Monday November 11, 2019 @01:48PM (#21507572)
> There could be a XSS vulnerability in the management interface.

Surely you aren't exposing that interface to the world at large, right?

[ Parent | on HN ]
Re:Ubiquity hardware sends telemetry and it cannot be turned... by basch on Monday November 11, 2019 @02:27PM (#21507986)
If you click the wrong link while youre on the lan side.

Of all the devices in a house, a router should be the most important to keep up to date.

[ Parent | on HN ]
Re:Ubiquity hardware sends telemetry and it cannot be turned... by BubRoss on Monday November 11, 2019 @03:42PM (#21508672)
Pfsense and ddwrt were some of the first router software packages to fix DNS rebind attacks if that's what you are talking about.

If it is not, you will have to explain exactly the vulnerability works.

[ Parent | on HN ]
Re:Ubiquity hardware sends telemetry and it cannot be turned... by chopin on Tuesday November 12, 2019 @03:41AM (#21512564)
A link can also have an IP address as host. Many routers come with 192.168.1.1 preconfigured. With Javascript enabled you could also probe the network and craft a fitting link.

Preventing DNS rebind attacks closes only one avenue.

[ Parent | on HN ]
Re:Ubiquity hardware sends telemetry and it cannot be turned... by BubRoss on Tuesday November 12, 2019 @12:54PM (#21516240)
How would that work exactly and how would it be router insecurity?
[ Parent | on HN ]
Re:Ubiquity hardware sends telemetry and it cannot be turned... by satanspastaroll on Tuesday November 12, 2019 @06:38AM (#21513324)
Providing updates with a switch to opt out would be no problem to me. However they seem to be pushing the update without notice or consent, without a way to disable telemetry or automatic updates.
[ Parent | on HN ]