<story><title>Netgear 0-day vulnerability analysis and exploit</title><url>https://blog.grimm-co.com/2020/06/soho-device-exploitation.html?m=1</url></story><parent_chain><item><author>Sodman</author><text>The worst part is this isn&amp;#x27;t even just going to affect folks that would never think to update their router firmware. The firmware they &lt;i&gt;do&lt;/i&gt; push out is frequently a massive downgrade.&lt;p&gt;About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed &amp;quot;new update&amp;quot; for router firmware would involve some critical security updates, and maybe some stability fixes, but it basically rendered the router unusable. It would crash every few hours with normal usage. I googled around and turns out it was a known issue, the only recommended fix was &amp;quot;roll back to version x.x.x (2 versions prior). I found this fix months after it had been posted, and there had still been no new patch released to fix the issue.&lt;p&gt;When my relatives call me to fix their wifi, I now have to think twice about updating the firmware. These days I recommend the google wifi mesh router(s), because they just involve the least maintenance effort. They have less fine-tune controls and the wifi speed is slightly slower when you start approaching gigabit speeds (vs other high-end consumer routers), but it&amp;#x27;s definitely worth the trade off for me. Plus, anyone calling me to help with their wifi won&amp;#x27;t notice either of those things :)</text></item></parent_chain><comment><author>kelnos</author><text>&amp;gt; &lt;i&gt;The worst part is this isn&amp;#x27;t even just going to affect folks that would never think to update their router firmware. The firmware they do push out is frequently a massive downgrade.&lt;/i&gt;&lt;p&gt;I worked there a bit over 10 years ago, so things may have changed, but honestly I wouldn&amp;#x27;t expect them to change all that much.  For that kind of hardware (SOHO stuff), Netgear didn&amp;#x27;t have any software developers in-house.  It was all outsourced to dev shops in Asia.  The software was usually whatever generic thing the dev house had built, with customization for branding and enabling&amp;#x2F;disabling features Netgear wanted or didn&amp;#x27;t want.  Occasionally they would pay to add features that didn&amp;#x27;t exist.&lt;p&gt;Netgear usually didn&amp;#x27;t get source code, and would only get changelogs for new releases (which weren&amp;#x27;t all that detailed).  There were often many regressions, and all bug testing and feature verification was black-box.  When something was wrong, it was often a fight to get the dev house to prioritize it, especially if they didn&amp;#x27;t think it was a critical bug (declaring a bug a shipping showstopper was usually effective, but you can&amp;#x27;t cry wolf all the time, and that only works for pre-release products, not updates).&lt;p&gt;I imagine things are better now; at the very least I expect these developers to have at least a &lt;i&gt;little&lt;/i&gt; more awareness of common security issues and how to avoid them (definitely was not the case in the 00s), but I assume it&amp;#x27;s still a mixed bag.  On the plus side, most of the current-gen hardware is beefy enough to run Linux, which a lot more developers are familiar with (IIRC a lot of the stuff back then was running vxWorks), which hopefully makes it easier to hire better developers.&lt;p&gt;If you want high-quality software on your networking gear, go with a company that you know is actually a software company, and not an outsourced hw&amp;#x2F;sw company.  Products that are based on OpenWRT or Tomato or something like that are probably safer, assuming they haven&amp;#x27;t broken it with their customizations... but don&amp;#x27;t expect updates to new major releases.  Having said that, I still buy Netgear switches and other stuff that&amp;#x27;s internal to my network and are generally relatively &amp;quot;dumb&amp;quot;.  They&amp;#x27;re usually pretty reliable and reasonably priced.</text></comment>
<story><title>Netgear 0-day vulnerability analysis and exploit</title><url>https://blog.grimm-co.com/2020/06/soho-device-exploitation.html?m=1</url></story><parent_chain><item><author>Sodman</author><text>The worst part is this isn&amp;#x27;t even just going to affect folks that would never think to update their router firmware. The firmware they &lt;i&gt;do&lt;/i&gt; push out is frequently a massive downgrade.&lt;p&gt;About a year ago, I tried to update the firmware on my Netgear router. It was the exact model from the article, the R7000. I assumed &amp;quot;new update&amp;quot; for router firmware would involve some critical security updates, and maybe some stability fixes, but it basically rendered the router unusable. It would crash every few hours with normal usage. I googled around and turns out it was a known issue, the only recommended fix was &amp;quot;roll back to version x.x.x (2 versions prior). I found this fix months after it had been posted, and there had still been no new patch released to fix the issue.&lt;p&gt;When my relatives call me to fix their wifi, I now have to think twice about updating the firmware. These days I recommend the google wifi mesh router(s), because they just involve the least maintenance effort. They have less fine-tune controls and the wifi speed is slightly slower when you start approaching gigabit speeds (vs other high-end consumer routers), but it&amp;#x27;s definitely worth the trade off for me. Plus, anyone calling me to help with their wifi won&amp;#x27;t notice either of those things :)</text></item></parent_chain><comment><author>jeffbee</author><text>The best thing about setting up Google wifi routers for your relatives is you can set yourself up as the manager of them, and manage them with the Google Wifi app from anywhere. So before Uncle Bob calls you about the wifi you&amp;#x27;d already have got the notification that his cable service is down again.</text></comment>