<story><title>Security Begins at the Home Router</title><url>https://insights.sei.cmu.edu/sei_blog/2018/07/security-begins-at-the-home-router.html</url></story><parent_chain><item><author>securityn0w</author><text>Do you realize that OpenWrt is not very secure and DD-Wrt is even worse?</text></item><item><author>j45</author><text>Solid firmwares like OpenWRT run on a lot of routers already.&lt;p&gt;It should be possible to have some amount of regular updates, if not automatic.</text></item><item><author>Yizahi</author><text>You will probably need more complex hardware to accommodate this and it will be much more complex to implement correctly. For SOHO it is better to simply optimize for quicker boot process. For homes it doesn&amp;#x27;t even matter, just reboot the thing automatically on schedule during night. My expensive router does this and it is not hard or expensive to implement in all new models, regardless of their price.</text></item><item><author>0xfeba</author><text>I agree with Steven Gibson. The biggest defense we can have on this is autoupdating routers. At a minimum, just restart at some fixed time after an update is downloaded. More fancy would be dynamically calculating a low usage day and time to restart.&lt;p&gt;But this would also involve the router manufacturer keeping it up-to-date as well.&lt;p&gt;Which gets me thinking... Does a SOHO (or any) device exist that effectively runs two firmware instances at once to allow minimal downtime as it switches over to new firmware? I imagine larger routers do, or at least, two identical physical routers accomplishes as much.</text></item></parent_chain><comment><author>flas9sd</author><text>With a current kernel and updated userland? the no-password root ssh after flashing is vulnerable to others in your local network yes, keep it offline until pubkey-only auth is configured. To save against dropbear exploits, bind ssh to the internal-ethernet interface and if installed, access uhttpd&amp;#x2F;LuCI only via this tunnel. Other than that it seems equal to other default distribution installs. Apparmor&amp;#x2F;selinux steps up ubuntus&amp;#x2F;fedoras game yes, I don&amp;#x27;t know how much of this has been a concern yet in OpenWrt, a recent talk touches shortly on it. It seems to be a clean, easy-to-configure distribution that is alive and well after the remerge that just got a recent stable-release. Secondary vectors like package-system are a factor. But despite being reliant on the vendor, it buildable by the end-user. I applaud their efforts.</text></comment>
<story><title>Security Begins at the Home Router</title><url>https://insights.sei.cmu.edu/sei_blog/2018/07/security-begins-at-the-home-router.html</url></story><parent_chain><item><author>securityn0w</author><text>Do you realize that OpenWrt is not very secure and DD-Wrt is even worse?</text></item><item><author>j45</author><text>Solid firmwares like OpenWRT run on a lot of routers already.&lt;p&gt;It should be possible to have some amount of regular updates, if not automatic.</text></item><item><author>Yizahi</author><text>You will probably need more complex hardware to accommodate this and it will be much more complex to implement correctly. For SOHO it is better to simply optimize for quicker boot process. For homes it doesn&amp;#x27;t even matter, just reboot the thing automatically on schedule during night. My expensive router does this and it is not hard or expensive to implement in all new models, regardless of their price.</text></item><item><author>0xfeba</author><text>I agree with Steven Gibson. The biggest defense we can have on this is autoupdating routers. At a minimum, just restart at some fixed time after an update is downloaded. More fancy would be dynamically calculating a low usage day and time to restart.&lt;p&gt;But this would also involve the router manufacturer keeping it up-to-date as well.&lt;p&gt;Which gets me thinking... Does a SOHO (or any) device exist that effectively runs two firmware instances at once to allow minimal downtime as it switches over to new firmware? I imagine larger routers do, or at least, two identical physical routers accomplishes as much.</text></item></parent_chain><comment><author>bigiain</author><text>Have you got links or keywords I can search for details about that? (I&amp;#x27;m in the middle of a decision about moving to an OpenWRT or Mikrotik router...)</text></comment>