router – Graves On SOHO Technology

Chances Are Your Router’s Firmware Blows

October 29, 2015
Michael Graves
networking, security

Linksys WRT-54G Router You surely have a lock on your front door. Do you have such a lock on your network? Though you may think so, but it may well be wholly unlocked. Or at least, you may not be able to know for certain that it’s locked. If you use a commercial Wi-Fi router from your ISP, or one of the big names like Linksys, Belkin, DLink et al, your network may not be as secure as you think.

At the outset let me state that, as someone who reads hereabouts, you’re no dummy. You’ve taken steps to ensure that the router doesn’t still have the default admin password. You’re using modern encryption on your Wi-Fi. You’re being responsible, but there are things beyond your grasp.

The simple fact is that the firmware the runs most retail, commercial routers is closed source. As such, you have no ready way to verify it’s behavior. Yet, the manufacturer, by virtue of necessity, uses various common software modules to create their firmware. They may even use some open source modules, but end up with an closed source binary in the end.

The upshot of this reality is that you have a very small team of developers responsible for maintaining the code. That means updates come along slowly, if at all for older devices. By extension, serious security issues get addressed slowly, if they ever get addressed at all.

Owning The Comcast CPE

August 5, 2015
Michael Graves
networking

Motorola Arris SB6141 cable modem For the past few weeks I’ve been thinking about the Comcast issued CPE that lives in my office. It’s a modem/router combination from SMC. We’ve had the service a long while. All the while we’ve been renting the device for $12.95 a month.

I can’t recall exactly when we transitioned from consumer to business class service. If I assume that it was five years ago, then we’ve paid over $750 in device rental! This for a device that can be purchased outright for under $200.

Clearly, this makes no sense at all. So last week I replaced the Comcast CPE with a Motorola/Arris SURFBoardSB6141. The choice of the SB6141 was made by consulting Comcast’s list of approved devices, and cross-referencing the SmallWall forums where Lee Sharp had some helpful advice to offer.

Manuel Kasper Announces The End Of m0n0wall Project

This morning’s email included a message from Manuel Kasper, leader of the m0n0wall project. On the very day that is the 12th anniversary of the project he has announced that he’s bringing it to an end. I’ve used m0n0wall for…

Ars Technica: 12M home and business routers vulnerable to critical hijacking hack

December 19, 2014
Michael Graves
security

Yesterday Ars Technica ran an article once again detailing how millions of consumer and SMB routers are vulnerable to exploit. This exploit, dubbed Misfortune Cookie, leaves the network open to those who would penetrate your systems and steal your personal…

Recent Thoughts About The Edge of My Network

January 23, 2014
Michael Graves
networking

In recent weeks I’ve been accumulating some thoughts about the edge of networks, and the edge of my home office network in particular.

This all started last month where there was an Ars Technica article describing how someone found a backdoor that allowed an evil-doer to gain admin access to a common consumer combination DSL Modem/router/Wifi AP. The author initially proved the exploit by hacking his Linksys WAG200G wireless gateway.

The article describes how he published the script used to run the exploit. That allowed others to try the exploit against various makes/models of consumer hardware. It thus came to light that the same trick works against various products from Linksys and Netgear, amongst others.

Choosing A Router/Firewall For A Small Office

net4801_2_l One project that I’m am about to start is moving from my m0n0wall router to a new one build around pfsense. The motivation for the project is the integration of our Comcast Business Class internet service into the rest of the household. At present there are two separate networks, with only a few devices enjoying the high speed cable service. The pfsense system will be configured for dual WAN, accessing both the cable service and Covad DSL circuit.

My existing m0n0wall runs on an old Soekris Net4801. In service for many years, it has been extremely reliable. If m0n0wall does what you need I have no hesitation in recommending the software. Support from the user community is tremendous as well.