Hacker News Reader

Comment by Tharkun | Hacker News Reader

So ... which SoHo router manufacturer can we actually trust? It seems pretty common in this industry to either not supply security updates, or to only supply them for a very short amount of time.

View on HN

Mikrotik is trustworthy enough. The update that fixed this was released in April, the first exploit appeared a few months later but this story gets regurgitated every couple of weeks because so many people use insecure configurations and don't bother upgrading their routers.

As to their update availability - I'm fairly certain I could take something they manufactured 15 years ago and update it to the current version, as it all uses the same OS, and they still support every architecture they've used.

Also, while Mikrotik security practices are not great (as I recall, before this vulnerability, admin passwords were stored in plain text), by default, I think zero services listen on the WAN port. Owners must specifically configure their device in a not recommended manner (exposing the low-quality web admin interface to the world) for this vulnerability. It's like exposing your printer web interface to the world and expecting it not to get hacked.

The main problem with Mikrotik is that the configuration interface is too low-level and it's easy to fall into such traps.

I wonder how networking equipment manufacturers can motivate regular users to update their equipment more regularly? Auto update would seems like a logical one but plenty of people have reasons to not update and don't want there router going down at times they cannot control.

For most people router is something they don't want to touch and sometimes they don't even have access to it because it's managed by somebody else.

But as the first comment says - introducing breaking changes is not acceptable and they should appear only in major releases. And then those security bugfixes should be backported on all major versions which were released at least 5 years back. Yesterday I upgraded mikrotik from 6.14 to 6.42 and it took me 30minutes of additional configuration to make everything working again.

Also mikrotik collets a lot of network stats so implementing an algorithm which would restart the router when there's usually the least amount of traffic should be feasible - those updates take less than a minute so it's not like windows 10.

I gave up on all-in-one firewall/router/wireless AP units recently and now have a more complex setup I'd only recommend to those who enjoy setting these things up and learning.

For the firewall I've got pfSense (FreeBSD based firewall) running on an small Intel box from Aliexpress with 6x ethernet ports. I overspecced the machine so I knew it would last for years, whilst allowing running intrusion detection (snort), reverse proxy, auto blacklisting and much more.

This is also acting as my router, but if & when my home network expands I'll add a dedicated one (and probably put 4x ethernet ports bonded using lagg into it as it'll still be controlling my vlans).

I got a dedicated ceiling mount wireless AP from TP-Link.

This has only slightly higher power and space requirements than what I had, but that buys me so much flexibility. I can upgrade and augment individual components when needed (particularly wifi). I have individual vlans, firewalled off from each other, running over three wifi SSIDs - trusted, guest and internet-of-shit. I'm currently connected into my trusted vlan over OpenVPN, so I can connect to my server without having to open any ports to the outside world.

The downsides are that it did take a couple of days to set it all up to my liking, but personally I've learned so much doing it it's been worth every minute.

https://blog.mikrotik.com/security/new-exploit-for-mikrotik-...

"Regardless of version used, all RouterOS versions that have the default firewall enabled, are not vulnerable"

I don't believe all MK devices OOTB had the WAN interface firewall'd (they do now though their wAP's run same license level 4 of RouterOS and do not have fw enabled on the ethernet port) though I do recall that being made very clear in both the documentation that came with the hardware and in any wiki/docs I looked at at the time I was first setting up my MK device.

The issue I have is the lack of communication with customers. I have not received any notification of this vuln since August 5th (well since patched in April) but they in general seem rather blase about the whole thing. I haven't followed the link to story but I follow BPR on Twitter and saw that it's around 421K according to censysio.

https://twitter.com/bad_packets/status/1050533001824595968

They've sent emails about this, posted to Twitter and Facebook, the software shows that there is an update available. If you've bought their device from a third party, and they don't have your contact information, how do you expect them to communicate with you?

Purchased everything on Amazon that was sold by Mikrotik. I follow a couple of their accounts on Twitter and will see routerOS version updates there well before I ever get an email. Like I said, I have not received any email about this vuln since August 5th (patched day of back in April). Email notification is paramount for me...

Edit: I see...*notification via email is what I thought I had written in top post.

Turris omnia. Open source (both hardware and software), lets you ssh into it directly out of the box (well, after you have set a root password in the gui)

They provide regular software updates, and it is imho a good hacker/tinkerer router.

I agree - got one, quite happy with it. But it's targeted for home use, not sure how well it fits into larger networks (small offices). MikroTik seems like a better fit for that, not sure.

One major advantage of Turris Omnia is that CZ.NIC is a non-profit, so they are not as constrained by profitability of this project, and it's a part of a larger strategy (e.g. you may allow reporting statistics back to turris: https://project.turris.cz/en/global-stats/).

300€ is about 5 times what I would consider a price to pay for a home router though.

this depends on what you want out of it I guess. I wanted a tinker router, one which doesnt treat me like an absolute idiot, with a spf for fiber, can do gigabit easily and is expandable.

The hAP-ac I have also ticks most of these boxes[1], but costs less than half what the Turris does (no PCIe, but I am not sure what I'd use that for in a router).

1: https://mikrotik.com/product/RB962UiGS-5HacT2HnT

This is about 5 times the price of hAP ac from Mikrotik, and hAP ac can do some things much faster due to hardware acceleration of some of its capabilities in Qualcomm QCA8337 switch chip.

See my post above: APU2 by pcengines. Put debian on it.

It's a great piece of hardware, of which I've used dozens for various purposes. But they draw ~10 times more power than, say, a cheap Linksys wifi router. So if all you're after is a SoHo wifi router, it might not be the best way to go.

They don't. Mine draw under 10W, which is well within range of a Linksys thing.

Mine draw around 10W idle, about 15W when active. My Linksys and TP-Link trinkets draw under 2W idle (which I'm guessing is my power meter's minimum value), and not much more when active.

Power meters generally don't well measuring low loads, 2W sounds like an error.

That's fair, but I don't know of any SOHO routers I trust, which is what led me to it. It's a tradeoff, but the same tradeoff being made by these mikrotik users.

There is this one the horizon though: https://up-shop.org/up-ai-edge/233-up-net-plus.html

It'd make a fine router in the same vein, no word on power usage though.

I have one running pfSense. It's never given me any trouble.

Germany (or rather DACH) has AVM, a German manufacturer that is making the "Fritz!Box" product line and supplied security updates to all affected routers they ever sold after somebody discovered and exploited a bug in the firmware to remotely call premium numbers via VoIP in various countries.

Their routers were also not affected by the KRACK WPA2 exploit last year.

AVM products cost a lot more than their competitors' but they are really worth their money.

I can agree with that, AVM Fritz!Box are also quite capable routers, the only problem I ever had was that it doesn't properly forward IPv6 ICMP.

It's 100% worth the extra cash getting an AVM over most ISP routers you get in germany.

Not affected by Krack? Is this the marketing mouth of AVM?

As KRACK is a client vulnerability, an access point shouldn't be vulnerable in the first place.

You only need to trust them for the hardware. Then install openwrt.

Ubiquiti makes great little boxes, Edgerouter Lite, Edgerouter POE and Edgerouter 4 have all served me well over the years.

They have hardware offloading for routing and iptables, will route 900Mbps, and get regular software updates.

Edgerouter Lite is $99, and draws about 5W.

Their wired hardware is okay but some is subject to some pretty embarrassing bugs that Ubiquiti is extremely slow to fix [0] and in my own experience, their support is utterly abysmal.

I would recommend buying something else.

0: https://community.ubnt.com/t5/EdgeRouter/EdgeRouter-X-SFP-le... (reported 2017-03, still alive as of 2018-08)

I bought a mini PC with 4 Gigabit Ethernet ports and Wifi, i5, 4G RAM, 32G SSD (probably way overkill for a router but I can do other stuff on it) on Aliexpress for about 250 USD and put Debian on it. I heard it works well with pfsense too.

Try OPNsense, it has hardened GUI server, and is stable as hell.

> A patch was issued earlier this year by MikroTik, however the latest statistics (above) reveal device owners and network operators have chosen not to apply it.

So MikroTik did its part.

Seems like the solution is still to see what router models are supported by your favorite aftermarket firmware.

Reply on news.ycombinator.com