Hacker News Reader

Comment by satanspastaroll | Hacker News Reader

This change is a firmware update that was likely automatically installed on unaware customers equipment. Very shady.

They claim this is to "gather crashes and other critical events strictly for the purpose of improving our products", but to be honest; how often does that happen in routers? They are very barebone anyway, and were there to be any issues, they would be notified by the customer.

Having it forced with no way to opt-out is also an indication of hostility. They claim they will release a firmware update without telemetry, but no dates have been set.

View on HN

Wireless modems and routers were one of the more problematic pieces of tech in peoples lives. You used to have to reboot that stuff constantly. If theres any device that I want sending crash logs back to make the firmware better, its a router.

What piece of non mobile/pc tech do you run firmware upgrades on more often than a router?

Once I flashed my router with tomato I never had any problems with it again. It just works and needs nothing. Now that I set up a pi-hole I have to worry a lot less about telemetry from TVs and rogue devices.

Good technology doesn't need to be updated all the time.

Do you know if the ancient Linux kernel on your router has any security issues?

Do you receive any notification if there's ever an issue found? Is there even a centralised tracker for security issues affecting the router software?

Sometimes, things need to be updated. And consumers can't be bothered to flash a firmware image.

It's a home router, who cares. Chances are any security issue it has can only be realistically exploited on the local network. Is it really worth the trouble of constant software updates to bother to prevent? I don't think it is.

It's not that easy:

There could be a XSS vulnerability in the management interface.

There could be a vulnerability in any component which is internet facing.

The router is handling packets. There might be a vulnerability in that logic allowing for maliciously crafted packets (in the answer of a request).

There -could- be a lot of things. Pfsense and ddwrt were some of the very first router software packages to address DNS rebind attacks.

I think saying tomato is more secure and refined than some router that updates itself constantly to secretly bait and switch the user's expectations is an understatement.

> There could be a XSS vulnerability in the management interface.

Surely you aren't exposing that interface to the world at large, right?

If you click the wrong link while youre on the lan side.

Of all the devices in a house, a router should be the most important to keep up to date.

Pfsense and ddwrt were some of the first router software packages to fix DNS rebind attacks if that's what you are talking about.

If it is not, you will have to explain exactly the vulnerability works.

A link can also have an IP address as host. Many routers come with 192.168.1.1 preconfigured. With Javascript enabled you could also probe the network and craft a fitting link.

Preventing DNS rebind attacks closes only one avenue.

How would that work exactly and how would it be router insecurity?

Providing updates with a switch to opt out would be no problem to me. However they seem to be pushing the update without notice or consent, without a way to disable telemetry or automatic updates.

They have a workaround until the firmware updated. You just need to put a firewall rule to block the url they are sending crash data to.

I have so many other devices that are snooping and constantly sending data (phones) that I don’t really care about my USG sending crash data.

I think commercial routers have a different standard to be held up to than consumer phones and iot devices.

The workaround is really lame and and blocks all traffic to the data leak domains.

I don’t want to send crash data. I also don’t trust a non-open source, non-documented, non-auditable submission of data from my network to theirs. They claim it’s only crash data, but I don’t know. They can also change it at any time as they’ve lost my trust by adding data leaks to a firmware update I accepted without knowing it.

You can just block any connection from the access points to the internet. They can connect to the controller and that's all the access they get. Access points have no need to connect to or be accessible from the outside world.

Ok. I get that it is best practice to give devices the least amount of access they need. But why does being able to block traffic make it okay that Ubiquity enables telemetry like this, without informed consent?

Your post has made it quite apparent that you have no experience managing these devices in a real world scenario.

>automatically installed on unaware customers equipment.

No.

>they claim this is to "gather crashes and other critical events strictly for the purpose of improving our products", but to be honest; how often does that happen in routers?

Also apparent you have not used their IPv6 stack nor their fq_codel implementation.

>Having it forced with no way to opt-out is also an indication of hostility. They claim they will release a firmware update without telemetry, but no dates have been set.

This move certainly made me scratch my head a little. Especially when Ubiquiti should know their customer base would be less than thrilled.

The article doesn't list which product lines are impacted, but as far as my experience goes with UniFi stuff, it doesn't auto update by default. You can turn it on in the controller but even that is unreliable at best (and not recommended, as the updates can sometimes be touchy - not to mention that the gear is offline during the update)

Have you owned or managed any ubiquiti hardware? The firmware is updated monthly, and there's always a detailed changlog.

Reply on news.ycombinator.com