Ask HN: Are there any hardware manufacturers that can be relied upon not to have big security problems?
Don't allow anonymous inbound traffic on your firewall to hit your NAS (or any other interface that you're not updating and monitoring rigorously).
If you need remote access to your NAS, install a VPN (e.g., Tailscale, ZeroTier) on the NAS or a different host on your internal network, and then access it remotely over an SSH tunnel.
I understand that the casual home user doesn't know how to install a VPN or do SSH tunneling, so they end up exposing their NAS through the firewall, and that's why these issues are widespread. But for people who are a bit more technically savvy, you can massively reduce your attack surface by denying any inbound connections through your home firewall.
In top of that this won't even really prevent this vulnerability as it can be triggered by a GET request. This means that if you are connected to the VPN any site you visit can trigger it. (If they can guess the hostname or IP)
Those should all go on their own vlan, or for a more Joe Average(tm) approach the guest network.
>laptops with malware on their network.
At that point you've got bigger fish to fry than shitty firmware, all bets are off.
I am assuming the hypothetical compromised laptop is your own, and thus assuming it contains credentials.
What credentials? Everything. All your credentials are belong to us.
At that point, the only way to defend against that is to have never trusted yourself. That's a ridiculous stance for any normal person; their home network is a trusted space.
That's why I'm saying all bets are off, you have bigger fish to fry than caring about some shitass firmware written by some third rate bank clerk in Bangladesh in a plastic box made by the finest sweatshops in China.
Personally were I in your situation, I would have individual computers for each network as needed for total and proper segregation of trust; a NAS for the home and a NAS for the public (eg: LAN party) network. I would not trust a single computer with all sorts of data to safely handle two wildly different levels of trust simultaneously like that.
I consider the home network a trusted enclave. Thus, all bets are off if a compromised laptop is in the home network. I assumed the laptop was your own as a worst case scenario (Credentials! In plain arm's reach!). If an untrusted third party laptop breached or was invited into your home network, that's not immediately as bad but the bets are still off.
Basically: I see worrying about shitass firmware when you haven't secured the network as pointless. The hypothetical situation presented was a compromised laptop in the network; forget the firmware, you need to deal with that laptop and then commence cleanup of the network first.
I fundamentally dislike "secure enclaves", since they amount to giving up at some point. You can instead meaningfully exercise "defence in depth" by trying to keep file servers secure against unauthenticated attackers, or even authenticated ones; by not running unneeded network services on your desktops; etc.
Securing one layer perfectly might be tempting, but it's much more work than securing multiple layers "well enough". In other words, "shared WPA2 WiFi + an up-to-date TrueNAS system + multiple accounts for different users" will be much less work and more practical than any network-only solution you can suggest.
A layered approach also means that you don't need to worry so much about someone else's screwups. A friend had malware on their laptop, but didn't have credentials for the NAS? Not much need to worry, maybe just change the WiFi password and you're probably fine. They had access to a limited account? Probably only the data on that account is compromised. Most times you won't even get to check logs to confirm or start some top-to-bottom "cleanup", since you'll never know this even happened.
A locked door is weaker than a stone wall, after all. You're trusting that it's safe to have a locked door than a stone wall.
If we're talking about a company, I agree. For a home, I think VPN + firewall is sufficient security against insecure management software on network devices.
>Even if it is protected outside of your local network many people have crappy IoT devices or even just laptops with malware on their network.
If there's a malicious laptop within your network, what difference does it make if your NAS has a security vulnerability? If your laptop is compromised, it's game over anyway because the attacker can steal your cookies or install a keylogger. If it's a housemate's laptop that doesn't have access to the NAS, they can do ARP poisoning[0] and MitM your NAS to steal your credentials (unless you're also vigorous about managing your own TLS CA).
>In top of that this won't even really prevent this vulnerability as it can be triggered by a GET request. This means that if you are connected to the VPN any site you visit can trigger it. (If they can guess the hostname or IP)
Other websites can trigger the behavior, but they can't read any responses because of same origin policy, so they can't exploit anything.[1]
Correction: I overlooked in the writeup that the GET request allows RCE. So, you're right is that malicious websites can exploit this despite SOP. Still, firewall + VPN reduces your risk by many orders of magnitude. Instead of the attacker trivially scanning for your device or looking it up on Shodan, they have to trick you into visiting a malicious site.
[0] https://en.wikipedia.org/wiki/ARP_spoofing
[1] https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...
All traffic to my NAS is secured, even over the local network. I don't trust the network and I don't think it should be game-over for my NAS because my housemate installs some malware. I use SSH with pinned keys and TLS (thanks Let's Encrypt).
I think if any NAS appliance doesn't provide some basic security like this it is a failing of that vendor. Even a self-signed TLS cert to provide TOFU validation would go a long way. (And actually in many ways be more secure than a public CA issued certificate.)
These measures sound good for you, but what percentage of HN readers can do that? How many threats does it eliminate in practice beyond what you'd get from basic VPN + firewall?
There's always additional security measures you can take, but the costs go up and the marginal benefits go down.
It's a bit like saying it's not sufficient for other HN users to deadbolt their doors because it's weaker than the armed guards that patrol your property 24/7.
But at the same time we are looking at a vulnerability that works through a firewall.
I am just suggesting that even in a presence of a firewall we should expect appliances to be secure on a hostile network. That is the standard we should hold vendors to. Much like Android, iOS, Windows and macOS hold themselves to this standard.
I'm also not saying that you should test this standard, defence in depth is very valuable. But I don't think saying "it is hard and a firewall solves many issues" is a good reason to forgive these vendors for shit security.
I'm advocating firewall with no inbound traffic + VPN for remote access. It mitigates most of the risk of devices on your network having security vulnerabilities.
My original comment in this thread was that it's more important to firewall + VPN your network than it is to pick a network appliance with a good security record.
I agree that there certainly are additional precautions you can take, but I think firewall + VPN defends against most practical attacks the average HN user would encounter.
Firewall + VPN is something a large proportion of HN (40%?) is capable of doing with about an hour of effort. I think it's a pretty small segment of HN that's even capable of the precautions you're talking about (separate VLANs, custom certificates, hardening every host), and it would take person-days of effort to replicate.
>But I don't think saying "it is hard and a firewall solves many issues" is a good reason to forgive these vendors for shit security.
I don't forgive vendors for shit security. I agree with you that we should hold vendors accountable. RCE on an unauthenticated GET request is absurdly incompetent and irresponsible, and D-Link deserves punishment. That said, I'm not in a position to influence D-Link, but I am in a position to help users protect themselves if appliances on their network have mistakes like this.
If you have some iot devices which phone home on the same network, then this theoretically could be a vector. It can be hard to know if that's the case.
On the more paranoid side, be sure your guest wifi can't access these devices.
1. With gadgets like this, the gadget is likely to be your firewall.
2. You are almost certainly running a sandboxed agent inside your firewall that runs untrusted code: your web browser. CSRF attacks taking over crappy devices like the devices in question are a thing.
There are a ton of remote access and update functionality in these things that make them fully exploitable even with no internet exposure.
Theyll do crazy things like VPN back to home servers, where every single device is on a flat /8 with no additional security. So anyone who dumps the VPN keys from one is basically on your eth.
Or update unsigned firmware from domains that end up abandoned and left hanging
Etc etc
By the problems all go away, I meant the problems associated with a network appliance handling malicious input that leads to a security issue. If the device isn't exposed to the Internet, it can't bungle malicious input.
>Theyll do crazy things like VPN back to home servers, where every single device is on a flat /8 with no additional security. So anyone who dumps the VPN keys from one is basically on your eth. > >Or update unsigned firmware from domains that end up abandoned and left hanging
Are there cases of that happening with products that have wide usage? Like 1M+ devices in the field?
The only time I can recall hearing of anything like that, was for a very small time vendor.[0]
Every security vulnerability I've heard about around NAS devices required the device to be exposed to the public Internet or for the attacker to be on the same local network as the vulnerable device.
I’ll see if I can drag up some references, a quick google doesn’t show what I’m looking for.
The best option however, is to find a recent MediaTek-based (because they are currently the most upstream-friendly WiFi AP SoC vendor) home router with vulnerable firmware (for easier flash lol) and replace the firmware with OpenWRT.
For NAS just build your own, or buy used rack-mount servers off eBay and leave them in basement.
Cisco have had some doozies but overall aren’t terrible.
Everything else is probably bad.
Bob: I hope everyone had a good weekend. I’d like to start out by giving some kudos to Fred and Jane for the D-Link NAS back door!
A round of polite clapping.
Bob: Let’s start with Igor, how's it going?
Igor: Bah, my target is running web server on Commodore 64 so I spend all weekend to write 6502 remote exploit for Contiki OS. Unfortunately, I found out target keeps secrets on ZX81 but I don’t know Z80 assembly.
Bob: Fortunately we’re a state sponsored hacking organization so we have considerable resources. Federico, do you think you could give Igor a hand?
Federico: Certamente!
The key term here is *hardware manufacturers*.
They have no financial incentive to worry too much about software. The solution to every problem is to buy new hardware. Software bugs are just added incentive.