[flagged]
Blocking updates seems useful for blocking malicious and helpful updates. I wonder which camp the majority of updates fall into.
If you did want to go this route, a simple fix would be to have the write enable line gated by a hardware one-shot timer (think like a 555 timer) triggered by a physical button on the front (and the button would also reboot the router).
The firmware update sequence would go like: Router prompts user to update using button -> user presses update button -> router reboots to clear malicious software -> when the router comes back up, the write enable gate remains open for $n minutes (and maybe there's a GPIO that can hold the gate open if it is already open) -> router performs software update.
The problem is that there's pretty much no way to do this without adding a $1-2 to the BOM, and no manufacturer of (pro|con)sumer routers will do that.
Edit: Or do what stacktrust wrote and just have a toggle switch (update/secure).
Consumer grade routers often have automatic updates these days.
Some motherboards offer a physical jumper for firmware updates, including x86 PC Engines APU2 coreboot router.
A read-only partition can bootstrap recovery from cloud, if the main firmware or config is damaged.
Some updates are possible with live kernel patching of the memory-resident OS, which can also be used by malware.
Many router malware families don't even try to be persistent. Even Mirai - arguably the most famous router botnet - is not persistent [1]. In case the device is rebooted, it just gets infected again in a few minutes.
It's very important that all network connected devices have an update mechanism, working automatically in the background.
[1] At least the original version. After the code leak people were doing all kinds of updates, so there are some variants that try to be persistent in some cases.
Can Suricata detect and block known router botnets?
In any case, you can have a separate storage (you need less than 1KB) for these two things.
edit they also come with a QR code you can scan on your phone to connect to the wifi without manually copy the password, so people just put up that qr code somewhere and connecting is easy enough.
They're sent back to the manufacturer and the boards are replaced.
"internet doesn't work" -> "send me a new router, it broke", problem solved.
Would they be sent back or would an engineer travel to wherever stuff is stored to do the job?
The labor is cheap, the boards are expensive as hell.
https://learn.microsoft.com/en-us/windows/iot/iot-enterprise...
> Unified Write Filter (UWF) is an optional Windows 10 feature that helps to protect your drives by intercepting and redirecting any writes to the drive (app installations, settings changes, saved data) to a virtual overlay. The virtual overlay is a temporary location that is cleared during a reboot or when a guest user logs off.. Increases security and reliability where new apps aren't frequently added. Can be used to reduce wear on solid-state drives and other write-sensitive media. Optimizing Application load timing on boot – it can be faster to resume from a HORM file on every boot rather than reloading the system on each boot. UWF replaces the Windows 7 Enhanced Write Filter (EWF) and the File Based Write Filter (FBWF).