• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

HUGE exploit in Netgear Nighthawk and other routers, accessed by browsing the web

Status
Not open for further replies.
M

marc^o^

Nintendo's Pro Bono PR Firm
Marty Chinn said:
They wouldn't. They gain access by you going to a website. When you connect to that website, it can then send commands via that exploit to your router and gain access. So they don't come to you, you go to them without realizing it because all you did was browse the web.
Click to expand...
I see, what kind of trap site would that be though?
 
T

Timedog

good credit (by proxy)
This is the post where I act like people are idiots for expecting their router to function with its included firmware.
 
S

SwiftDeath

Member
Wow Netgears lack of initial response and current response are terrible

Netgear couldn't even be bothered to respond to the guy and say "We got this, give us X time to fix it"

Rollins handled this well
 
C

clav

Member
tim.mbp said:
Guess I'll try out dd-wrt on my R6400 later tonight.
Click to expand...

For those of you interested in DD-WRT, KONG releases are consistently decent.

Like every DD-WRT public release though, scan the DD-WRT forums before installing. Have a USB to TTL cable ready in case of brick.
 
P

pestul

Member
CDX said:
People have a router capable of putting DD-WRT, Tomato, or Open-WRT or some other firmware on it, BUT they just keep the manufactures firmware on it?

I find that odd, because It seems like in my circle of friends, nearly everybody has one of those firmwares listed above on their router.

But I guess now that I think about it, it shouldn't be odd that most will just stick with whatever firmware the manufacturer gives them. That's probably what the vast majority do.
Click to expand...
Some routers are incapable of maximum throughput with 3rd party firmware. I had a Cisco router that actually couldn't deliver my full Fibre potential from the ISP and I had to use one of Cisco's firmware. Not all routers are like this obviously, but there are some justifications for not using Open Source.

I have an Archer router that I love currently.
 
V

ViciousDS

Banned
SwiftDeath said:
Wow Netgears lack of initial response and current response are terrible

Netgear couldn't even be bothered to respond to the guy and say "We got this, give us X time to fix it"

Rollins handled this well
Click to expand...

Yes, I'm looking at an archer C5400 right at this moment. The lack of response means....I'm not buying from you anymore. I left the stock firmware on there because I had absolutely no issues with it.

I mostly run merlin on my asus routers and even had XWRT on my R7000 for a long time before reverting.
 
B

Belker

Member
jstripes said:
Does your circle of friends happen to be tech savvy?

I think this is accurate. THere's also a bit of crossover with people like me, that know enough to be able to update a device using the manufacturer's firmware & instructions, but who don't know about third-party options such as this DD-WRT that's being discussed. It's partially caution, partially lack of experience and knowledge, but I'm uneasy trying to update anything with non-official firmware.
Click to expand...
 
T

TheCochese

Banned
Just updated, it was trivial to do. Shame on the lack of a speedy production update.

I still with the stock Netgear software because it does what I need it to. I've loaded DD-WRT on a number of other devices, but haven't needed to on the two Netgear products I own.
 
V

ViciousDS

Banned
Belker said:
jstripes said:
Does your circle of friends happen to be tech savvy?

I think this is accurate. THere's also a bit of crossover with people like me, that know enough to be able to update a device using the manufacturer's firmware & instructions, but who don't know about third-party options such as this DD-WRT that's being discussed. It's partially caution, partially lack of experience and knowledge, but I'm uneasy trying to update anything with non-official firmware.
Click to expand...

XWRT is the easiest firmware to install......you browse the file like any normal update and hit install. It doesn't require recovery mode or anything to be done. dumping the ram all that stuff isn't needed. It's probably the easiest alternative



always backup before installing or attempting firmware updates though
Click to expand...
 
M

mike6467

Member
CDX said:
People have a router capable of putting DD-WRT, Tomato, or Open-WRT or some other firmware on it, BUT they just keep the manufactures firmware on it?

I find that odd, because It seems like in my circle of friends, nearly everybody has one of those firmwares listed above on their router.

But I guess now that I think about it, it shouldn't be odd that most will just stick with whatever firmware the manufacturer gives them. That's probably what the vast majority do.
Click to expand...

Yeah, I mean once I finally managed to get my family to understand why putting a security key on their networks was important, the next step was a full on, third party, firmware update.

I'm sorry, I'm just bitter because I have two of the routers in this list...
 
S

show me your skeleton

Member
just after a bunch of zyxels were exploited crippling tens if not hundreds of thousands of users.

virgin media use netgear, any idea what model?

edit: okay their forum states the netgear-made router isn't affected.
 
C

clav

Member
Rebel Leader said:
why should people use dd-wrt?
Click to expand...

Usually updates to the latest Linux kernel (more security patches) although it does have minor bugs like LEDs not lighting up when certain settings are not selected. You also lose hardware acceleration which is important to user who have really fast connections.

Web Interface is somewhat better than it was many years ago although still clunky. You should probably stick to Rmerlin or Tomato if that's what you prefer although these firmwares are stuck on very old Linux kernels due to drivers.

DD-WRT/OpenWRT tend to be up to date. Former is for everyone. The later is for people willing to learn.

If you need fast speeds for home use, you should build yourself a pfsense router.

People were laughing at Google for entering the router business. Problem is that a lot of current routers don't update themselves.
 
F

FunkyMunkey

Banned
CDX said:
People have a router capable of putting DD-WRT, Tomato, or Open-WRT or some other firmware on it, BUT they just keep the manufactures firmware on it?

I find that odd, because It seems like in my circle of friends, nearly everybody has one of those firmwares listed above on their router.

But I guess now that I think about it, it shouldn't be odd that most will just stick with whatever firmware the manufacturer gives them. That's probably what the vast majority do.
Click to expand...

this is classic echo chamber. the vast majority of people aren't going to have anything but what it came with on it and a huge chunk of them probably don't even know what firmware is
 
R

rawd

Member
claviertekky said:
Usually updates to the latest Linux kernel (more security patches) although it does have minor bugs like LEDs not lighting up when certain settings are not selected. You also lose hardware acceleration which is important to user who have really fast connections.

Web Interface is somewhat better than it was many years ago although still clunky. You should probably stick to Rmerlin or Tomato if that's what you prefer although these firmwares are stuck on very old Linux kernels due to drivers.

DD-WRT/OpenWRT tend to be up to date. Former is for everyone. The later is people willing to learn.

If you need fast speeds for home use, you should build yourself a pfsense router.

People were laughing at Google for entering the router business. Problem is that a lot of current routers don't update themselves.
Click to expand...

+ customized VPN routing
 
S

Sweeney Tom

Banned
Glad I listened to the people saying Netgear was trash and didn't buy any of their products on Black Friday week. Thanks friends
 
N

Neo_Geo

Banned
newshinycd said:
Ha. I bought a new router last year, and I got some shit from coworkers because I went with an Asus router instead of Nighthawk.
Looks like they'll be eating crow tonight.
Click to expand...

Owned several Asus routers, went back to Netgear recently. I will go anywhere else except for Asus when I ever go with another manufacturer.
 
M

mike6467

Member
TheCochese said:
Just updated, it was trivial to do. Shame on the lack of a speedy production update.

I still with the stock Netgear software because it does what I need it to. I've loaded DD-WRT on a number of other devices, but haven't needed to on the two Netgear products I own.
Click to expand...

Did this wipe your existing information? I've got a PPPoE password I would need to call my ISP to verify if that's the case.

Edit: In case anyone else is curious. I called and got my PPPoE credentials then proceeded to update to the beta firmware. The update was super simple, I didn't need them, it kept my information and took about 5 minutes total.

Edit 2: This is an R7000
 
M

Marty Chinn

Member
Sweeney Tom said:
Glad I listened to the people saying Netgear was trash and didn't buy any of their products on Black Friday week. Thanks friends
Click to expand...

The thing is the Nighthawk routers aren't trash. They're quality devices that a lot of people here on GAF use and highly recommend. I think Netgear handled this poorly, but the router itself is pretty good quality hardware, exploit aside of course.
 
M

mike6467

Member
TheCochese said:
I don't have that need, so I don't know. I can't recall any custom settings when I set it up.
Click to expand...

Gotcha, thanks for the response. Trying to avoid a lengthy call if possible, I haven't had great experience with the first tier tech support, so I may be looking at an hour or more to get a password. Thanks Netgear...I really should write these things down...
 
M

mackattk

Member
It is pretty scary thinking about the amount of people out there who have never touched the routers or upgraded their firmware.

Most probably just hook it up and use the default password listed on the bottom of the router or wherever... some might change the ssid/password but after that it would basically be left untouched.
 
L

Lv99 Slacker

Member
Aaand this is why I wish I knew how to build and set up a pfSense router. If anyone here lives in Austin TX, hit me up. I'm really interested in building one.
 
S

Septimus Prime

Member
newshinycd said:
Ha. I bought a new router last year, and I got some shit from coworkers because I went with an Asus router instead of Nighthawk.
Looks like they'll be eating crow tonight.
Click to expand...
I like Asus routers a lot, too, but they also have some security flaws. You should probably get least change the firmware to Merlin (which is basically the regular Asus firmware with vulnerabilities patched).
 
T

TheBryanJZX90

Member
Lol this story freaked me out, and then I freaked my wife out, until I went through my Amazon orders to confirm that our router is one of the affected ones, and I saw that we actually have an Asus. Oops!
 
S

SoRuffShoNuff

Member
CDX said:
People have a router capable of putting DD-WRT, Tomato, or Open-WRT or some other firmware on it, BUT they just keep the manufactures firmware on it?

I find that odd, because It seems like in my circle of friends, nearly everybody has one of those firmwares listed above on their router.

But I guess now that I think about it, it shouldn't be odd that most will just stick with whatever firmware the manufacturer gives them. That's probably what the vast majority do.
Click to expand...

Most people have never even heard of the firmware you listed.
 
B

bionic77

Member
Sweeney Tom said:
Glad I listened to the people saying Netgear was trash and didn't buy any of their products on Black Friday week. Thanks friends
Click to expand...
I have a nighthawk that has been up for 2 years and it has never dropped a single connection and covers every single foot of 4K sq foot house including the basement.

This is definitely horrible but the hardware on the routers is great.

I updated the firmware. I think I am ok. Not sure how to check my Macs or phones to see if anything was corrupted but I would assume it would still ask for the password to make any real changes. No idea about the phones...
 
T

thelatestmodel

Junior, please.
One (1) Giant Size Novelty Sexual Device said:
Wait, wait, wait. People own Netgear routers and don't use dd-wrt?
Click to expand...

CDX said:
People have a router capable of putting DD-WRT, Tomato, or Open-WRT or some other firmware on it, BUT they just keep the manufactures firmware on it?
Click to expand...

Timedog said:
This is the post where I act like people are idiots for expecting their router to function with its included firmware.
Click to expand...

Oh come on, people don't even think this is a thing you have to worry about. Stop acting like people are idiots for using stock firmware.
 
L

LCGeek

formerly sane
thelatestmodel said:
Oh come on, people don't even think this is a thing you have to worry about. Stop acting like people are idiots for using stock firmware.
Click to expand...

Unless it's a good one they are. Plenty have people have talked about basic performance, stability and utility benefits. I don't also expect most people to change their firmware savvy users should though.
 
Ploid 3.0

Ploid 3.0

Member
thelatestmodel said:
Oh come on, people don't even think this is a thing you have to worry about. Stop acting like people are idiots for using stock firmware.
Click to expand...

I looked into it, I was just scared of messing up the router. Seems like mine can use DD WRT and I'm still being extra careful about it. I will install it as I have a backup router in case things go wrong, it's just that this one is better and newer.
 
S

Suikoguy

I whinny my fervor lowly, for his length is not as great as those of the Hylian war stallions
This is a huge problem.

How many people actually update the firmware on their router?

So, even if they release an update, how many will actually be updated?
 
R

RedRooster

Member
This might finally be the push I need to switch to advancedtomato. Anyone use that firmware on a R7000? Are the LAN speeds still good?
 
G

garath

Member
Yep. I've got the R7000. Got it for a big discount black Friday to replace my malfunctioning Asus router.

Will install the beta firmware tonight and explore ddwrt this weekend when I have more time.

Thanks for the heads up. Disappointing.
 
T

TheOMan

Tagged as I see fit
Ploid 3.0 said:
I looked into it, I was just scared of messing up the router. Seems like mine can use DD WRT and I'm still being extra careful about it. I will install it as I have a backup router in case things go wrong, it's just that this one is better and newer.
Click to expand...

Can you not do a firmware backup?

Suikoguy said:
This is a huge problem.

How many people actually update the firmware on their router?

So, even if they release an update, how many will actually be updated?
Click to expand...

Very few, for sure. And OTA updates would probably be pretty inconvenient here, but if they can find a way to do it, Netgear should probably bite the bullet and do so now that this is public knowledge.
 
Status
Not open for further replies.

Similar threads

  • Locked
Netgear router security vulnerability
1
2K
Nilaul replied
Top Bottom