A little while ago I mentioned finding curious URLs in a table of voice-configuration data in a modem-router-firewall product which is widely distributed for NBN FTTN connections. These URLs linked to a Swiss network and had no plausibly valid existence. The supplier claims they're harmless without specifying how they reached that conclusion, but they obviously suggest a potential security issue.
The Wikipedia entry for Netgear - https://en.wikipedia.org/wiki/Netgear - states: QUOTE Various Netgear products that were manufactured by SerComm were found to contain a backdoor that allowed unauthorized remote access to the affected devices.[6] Netgear, along with other companies with products manufactured by SerComm that were affected by the aforementioned backdoor issued firmware updates for some of the affected products, but it was shortly found that the updates merely hid the backdoor but did not remove it.[7] On January, 2017, various Netgear products were found to be vulnerable to an exploit that allows a third party to access the router and the internal network and turn the router into a botnet.[8] UNQUOTE The Wikipedia entry for D-Link - https://en.wikipedia.org/wiki/D-Link - has a section on vulnerabilities which finishes: QUOTE On January 5, 2017, the Federal Trade Commission sued D-Link for failing to take reasonable steps to secure their routers and IP cameras. As D-Link marketing was misleading customers into believing their products were secure. The complaint also says security gaps could allow hackers to watch and record people on their D-Link cameras without their knowledge, target them for theft, or record private conversations.[11] D-Link has denied these accusations and has enlisted Cause of Action Institute to file a motion against the FTC for their "baseless" charges.[12] UNQUOTE To cut a long story short, I haven't been able to identify any domestic or small-business modem-router-firewall product without some suspicion of security issues. ISPs want cheap products which, in the main, probably means ones made at least partly in China outside Australian control. Surely there's a problem here? Is the whole NBN network at the mercy of any supplier with something to sell? Will we find Australia's computers are wide open to unknown, probably national, actors at will? Why haven't DSD been asked to become involved? Can any Linker suggest a product which appears to be reasonably secure? Or is this a non-issue? David L. _______________________________________________ Link mailing list [email protected] http://mailman.anu.edu.au/mailman/listinfo/link
