WyzGuys Tech Talk

We recently reviewed the bad state of affairs in the world of edge devices, routers, cable and DSL modems, and wireless access points.  I just read an article on CSO the talked about the dangers that exist with the routers that router traffic and basically run the Internet.  The problem is that these routers are running a Linux kernel in their core that is six or seven version old, and vulnerable to exploits that otherwise would not work on a properly patched and up to date computer or server.

And lots of routers are just plain old, which makes the problems worse.  Updates, if they exist at all, require the router to be taken out of service to install.  So lots of don’t get patched.  And we are not just talking about edge routers, but also routers in the core of the Internet, run by telcos and Internet service providers.

Even if we took all these outdated routers out of service and replaced them with new routers, we would still have basically the same problem.  Routers are not designed with the same level of security in mind as computers and servers.  And so they add to the legions of non-computer Internet-connected devices (the Internet of Things or IoT) that are open to exploitation.

The computing power at the heart of these routers may not be too impressive compared to a computer of the same vintage, but the processors, RAM, storage, and other capabilities built into routers are many times better than the computers we had ten or twenty year ago, and those computers were good enough to start a revolution.  In the hands of a skilled hacker or criminal exploiter, a router could be converted into an attack platform that could be used to pivot into a network and exploit other more valuable systems.

I like to finish up these posts with a solution, or at least some advice or good ideas or practices.  In this case, there is nothing that you or I can do to protect ourselves from the inherent weaknesses in the routers that our computers connect to.  We have to hope that manufacturers of these devices will recognize that times have changes, and security needs to be baked in the design from the design stage, through manufacturing, installation, and hopefully, with a mechanism in place to keep them secure for their expected useful life.

Of course we can do what we always do as consumers, and vote with our dollars.  A properly designed secure router will cost more, and in this case, it is worth the extra money.