Bad UI Design Sabotages Security of ASUS SoHo Routers

[CiscoX]

Information from HardwareZone by ngbc

All 'RT' router affected
http://news.softpedia.com/news/bad-ui-design-sabotages-security-of-asus-soho-routers-500330.shtml

http://www.securityforrealpeople.com/2016/02/poor-ux-leads-to-poorly-secured-soho.html

 

[Nullity]

tl;dr

The firewall must be enabled to block WAN access to administrative router services like SSH & HTTP(S).

With the firewall disabled, outside hosts will not be blocked. Seems obvious to me, but I suppose the GUI should note that you cannot block without the firewall.

 

[RMerlin]

That's another alarmist report. Because if you disable that firewall, you are exposing MUCH MORE than just your router's webui... Like, uh, your whole LAN.

"Sabotage"? Some wannabe security experts need to get a life, quite bluntly.

 

[CiscoX]

That's another alarmist report. Because if you disable that firewall, you are exposing MUCH MORE than just your router's webui... Like, uh, your whole LAN.

"Sabotage"? Some wannabe security experts need to get a life, quite bluntly.

hehe

 

[sfx2000]

That's another alarmist report. Because if you disable that firewall, you are exposing MUCH MORE than just your router's webui... Like, uh, your whole LAN.

"Sabotage"? Some wannabe security experts need to get a life, quite bluntly.

I would tend to agree - it's more a UI/UX glitch than a serious issue - but it also points out how much Asus has built on top of an aging code base, and that code base is getting more and more brittle as they add/remove features over time and models...

Also that as our homes/cars/business/bodies are ever more connected to the internet, it's very important to do it not only in the right way as a technology, but also to ensure that users don't accidentally expose themselves thru different, and seemingly unrelated, features.

 

[RMerlin]

I would tend to agree - it's more a UI/UX glitch than a serious issue - but it also points out how much Asus has built on top of an aging code base, and that code base is getting more and more brittle as they add/remove features over time and models...

Also that as our homes/cars/business/bodies are ever more connected to the internet, it's very important to do it not only in the right way as a technology, but also to ensure that users don't accidentally expose themselves thru different, and seemingly unrelated, features.

Well, you know the saying: if you make it idiot proof, nature will build a better idiot

You could add a large popup warning when you disable the firewall that "This will expose your entire LAN AND ROUTER to the rest of the world, including nasty buggers who love nothing more than to install malwares everywhere they can! Are you really, REALLY, REALLY sure you want to do this, from the bottom of your heart, and commit yourself body and soul to helping make the world a worse place for people to live in?". And I bet a large portion would just click on "Yes" out of reflex, without reading it

 

[sfx2000]

Well, you know the saying: if you make it idiot proof, nature will build a better idiot

And they seem to get better every day

It would be interesting to do some analysis/analytics on commonly used settings - and then move the others into an advanced/pro menu - even here, a majority of users likely use 20 percent of the features exposed in most consumer grade router/AP's - it's the 80 percent of functionality that gets users into trouble as they can impact security or functionality of the device in a less than positive manner...

The challenge here then is everyone uses a different 20 percent (the MSWord toolbar/feature issue...) - but I would be perfectly ok with a dumbed down WebUI, and then advanced functionality via SSH into a menu'ed interface with an option to go right to the shell, where everything can be tweaked...

 

[Nullity]

And they seem to get better every day

It would be interesting to do some analysis/analytics on commonly used settings - and then move the others into an advanced/pro menu - even here, a majority of users likely use 20 percent of the features exposed in most consumer grade router/AP's - it's the 80 percent of functionality that gets users into trouble as they can impact security or functionality of the device in a less than positive manner...

The challenge here then is everyone uses a different 20 percent (the MSWord toolbar/feature issue...) - but I would be perfectly ok with a dumbed down WebUI, and then advanced functionality via SSH into a menu'ed interface with an option to go right to the shell, where everything can be tweaked...

I think the article does have a valid complaint. The toggle logic needs to be fixed. It is just too bad the author felt the need to aggrandize his painfully simple observation.

Turning off the firewall is...

 

[System Error Message]

in routerOS if you dont protect the router with the firewall the router can get swamped by DoS. Cant you change the IPTables settings to include the listen interface/IP and deny from other interfaces/IP?

 

[RMerlin]

in routerOS if you dont protect the router with the firewall the router can get swamped by DoS. Cant you change the IPTables settings to include the listen interface/IP and deny from other interfaces/IP?

A better "solution" would be for httpd to stop binding to all interfaces, and only bind to the specific interfaces it's supposed to be listening on. That would be just good security practice.

 

[System Error Message]

A better "solution" would be for httpd to stop binding to all interfaces, and only bind to the specific interfaces it's supposed to be listening on. That would be just good security practice.

Are you able to do that? Can httpd be binded to a physical interface?

 

[RMerlin]

Are you able t.o do that? Can httpd be binded to a physical interface?

No idea, I never really looked at that part of the code. My main worry is that things can get tricky with some users using Dual WAN and VLANs, all scenarios which I cannot realistically test without devoting more time than I'm willing to.

This would be only one of many architecture issues in Asuswrt (and the Tomato code it was originally based on), and taking care of these would require too much changes all over the place, it would make it impossible to keep in sync with Asus's own codebase afterward.

Personally I consider this to be a non-issue, as disabling the firewall makes no sense anyway unless you were troubleshooting something.

 

[RMerlin]

And anyway in this specific case, Asus has already taken steps to mitigate/resolve the potential risk, so no need for me to devote any resource to this case.

 

[System Error Message]

Thats good than, so we can still rely on asus as being something decent unlike linksys, dlink and tp-link. I wonder if tp-link has updated their firmwares with updated libraries since people posted their outdated security.

 

[jegesq]

...Personally I consider this to be a non-issue, as disabling the firewall makes no sense anyway unless you were troubleshooting something.

Other than perhaps in a testing environment, why would one ever turn off the firewall? The RT models that the "security" guy with his hair on fire is writing about, are, for the most part, not targeted for professionals, but for consumers. So why not just remove the ability of consumers to disable the firewall from the GUI entirely, and take the "better idiot" scenario out of the equation entirely?

 

[L&LD]

Other than perhaps in a testing environment, why would one ever turn off the firewall? RT's are, for the most part, not designed for professionals, but for consumers. So why not just remove the ability to disable the firewall from the GUI entirely, and take the "better idiot" out of the equation entirely?

Better to leave that option in for the people that can use it wisely.

The 'better idiot' will still be born the second that option is removed.

 

[Nullity]

Better to leave that option in for the people that can use it wisely.

What good reasons are there for disabling the firewall?

I think my RT-N66U has the firewall disabled, but only as a side-effect of having it in AP mode.

 

[L&LD]

What good reasons are there for disabling the firewall?

I think my RT-N66U has the firewall disabled, but only as a side-effect of having it in AP mode.

In a multi router setup, of course.

 

[jegesq]

In a multi router setup, of course.

Not even then,IMHO. No danger running multiple hardware firewalls in that scenario, and no reason to disable them either.

 

[RMerlin]

The only potential setup I can think of would be someone who just wants to route two separate segments within his LAN, and does not need to isolate the segments - just route them together, without NAT. But that's not something I'd expect to see in a home network unless someone went out of his way to create a weird topology.