Expert Comments

Expert Advise on Home Routers Largely Unpatched

Expert(s): Security Experts
Expert(s): Security Experts

Employers who have suddenly shifted a large percentage of their workforce to remote due to Covid-19 no doubt will shudder by the findings of a new Frauhofer Institute study that concluded no home router was without security vulnerabilities. The German tech think tank analyzed 127 home routers from seven manufacturers sold in Europe and found that 46 of them hadn’t a security update within 12 months, and some hadn’t been updated for more than five years. The lion’s share (91 percent) of the routers use Linux OS, but many manufacturers don’t integrate fixes when they’re available from Linux kernel maintainers. Vendors can distribute security patches to their devices far more often, but do not, Fraunhofer found, and to make matters even worse, many of the routers are powered by a very old version of Linux.

Experts Comments

July 07, 2020
James MacQuiggan
Security Awareness Advocate
KnowBe4
As consumers, people consider their home routers, computers, and other electronic devices like their oven, dishwasher, and refrigerator, to be able to just plug them in and run. They only look at them when there is a problem. With home routers, people buy them, install them, and maybe configure them with a new password, but for the most part, as long as it's running, they don't mess with it. Similar to smartphones or computers, these devices need to be updated to reduce an opportunity for.....Read More
As consumers, people consider their home routers, computers, and other electronic devices like their oven, dishwasher, and refrigerator, to be able to just plug them in and run. They only look at them when there is a problem. With home routers, people buy them, install them, and maybe configure them with a new password, but for the most part, as long as it's running, they don't mess with it. Similar to smartphones or computers, these devices need to be updated to reduce an opportunity for exploitation by cybercriminals. Unfortunately, with legacy devices, the products may no longer be supported, and therefore the router should be replaced. If the router is a later model, it's essential that people register their router with the manufacturer so they can receive notifications to update the device. If registration is a privacy concern for the person, then visiting the manufacturer's website on a regular basis for updates would be the best option. Comparable to vehicle recalls, the manufacturer alerts the owner that there is an issue with their car, which needs to be corrected. If the person fails to bring in the car, they could be liable for matters in the event of it causing an accident. Similar to the router issues, if the owner doesn't update the router when notified, they could be exposed to vulnerabilities that could have been corrected before a possible data loss, ransomware attack, or worse, identity theft.  Read Less
July 07, 2020
Kiri Addison
Head of Data Science for Threat Intelligence and Overwatch
Mimecast
These findings are particularly worrying as the COVID-19 pandemic means that many employees are working from home and connecting corporate devices to their home router. This obviously provides greater opportunity for sensitive corporate data to be lost or stolen by nefarious actors. The manufacturers of these devices need to rapidly improve the security of their products and ensure that patches for known vulnerabilities are developed and made available through updates. This will likely require.....Read More
These findings are particularly worrying as the COVID-19 pandemic means that many employees are working from home and connecting corporate devices to their home router. This obviously provides greater opportunity for sensitive corporate data to be lost or stolen by nefarious actors. The manufacturers of these devices need to rapidly improve the security of their products and ensure that patches for known vulnerabilities are developed and made available through updates. This will likely require the enforcement of legislation, such as the IoT legislation recently proposed by the UK government. It is also vital that people understand that these routers need regular patching and must be registered with the manufacturer to receive these updates when available, which can help keep them secure. This is important cyber-awareness and it is the role of organisations to educate their workforce on this. According to our State of Email Security report, despite this increased threat, over half of organisations – 55% – don't provide any sort of email security training on a frequent basis. This needs to be improved, or vulnerabilities such as this one will lead to further security problems for UK organisations.  Read Less
July 07, 2020
Craig Young
Principal Security Researcher
Tripwire
I’m absolutely stunned that they would assess that Netgear and ASUS do a better job than others. Overall I have some questions about how they selected the ‘127 current routers’. The research specifically cites Linksys WRT54GL despite that it’s been out of support for years. I’m not sure how relevant it is to be comparing this router to currently supported devices from other brands. The metrics used by the research included days since the last update, the use of outdated software,.....Read More
I’m absolutely stunned that they would assess that Netgear and ASUS do a better job than others. Overall I have some questions about how they selected the ‘127 current routers’. The research specifically cites Linksys WRT54GL despite that it’s been out of support for years. I’m not sure how relevant it is to be comparing this router to currently supported devices from other brands. The metrics used by the research included days since the last update, the use of outdated software, the inclusion of private keys, hardcoded passwords, and exploit mitigations. While these are all interesting data points, there is a lot more that goes into security. A router vendor can keep their Linux kernel up to date and enable all the exploit mitigations they want, but it isn’t going to matter if the device still allows command injection by a cross-site request forgery. Similarly, a vendor can release updates on a regular basis but still ignore security researchers. A more complete picture of vendor security reliability should include aspects related to how well the vendor works with researchers and the typical response time for resolving externally reported issues.  Read Less

Submit Your Expert Comments

What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.

Write Your Expert Comments *
Your Registered Email *
Notification Email (If different from your registered email)
* By using this form you agree with the storage and handling of your data by this web site.
SUBMIT

You may also like

Panasonic Becomes Latest Victim Of Data Breach – Security Expert...

Clearview’s £17 Million Fine For Processing 10+ Billion Images Is...

Booz Allen Report On CISOs And China Quantum Computing Risks,...

Experts Reactions On Sky Broadband Hack Warning

Ransomware Set To Break Records This Black Friday 2021

Security Expert On Apple Suing NSO Group

Meta Delays Plans To Rollout End-to-end Encryption

NCSC Issues Black Friday Warning To Tetailers

How The Zelle Fraud Scam Steals Your Bank Credentials

GoDaddy Data Breach Impacts Over A Million Users, Experts Reactions

Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics

Twitter Facebook-f Linkedin Youtube

Working With Us

The Pages

Our Contributing Experts