Germany's Fraunhofer Institute for Communication (FKIE) has carried out a study involving 127 home routers from seven brands to check for the presence of known security vulnerabilities in the latest firmware. The results are appalling.
The FKIE study found that 46 routers hadn't got a single security update within the past year and that many routers are affected by hundreds of known vulnerabilities.
It also found that vendors are shipping firmware updates without fixing known vulnerabilities, meaning that even if a consumer installs the latest firmware from a vendor, the router would still be vulnerable.
SEE:Best Wi-Fi routers for your home office in 2020: Google Wifi, ASUS ROG, and more
FKIE assessed that ASUS and Netgear do a better job on some aspects of securing routers than D-Link, Linksys, TP-Link and Zyxel, but it argues the industry needs to do more to secure home routers.
FKIE found that AVM, a German router manufacturer, was the only vendor that didn't publish private cryptographic keys in its router firmware. The Netgear R6800 router contained 13 private keys.
In the worst cases of devices FKIE assessed, the routers hadn't been updated for more than five years.
About 90% of the routers in the study used a Linux operating system. However, manufacturers weren't updating the OS with fixes made available from Linux kernel maintainers.
"Linux works continuously to close security vulnerabilities in its operating system and to develop new functionalities. Really, all the manufacturers would have to do is install the latest software, but they do not integrate it to the extent that they could and should," said Johannes vom Dorp, a scientist at FKIE's Cyber Analysis & Defense department.
"Numerous routers have passwords that are either well known or simple to crack or else they have hard-coded credentials that users cannot change," he added.
The study targeted five key signals in firmware images to assess each manufacturer's approach to cybersecurity. These included the days since the last firmware update was released; how old are the OS versions running these routers; the use of exploit mitigation techniques; whether private cryptographic key material isn't private; and the presence of hard-coded login credentials.
FKIE concludes that router makers are significantly lagging in the delivery of security updates compared with operating system makers.
"The update policy of router vendors is far behind the standards as we know it from desktop or server operating systems," FKIE notes in the report.
"Most of the devices are powered by Linux and security patches for Linux kernel and other open-source software are released several times a year. This means the vendors could distribute security patches to their devices far more often, but they do not."
The results mirror findings from a 2018 US study by American Consumer Institute (ACI), which analyzed 186 small office/home office Wi-Fi routers from 14 different vendors. It found 155, 83%, of the firmware sampled had vulnerabilities to potential cyberattacks, and that each router had an average of 172 vulnerabilities.
ACI criticized router makers for not providing an auto-update mechanism to keep routers updated. Often updates are only made after high-profile attacks on routers, such as Mirai IoT malware, and the state-sponsored VPNFilter malware.
SEE:VPN usage policy (TechRepublic Premium)
As for exploit mitigation, a researcher who recently found 79 Netgear router models had a remotely exploitable flaw also found that its web-based administration panel never applies the exploit mitigation technique ASLR (address space layout randomization), lowering the bar for remote attackers to take over an affected router.
The German study found that more than a third of the devices use a kernel version 2.6.36 or older, with the latest security update for 2.6.36 provided in February 2011. It also found a Linksys WRT54GL router running on Linux kernel version 2.4.20, which was released in 2002.
"The worst case regarding high-severity CVEs is the Linksys WRT54GL powered by the oldest kernel found in our study," the report notes. "There are 579 high-severity CVEs affecting this product."
Go here to see the original:
Home router warning: They're riddled with known flaws and run ancient, unpatched Linux - ZDNet
- Amazon just slashed the price of our favorite budget home security camera - Tom's Guide - March 14th, 2024 [March 14th, 2024]
- Los Angeles Police Department warning home owners to hard-wire home security systems as organized theft rings ... - Notebookcheck.net - March 14th, 2024 [March 14th, 2024]
- Mesa family upping home security as burglaries increase - Yahoo! Voices - March 14th, 2024 [March 14th, 2024]
- An attempted kidnapping in Glendale is caught on camera - The Arizona Republic - March 14th, 2024 [March 14th, 2024]
- Best Security Systems For Apartments Of 2024 Forbes Home - Forbes - March 14th, 2024 [March 14th, 2024]
- Airbnb's Unexpected Home Security Ban Sets A New Standard For Rental Property Owners - House Digest - March 14th, 2024 [March 14th, 2024]
- Wayward 450-pound pig named Kevin Bacon hams it up for home security camera - The Associated Press - March 14th, 2024 [March 14th, 2024]
- The Best Home Security Cameras According To Rigorous, Hands-On Testing - Forbes - March 14th, 2024 [March 14th, 2024]
- Best home security deal: Get the Arlo Essential Wired Video Doorbell for just $49.99 at Amazon. - Mashable - March 14th, 2024 [March 14th, 2024]
- The 6 Hottest Outdoor Design Trends You'll See Everywhere This Spring and Summer - SFGATE - March 14th, 2024 [March 14th, 2024]
- This smart security camera impressed me in the most unexpected way - ZDNet - March 14th, 2024 [March 14th, 2024]
- Lithe Audio and Lilin integrate AI for home security - HiddenWires - March 14th, 2024 [March 14th, 2024]
- Why Airbnb Is Banning Cameras in Rentals - TIME - March 14th, 2024 [March 14th, 2024]
- PC students gift overnight security guard trip home to Nigeria - WPRI.com - March 14th, 2024 [March 14th, 2024]
- Influencer suing Tyreek Hill for 'breaking her leg' DEMANDS he hand over his private texts and home security f - Daily Mail - March 14th, 2024 [March 14th, 2024]
- Ring's Battery Doorbell Pro is one of the best security systems I've tested (but there's a catch) - ZDNet - March 14th, 2024 [March 14th, 2024]
- Ring Spotlight Cam Pro Review: Compact, Reliable And Long Battery Life - Forbes - March 14th, 2024 [March 14th, 2024]
- Home security video catch person taking mail that results in $8,000 worth of fraudulent checks - AOL - February 16th, 2024 [February 16th, 2024]
- Best Home Security Cameras of 2024 - CNET - February 16th, 2024 [February 16th, 2024]
- Ring sale: Save on Ring doorbells and home security cameras today - Digital Trends - February 16th, 2024 [February 16th, 2024]
- Blink's video doorbell just crashed to $44 and it doesn't require a subscription - Tom's Guide - February 16th, 2024 [February 16th, 2024]
- Snag Up to 43% off These Blink Security Cameras and Doorbells - CNET - February 16th, 2024 [February 16th, 2024]
- U.S. House Republicans impeach Homeland Security chief Mayorkas on second try Oregon Capital Chronicle - Oregon Capital Chronicle - February 16th, 2024 [February 16th, 2024]
- Wi-Fi jamming to knock out cameras suspected in nine Minnesota burglaries -- smart security systems vulnerable as ... - Tom's Hardware - February 16th, 2024 [February 16th, 2024]
- The 4 Best Security Cameras for Your Home of 2024 | Reviews by Wirecutter - The New York Times - February 16th, 2024 [February 16th, 2024]
- Security guard shoots man allegedly trying to run people over in Home Depot parking lot - CBS Los Angeles - February 16th, 2024 [February 16th, 2024]
- The 4 Best Smart Doorbell Cameras of 2024 | Reviews by Wirecutter - The New York Times - February 16th, 2024 [February 16th, 2024]
- Everything you need to know about the Ring Protect price hike - Digital Trends - February 16th, 2024 [February 16th, 2024]
- Vory Threatens To 'Kill' Girlfriend In Alleged Footage Of Domestic Abuse - HipHopDX - February 16th, 2024 [February 16th, 2024]
- Angry Airbnb host sent guest's wife security photo of him with another woman, lawsuit claims - New York Post - February 16th, 2024 [February 16th, 2024]
- Best Smart Locks of 2024 - CNET - February 16th, 2024 [February 16th, 2024]
- Bear tries to enter Washington home through doggie door - UPI News - February 16th, 2024 [February 16th, 2024]
- The Ring Battery Doorbell Pro has 3D motion detection - Gadget Flow - February 16th, 2024 [February 16th, 2024]
- We test some of the latest home security cameras to see how far the technology has come - Nottinghamshire Live - February 16th, 2024 [February 16th, 2024]
- Ring Is Raising Rates on Some Plans by 25% in March - PCMag Middle East - February 16th, 2024 [February 16th, 2024]
- The 12 Best Home Security Cameras of 2023 - Security.org - December 11th, 2023 [December 11th, 2023]
- Traveling for the holidays? Keep an eye on your home with the Blink Mini security camera, now just $20 - Gwinnettdailypost.com - December 11th, 2023 [December 11th, 2023]
- Gangs from South America use security jammers to break in to expensive homes across country: police - WLS-TV - December 11th, 2023 [December 11th, 2023]
- Best Home Security Companies Of 2023 Forbes Home - Forbes - December 11th, 2023 [December 11th, 2023]
- Best Wireless Security Cameras Of December 2023 Forbes Home - Forbes - December 11th, 2023 [December 11th, 2023]
- Best Outdoor Security Lights With Cameras Of 2023 - Forbes - December 11th, 2023 [December 11th, 2023]
- Wireless CCTV camera for home security? Here are top 10 options to choose from | Mint - Mint - December 11th, 2023 [December 11th, 2023]
- Cougar struck and killed near Minneapolis likely the one seen in home security video, expert says - Drgnews - December 11th, 2023 [December 11th, 2023]
- Cougar living in Lowry Hill neighborhood of Minneapolis, city, DNR warn - Star Tribune - December 11th, 2023 [December 11th, 2023]
- FAIR Applauds Senate Republicans for Holding Firm and Demanding that National Security Starts at Home - StreetInsider.com - December 11th, 2023 [December 11th, 2023]
- Prevent Burglaries With ADT's Tips For Property Security | Security News - SecurityInformed - December 11th, 2023 [December 11th, 2023]
- Prince Harry Says His Security Removal Had One Glaring Error - Newsweek - December 11th, 2023 [December 11th, 2023]
- Save $50 on the Ring Alarm home security system from Amazon - SFGATE - September 13th, 2022 [September 13th, 2022]
- An Indian Security System That Is Being Transformed By Technology - Inventiva - September 13th, 2022 [September 13th, 2022]
- Home Security Systems Market | expected to reach $96.5 billion | growth of 9.1% CAGR | 200 pages report - Taiwan News - September 13th, 2022 [September 13th, 2022]
- VP Harris wishes lawmakers treated domestic threats as 'Americans' - Business Insider - September 13th, 2022 [September 13th, 2022]
- Axis Communications Unveils Latest Solutions for Integrating Sight, Sound, Analytics and More at the 2022 Global Security Exchange - Business Wire - September 13th, 2022 [September 13th, 2022]
- Tomorrow.io Delivers First Radar for Weather Satellite Constellation Backed by U.S. Air Force - Benzinga - September 13th, 2022 [September 13th, 2022]
- The 2 Stocks Everyone's Talking About Tuesday - The Motley Fool - September 13th, 2022 [September 13th, 2022]
- What To Do With Old Smartphones? 15 Genius Reuse Ideas - TechPP - September 13th, 2022 [September 13th, 2022]
- Broken Arrow Man Arrested, Accused Of Hiding Cameras To Record Minors - News On 6 - September 13th, 2022 [September 13th, 2022]
- Massacre in Pike County Suspect is escorted by security as they enter court on the first day of the trial. - TDPel Media - September 13th, 2022 [September 13th, 2022]
- Department of Homeland Security PAL-Home - November 4th, 2021 [November 4th, 2021]
- Native Sun Home Accents, Inc. - Arizona Security Doors ... - November 4th, 2021 [November 4th, 2021]
- Ring Alarm Pro review: A giant leap for home security - CNET - November 4th, 2021 [November 4th, 2021]
- The Top Reasons You Should Not Ignore Installing a Home Security System - Southeast Missourian - November 4th, 2021 [November 4th, 2021]
- Where is the best place to install my home security cameras? - TechRadar - November 4th, 2021 [November 4th, 2021]
- Wyze announces new camera features and a new Wyze Smart Switch and Smart Bulb - The Verge - November 4th, 2021 [November 4th, 2021]
- Connected Home Security Market 2021: Global Analysis, Share, Trends, Application Analysis and Forecast To 2027 Bolivar Commercial - Bolivar... - November 4th, 2021 [November 4th, 2021]
- Amazon Black Friday deal takes $250 off the Arlo Pro 3 Spotlight 4 camera system - T3 - November 4th, 2021 [November 4th, 2021]
- Frontpoint Security Expands Executive Team with the Announcement of its First Chief Commercial Officer - PRNewswire - November 4th, 2021 [November 4th, 2021]
- Xiaomi Smart Door Lock Xhome security with face recognition and a sleek design - Gadget Flow - November 4th, 2021 [November 4th, 2021]
- US Blacklists Israeli Spyware Companies Over Threat to National Security - The Daily Beast - November 4th, 2021 [November 4th, 2021]
- Remote Work Security: Handling Setbacks in the Time of COVID-19 - Security Intelligence - November 4th, 2021 [November 4th, 2021]
- World Series 2021 - The inside story of where Jorge Soler's home run went once it left Minute Maid Park - ESPN - November 4th, 2021 [November 4th, 2021]
- Ask a Broker: The importance of smart-home technology - Aspen Daily News - November 4th, 2021 [November 4th, 2021]
- Apple's Craig Federighi defends App Store in face of looming regulation - Mashable - November 4th, 2021 [November 4th, 2021]
- The eufy Floodlight Video Camera II provides 360 degrees of security coverage without breaking the bank - TechHive - November 4th, 2021 [November 4th, 2021]
- Worldwide Automotive Software Industry to 2026 - Safety and Security Software is Expected to Witness Faster Growth Rate - ResearchAndMarkets.com -... - November 4th, 2021 [November 4th, 2021]
- She would never just leave: Investigators look into if Mid-City moms disappearance related to financial investigation - KTLA Los Angeles - November 4th, 2021 [November 4th, 2021]
- Bring Alexa support to your home security with 54% off wansviews 1080p outdoor cam from $18 - 9to5Toys - July 2nd, 2021 [July 2nd, 2021]
- Members of Congress Are Spending More Than Ever on Security Mother Jones - Mother Jones - July 2nd, 2021 [July 2nd, 2021]
- Google Nest to Strengthen Its Commitment to Security by Testing Devices Against the ioXt Alliance's Global Security Standards - Business Wire - July 2nd, 2021 [July 2nd, 2021]
- Summer Wells investigators receive more than 700 tips about missing Tennessee girl - Fox News - July 2nd, 2021 [July 2nd, 2021]
- DIY Home Security Solutions Market Analytical Overview, Growth Factors, Demand and Trends Forecast to 2027 The Courier - The Courier - July 2nd, 2021 [July 2nd, 2021]