[WOW] 32,003 Router Vulnerabilities Found

Now I have a gateway device from AT&T, combining the functions of modem and router, for my high speed broadband connection. I have no idea if it is self updating. How would I learn that?

You start off with " Is yours on the hit list?".

OK, how do I find out? Got a link to a list of the routers that should be suspect?

As far as updates, I take a very careful approach. One router I have, I updated the firmware after I had it 13 months. That essentially broke it. The manufacturer wanted almost half of what I had paid for it to tell me simply if I could roll back the firmware. Instead I updated to a different brand. A recent update to it now requires a reboot every few days to keep my internet connection up.

Maybe one of the aftermarket firmwares is the way I should go.

@Bob
If GM or Ford sold cars with 32,003 known vulnerabilities, all in the name of reducing costs, I don't think that would "leave consumers to collectively bear the burden" of horrific law suits when the brakes fail, or the steering, or if the accelerator sticks full open.

BTW, it would have been handy to see a list of this junk being sold to us.

Here's where you can find the report:

http://www.theamericanconsumer.org/wp-content/uploads/2018/09/FINAL-Wi-Fi-Router-Vulnerabilities.pdf

The list is at the end of the PDF.

While self updating routers would be a benefit for most people since they wouldn't know when or how to update a router, there is no way I would want a router that self updated unless I could turn that dubious "feature" off.

Updates aren't always perfect. It's not uncommon for updates for anything, hardware and software, to be buggy or flat broken (I'm talking to you, MS!) so I prefer to wait a week or two before deciding to download and install an update (waiting allows time for bug reports to start surfacing), then choose when I will download and install the update rather than having it foisted upon me whether I want it or not and at an inconvenient time.

What is needed is for router manufactures to develop easier ways to for users to manually update their routers, then send out reminders saying a new update is available without a link to direct people to the update (not providing an update link would help make it harder to entrap the unwary with spoofed update emails).

I recently received an email from Netgear saying there was a new update available. I went to Netgear's website (directly, not via the link in the email), got the number of the latest version, then checked inside my router. The version I had was the one I updated to several months ago. While I'm reasonably confident the email I received was actually from Netgear, I can't help but wonder why they sent it, saying my router needed updating?

Thank you, Turboprop Ted!

The router I am using is listed. My "retired" router is not. But, this list is for the routers they investigated -- and not all (but most) have weak spots. So, I still don't know if the current router is OK, or if the one I set aside is.

There is a firmware update for both routers, but I run with extensive configuration changes. And they say I will probably lose those with an update.

Maybe it's time to update the spare first, swap that in, and see how it goes.

Bob, please don't scare your readers with such sensational, and mostly theoretical, claims of threats and impending doom. It's OK to provide information, but it needs to be put into the proper perspective, especially for your target audience. Look at it this way: The chances that YOUR router is going to be hit with one of these 32,003 vulnerabilities are astronomical (you can actually calculate that). But then, if YOUR router is targeted for a hack, you are out of luck no matter how much you update the firmware. I don't know who came up with the ridiculous number 32003, but I would add one more to that: With auto update routers the hacker now has one more (and very easy) method of getting into your router and network.

Well my Linksys E2500 routers last firmware update, V2 available is April of 2014. There is a V3 but it is not compatible with the V1 or V2 models. So is it then time for a new router?

Here is the link every one is looking for: http://www.theamericanconsumer.org/wp-content/uploads/2018/09/FINAL-Wi-Fi-Router-Vulnerabilities.pdf

Thanks Bob for bringing this to our attention.

Coco

While your router might well need a firmware update to close one or more vulnerabilities, and that might be difficult to accomplish, there are also many, many steps to take to improve the security of routers, such as:

1) Making sure the WiFI password(s) are WPA2 or WPA3 (coming soon).
2) Changing the administrative user name and password.
3) Disabling remote administration. Clarify whether a remote app on a phone or tablet requires remote administration.
4) Limiting IoT devices to their own WiFi network (such as a guest network).
5) Making sure the SSIDs (network names) for all networks are nondescript (such as "Kitchen" or "Network1"), never your own name or the name of the make/model of the router itself.
6) Use a wired connection (Ethernet) if possible.
7) Turn the router off, and on, once in a while (maybe once a week).

There's plenty more information at routersecurity.org.

Second, the published report does not really explain their methodology. Keep it simple, make complexities manageable for home and business owners! Tell us how to assess known vulnerabilities for whatever router we happen to have, and give excellent security-oriented buying advice for a replacement.

One other thing that hasn't been mentioned, is that even if your router is not on the list, it DOES NOT mean it is safe and not vulnerable, it just means it wasn't checked.

Bob S's comment is good advice to follow.

Coco

I too was unable to find a list of these vulnerable routers, so I decided to message the manufacturer of the one we own.

I just received their four paragraph response. I am familiar with and know the definition of every word in the response, but they are strung together in a way that makes no sense and most definitely did not answer my simple question.

They also linked me back to the page I started from, and from where I had originally written them with my question.

About as much use as a chocolate coffeepot. I still don't know if my router auto updates firmware, or if I can do it myself.

Thank you to the posters who added great information in the time it took me to formulate my own post.

I wish you'd, or someone, had said what happens if your router is secured with a password that would take 6 trillion years to crack. Yes, that's possible and not even difficult. I have Comcast, but only use their modem. I run that through a Linksys EA router which I replace every two years Smart WiFi which according to your link is okay, I already knew it was self-updating.

Great article, Bob, to create FUD (fear, uncertainty, doubt). You warn readers "Your router may be compromised!!!" but then fail to point us to the news source so we can look up our model.
Thanks to the alert people who did provide that necessary URL.