Re: Own on install. How grave it is?

[Michal Hrušecký <michal.hrusecky () nic cz>]

On January 9, 2018 2:42:07 PM CET, Georgi Guninski <guninski () guninski com> wrote:
> [don't know if this is ontopic. Not on the list so CC me].
>
> This is well known, haven't seen it discussed.
>
> In short doing clean install (factory defaults) has a window of
> opportunity when the device is vulnerable to a known network attack.
>
> It used to be common sense to reinstall after compromise (probably
> doesn't apply to the windows world where the antivirus takes care).
>
> All versions of windoze are affected by the SMB bug to my knowledge.
> Debian jessie (old stable) is vulnerable to malicious mirror attack.
>
> More of interest to me are devices where the installation media is
> fixed and can't be changed.
>
> This includes smartphones and wireless routers.
>
> Some smartphones might be vulnerable to wifi RCE (found by google?).
> Some wireless routers might be vulnerable to wifi RCE or
> default admin password attack over wifi.
>
> Internet of Things will make things worse (some NAS devices are
> affected).
>
> Shielding the device might not be solution since updates must be
> applied.

Hi,

we are manufacturers of Turris Omnia routers and our approach to minimise those attacks is that on factory reset, your 
wan and wifi is disconnected till you setup your router. So your workflow after factory reset has to be connect localy 
via wire, setup your own password and then recommended steps are sugested in this order - setup wan, update, setup 
wifi. In theory somebody can beat you on LAN, but you should have enough common sense to disconect other computers if 
you are doing factory reset. You can also skip updates, but hey, you can setup passwordless wifi if you try hard enough 
(not easy that easy in our setup) and make your pasword admin1234. We can't protect you from every mistake and there 
are usecases where it might make sense.


-- 
Sent from my Jolla device with K-9 Mail. Please excuse my brevity.