Re: [Cerowrt-devel] security guidelines for home routers

[Mikael Abrahamsson <swmike@swm.pp.se>]

On Tue, 27 Nov 2018, Sebastian Moeller wrote:

> 	Really, which ones? I would like to know so I can avoid them ;) 
> Just joking, but I have never heard of secure booting in the context of 
> MIPS based routers and at least in the retail market most cheap devices 
> still seem MIPS based. Then again this is slowly changing with x86 (via 
> DOCSIS-SoCs and even the high end lantiq/intel dsl SoCs) and ARM slowly 
> seeping into the market. I think bot x86 and ARM have specs for secure 
> booting or related methods.

DTs Speedports.

> 	I am old school, once somebody has physical access to the device 
> it is game over already. Point in case people have found ways to decrypt 
> the encrypted configuration files huawei tends to use in their routers, 
> and some people even hacked docsis-modems. From my reading of the BSI 
> recommendations, even pressing a reset button long enough would be okay, 
> the only nono seems to be allowing changing the firmware to non-signed 
> ones without explicit opt-in by the user.

Again, how do you define "explicit opt-in"? Yes, cutting a wire inside the 
device is probably a good way to do it, if someone doesn't understand this 
is modification of the device then I don't know what is.

> 	But that is okay for a device that an ISP owns and rents out, but 
> decidedly not okay for a device I want to own.

I agree, but it might be exactly what some other people want to own, who 
just want things to work. There are plenty of devices that people pay and 
own, but they expect their ISP to manage and software update.

-- 
Mikael Abrahamsson    email: swmike@swm.pp.se