ASUS has released a new firmware update that addresses a vulnerability impacting seven router models that allow remote attackers to log in to devices.
  • Pxtl@lemmy.caEnglish
    641·
    5 months ago

    Never turn on remote admin. You don’t need to admin your router from outside of your house.

      • Professorozone@lemmy.worldEnglish
        4·
        5 months ago

        I heard that a while ago many VPN services were bought by the very people you use a VPN to protect against. How do you know which ones are safe?

        • Evkob@lemmy.caEnglish
          31·
          5 months ago

          I believe they mean setting up a VPN on your network, rather than buying a service from a VPN provider.

          Something like Wireguard lets you configure individual devices to access your network remotely.

          • sugar_in_your_tea@sh.itjust.worksEnglish
            1·
            5 months ago

            Yup, I did that last week and it’s pretty easy. Basically:

            1. Set up a VPS and configure wireguard
            2. Set up your computer to connect to it (or your router if you literally only want remote admin); you’ll probably want to configure persistent connections
            3. Set up your phone to connect to it
            4. Test it at work sometime to make sure it all works

            I do it in two hops: connect to VPS then to internal computer. There are other configurations (e.g. talk to peer computers directly), but this works well for me.

        • Dultas@lemmy.worldEnglish
          12·
          5 months ago

          This would be self hosted so you can access your own internal network. Wireguard on OpenVPN are your best options there, personally I use wireguard/pivpn.

          • ccdfa@lemm.eeEnglish
            1·
            5 months ago

            Pivpn was discontinued just a heads up. I switched to just plain wireguard when I heard the news.

        • Caboose12000@lemmy.worldEnglish
          7·
          5 months ago

          The way to tell which ones are safe is to look up legal history for each company. When the home country of the company demands all the data they have, the companies are going to give all the data they have. So if a court order of a VPN yields nothing or almost nothing, then you know they really don’t save any logs.

          As someone else mentioned already, proton and mullvad are the good ones in, but that can change if either company gets bought out or changes management etc

        • sunzu@kbin.run
          2·
          5 months ago

          proton and mullvad are the privacy focused choices, but you are still just trusting a third party to be pinky promise to keep no logs etc.

  • RubberDuck@lemmy.worldEnglish
    581·
    5 months ago

    That site… even the model list is an advertorial.

    • XT8 (ZenWiFi AX XT8)
    • XT8_V2 (ZenWiFi AX XT8 V2)
    • RT-AX88U
    • RT-AX58U
    • RT-AX57
    • RT-AC86U
    • RT-AC68U
  • mox@lemmy.sdf.orgEnglish
    351·
    5 months ago

    Friendly reminder that OpenWrt exists, and is probably safer than the stock firmware in any consumer router.

    From a quick look, I see that at least one of the affected models has official OpenWrt support: the RT-AC68U

    • Avid Amoeba@lemmy.caEnglish
      81·
      5 months ago

      Friendly reminder that OpenWrt supports Raspberry Pi and every Pi from 3 onwards makes for a great, inexpensive router. Adding WiFi can be done with any off-the-shelf WiFi router or access point, brand new or second hand. Since they aren’t exposed to the Internet, remote vulnerabilities are significantly mitigated.

      • Mazoku@lemmy.mlEnglish
        2·
        5 months ago

        Yup. I use a CM4 with a DFRobot router board running openwrt. Works great.

    • RubberDuck@lemmy.worldEnglish
      6·
      5 months ago

      I got fed up with trying to find the right firmware each time. It was too much of a hassle. Then small issues with the one I had… you need an earlier version… I love the idea, it was just a pain.

    • sugar_in_your_tea@sh.itjust.worksEnglish
      3·
      5 months ago

      Another friendly reminder, enterprise-grade routers like Mikrotik are fantastic. They don’t have wifi builtin, so you may never need to upgrade it if you get fast enough uplink (mine is gigabit, so should be fine). You’ll need a separate AP (I got Ubiquiti). They’re way more feature complete than nonsense like these from ASUS, and they generally have more secure firmware.

    • towerfulEnglish
      3·
      5 months ago

      I thought OpenWRT doesn’t support modems due to licencing issues.
      So, I guess you would need a separate modem, or ISP router in bridge mode, or double NAT with OpenWRT being DMZ

    • Lem453@lemmy.caEnglish
      1·
      5 months ago

      If you are willing to spend a bit more upfront, I bought a mini PC in 2017 and installed opnsense on it. It’s still rock solid. For wifi, I use a separate ap (a ubiquity UAP that I bought in 2015) and it is also going strong. Almost a decade of rock solid performance easily beats out any other router I’ve owned in terms of both performance and cost.

  • Dem Bosain@midwest.socialEnglish
    181·
    5 months ago

    It’s really too bad I’m unable to update my firmware until I agree to let ASUS sell my data.

    • bitchkat@lemmy.worldEnglish
      3·
      5 months ago

      Interestingly, I didn’t get any prompts. It did tell me to manually restart the router but once it did, no prompts. RT-AC68U running 3.0.0.4.386_51915

    • Sabata@ani.socialEnglish
      1·
      5 months ago

      Let us sell your data or we wont fix this massive bug that’s also our fault.

    • Pxtl@lemmy.caEnglish
      3·
      5 months ago

      Merlin has the problem that it doesn’t have something like like aimesh where you can auto synch the config between all your routers. I’ve got a network of three Asus routers and they work great and I can admin them like they’re one router, and I’d hate to have to give that to up.

    • bitchkat@lemmy.worldEnglish
      1·
      5 months ago

      Will that let you download speeds greater than 160 mbps? The last time I tried Merlin, the ASUS router I had wouldn’t download at full speed allowed by my internet connection?

      • czech@lemm.eeEnglish
        2·
        5 months ago

        I’m getting full speed (currently 290mbps on verizon 5g).

  • shimura@lemmy.worldEnglish
    5·
    5 months ago

    According to the CVE it looks like my XT8 is already updated beyond the affected version. It says through version 3.0.0.4.388_24609 and mine is version 3.0.0.4.388_24621.

    I also noticed this vulnerability was posted on May 29th with the last update being June 13th. Seems like this a report that’s already outdated.

    • kn33@lemmy.worldEnglish
      14·
      5 months ago

      Nah, those get their own, unique set of security issues, discovered or otherwise. Hint: every firmware does.