I do SMB support. I recently replaced one at a customer , essentially because it didn’t support larger disks. Also because it was slow as fuck. replacing a 10 year plus device doesn’t seem that unreasonable.
That said, I don’t like Dlink.
My “newer model” wouldn’t be a D-Link.
My thoughts exactly … if a company’s response to a problem with their equipment is to instead of fixing the problem but to ask you to replace it with a new model
I would go buy something new … it just wouldn’t be with the same company
This would be a great opportunity for a rival company to take advantage of this.
It would. They could over a discount with the turn in of a d-link device and roll in some nonsense about reducing e-waste. They will probably get a nice little sales boost and tax breaks while helping the decline of a competitor.
they don’t make them anymore, anyway.
Which is likely why they are not bothering to fix it.
Anybody who didn’t already know this:
D-Link makes marginal products that routinely suffer major security flaws. Do not buy/use D-Link products.
damn, side-eyeing the D-Link router I got in the closet now
It’s usually possible to replace the firmware of d-link routers with open alternatives, such as dd-wrt.
So D-Link can’t afford to pay employees to fix their shit? That’s not a strong argument for buying more of their stuff.
They don’t want to pay employees.
Some of these machines haven’t been sold since 2013. That’s a pretty decent lifespan.
So what you’re saying is I should be able to pickup one of these used for a song?
Edit: oh, these are all four years past their EOL. Yeesh.
I run old hardware like this, but I’d never recommend anyone else do it.
oh, these are all four years past their EOL. Yeesh.
Yeah, at a certain point it’s the consumer’s (and blog writer’s) fault, and that’s after EoL. Not patching a supported one and just getting rid of support, saying buy a newer one? Yeah, that’s bad.
Continuing to not support an EoL model that you already don’t support due to EoL (or even dropping support for an EoL model that no one expected you to support in the first place due to EoL)? Non-issue.I was going to disagree, because manufacturers often set a very short and arbitrary EOL, but looking at the amazon price history this doesn’t seem to have been sold new since around 2013.
Continuing to not support an EoL model that you already don’t support due to EoL (or even dropping support for an EoL model that no one expected you to support in the first place due to EoL)? Non-issue.
Dropping support should mean opening the source. I think there’s a movement about that.
At what point is that acceptable? Attacks like this were well known when this was new so shouldn’t they fix it? 12 year old cars have been recalled before, but there are a lot of cars without the latest safety fixes. We need aeserious debate over when it is accebtable to call something that works scrap because it isn’t supported. there are costs to the environment and society around this so even though I don’t own one of these devices I’m affected but it.
Last sold 20+ years ago sounds reasonable.
Cars are not consumer grade NAS. If you want your consumer NAS to have the same regulated support requirements, expect to see prices go up by about 5x or more. Auto tech doesn’t age out like computer tech. I wouldn’t want a 20 year old device - the power consumption alone would be horrific, let alone the performance and lack of capability.
These are already 4 years past EOL. Know how long we spec servers for our clients? 5 years, max (we push them to replace at 4 years).
After 5 years the risks go up, and dealing with an outage will cost more in support costs than simply having planned and deployed a new system already.
These devices are double our server lifetime already - last made in 2013.
Again, I do dumb shit like this for my own systems at home, because I deal with the risk myself (redundancy). I’d never let a client do this. If someone had one of these at any point, I would’ve been replacing it - even if it was brand new.
My complaint against Dlink is these things were junk from the start. But expecting anything from them years after EOL is unreasonable.
It would be REALLY nice if IT appliances had replaceable admin boards, especially for something as simple as a nas that probably hasn’t upgraded the PCI buss in a decade :)
Swap the OS for sure
Any vendor is going to reach a point where they no longer are willing to support older devices. So you have three choices:
- Run with the vulnerability. This is incredibly stupid and I’d hope no one did this.
- Replace the OS on any such device with something open source. Probably the best option for those who already own such a device.
- Never buy a proprietary device in the first place. Unless you really, really need something the propriety device offers, a beige box running some flavor of 'nix is probably a better long term solution.
Ok, I guess there is a fourth option. Learn to enjoy that vendor bending you over every few years. This is what many businesses do and it can make sense. You just need to have lots of money.
every few years
These boxes had almost a decade of support.
I object to your third point, it can be a sexy black box
If you’re using one of these models, it’s highly recommended that you replace your NAS system with one that’s still receiving patches from the manufacturer. If that isn’t possible right now, Netsecfish suggests restricting access to your NAS settings menu/interface to only trusted IP addresses. You could also isolate your NAS from the public internet to ensure that only authorized users can interact with it.
Emphasis mine, regardless of this incident, even with a brand new supported model, it shouldn’t be exposed to the internet. Half the reason these security issues are such a big deal is because manufacturers wanted to make things simple and designed it to sit on the open internet, so they wouldn’t have to deal with support requests. Now their customers are exposed because of poor recommendations and the lack of updates.
Exactly!
If you need external access, use an external access infrastructure that’s designed for that purpose, with controls and monitoring.
who the fuck even still has an exposed IPv4 address anyway, those are fucking expensive since we ran out. I couldn’t expose my network if I tried.
Its free, so why the fuck not? Why the hassle with ddns, wich funnily enough is also free with my hoster/registra
Dynamic DNS has solved that for 20+ years. Just need a domain name, and a utility to update the IP when it changes.
That said, my IP hasn’t changed in over 5 years now.
Dynamic DNS is useless if you’re on CGNAT.
Still though, Dynamic DNS points to an external IP address, which you’d have your NAS exposed on a public port. This is the flaw in the design which allows remote execution of this exploit.
If you need remote access to the NAS, it should not be publicly exposed and should require a VPN to access. That way if there is an issue or misconfiguration, everyone on the internet can’t exploit it easily.
Stallman was right?
Always is.
Well… I definitely wouldn’t say “always”, as he has taken some pretty gross stances on non-technical subjects https://www.wired.com/story/richard-stallmans-exit-heralds-a-new-era-in-tech/
Go read what he actually wrote, not what the character assassins pretended he meant.
On what? His disgusting views on the age of consent? His disgusting views on rape?
The more I read into his views the more disgusting I find him. Then again I shouldn’t have had any standards for someone who goes up on stage and eats gunk off of his feet.
I read his article on pay toilets. He makes a good point.
I’m a little bit torn on this one, we’re talking 10-15 year old devices here. The number of companies that will continue to produce emergency security patches for their hardware so old and having reached EOL four years ago in 2020 are few and far between. Caveat Emptor most definitely, but if you’re someone who likes to keep their tech running forever, you’re going to need to get creative, when the manufacturer eventually stops patching. For this particular instance, I’d recommend placing the unit behind a vpn on the lan.
Which is where it should’ve always been anyway.
When you make convenience your priority, you’re gonna give up some control or security.
The first time I saw vendor-provided access (e.g. WD stuff) about 20 years ago, all I could think is “that’s a bad idea”. I’ve never owned this kind of product for just that reason - you’re trusting a third party to handle stuff correctly with no recourse if they screw up.
It’s not like a business contracting with a hosting service, with clear penalties in the contract.
I can’t blame them. I think relying on the manufacturer for updates means that you are expecting them to spend money on you. That works for a while but not indefinitely
