Oi! Yleisradio Oy (Yle) Gets Its Facts Wrong on Home Network Security
Are Microsofters or Supo running that site?
THIS week we took a closer look at router security, based on publicly available information from the past decade. We responded to Finland's national broadcasting basically broadcasting misinformation or bad advice on behalf of the spy agency, Supo (or SuPo). The short story or stories might be, there are back doors in such routers; they're there by design, according to researchers, and ISPs that distribute such routers try to silence those researchers instead of actually addressing the holes (some went on for years without the ISPs bothering to fix; or leaked passwords circulated on the Net without any action from the ISPs). So who are what are they actually protecting? Users and homes? Or spies and overpowered states?
"First they allowed Huawei to build Finland's 5G network even though Nokia also has its own 5G implementation and would probably have been able to build it," Sompi noted. "And practically every router that the ISP provides its customers is Huawei brand. Now suddenly they are worried about the LAN management passwords of these routers..."
"If CIA has that backdoor, surely China and Russia have them too. There is always double agents that leak that type of information," Sompi said this afternoon. "Probably the whole announcement about that security risk was just meant to be fearmongering against China and Russia [...] And not solve any real security problems..."
"I think that actually the main thing about the announcement that Finland's intelligence agency SuPo gave about the router security was that people should change the default password of the router's setup UI, which makes no sense because the router configuration can only be accessed from the LAN [...] it cannot be accessed from outside anyway, so it shouldn't matter and changing the password does not fix the backdoors and security vulnerabilities that are exploitable from the outside [...] the password of the configuration page is basically just a child lock meant to keep unauthorized people from the same household from changing those settings..."
"Nowadays", according to Sompi, security" means "don't worry, WE are in control of your devices - not THOSE BAD GUYS over there!"
Sompi gave us a rough translation of the SuPo propaganda piece, relayed to Finns in their native language (legally speaking, there are two native languages there, but the article is published only in one of them) via the national media:
Supo warned about a security risk in home routers - check at least these six things in your home routerChange the default passwords to strong passwords. Keep hardware and software upgrades up-to-date and block remote access to your devices.
[Picture] Various devices in the network can be used as a part of a cyber attack.
Anyone who owns an unprotected device that is always connected to the Internet, like a home router, can make spying possible for foreign intelligence agencies, tells suojelupoliisi (Supo) in their new security report.
More and more devices have an Internet connection that allows the device to be remotely controlled from the public Internet.
It can provide a possibility for state intelligence agencies to use the device remotely without permission, which they do in attempt to penetrate into information systems of Finland and its allies.
[At the end of the article you can find six easy tips for protecting your home]
Router is an essential part in protecting a home Router is a device that connects other devices to the Internet. For example computers, mobile devices and many other smart devices like household appliances, entertainment systems and gaming consoles are usually connected to the Internet either via the router directly or via a WiFi network that is made possible by the router.
Because the router controls all network traffic, it is an important part of protecting the devices in the wireless network from external threats, like hackers and denial-of-service attacks.
According to supo, particularly unprotected and unupdated home routers form a significant risk to national security.
Hijacked home routers can be used, for example, as a part of a wide denial-of-service attack, in attempt to bring down company websites, governmental online services and home pages.
Change the default password to something more complex [Picture] In this router the user name and password are by default "admin". The picture has been manipulated for privacy reasons.
Change the router's default password to a strong password. The most important property of a strong password is its length. Special characters, like upper and lower case letters and adding numbers make the password even safer. [Translation note: The previous sentence has a similarly vague grammar also in its Finnish version.]
It's not recommended to use the same password in more than one accounts and devices. If one service leaks the password, then the other ones are also in danger.
[Link: Here you can test how quickly your different passwords can be guessed by brute force]
Check at least these six easy ways of protection - Use firewall.
- Block remote access to the device from the internet so that the device cannot be reached [?] from the public network
- Run software and device upgrades (firmware) and keep them up to date
- Create a separate network for IoT devices (Internet of Things). This way poorly protected IoT devices don't provide attack surface to hackers and endanger your computers and phones by doing so.
- Power down your router regularly.
- Disable features that you don't need.
[Video] Russia is now treating Finland as an unfriendly country, says Antti Pelttari from Suojelupoliisi.
The advice they give here in the UK is similar. They assume you use Windows (which itself is littered with back doors and front doors) and they conflate WiFi password with "security" even though it only impacts who can use your network, not crack your network. They use scary red lights and misleading message to discourage open Wi-Fi, which isn't the same as security. It's about sharing, e.g. offering a connection to a house guest with minimal hassle. At the same time, as we explained yesterday, even senior people at the ISPs (I know some managers and engineers at BT) acknowledge that the routers offer no real security. "Updating" them does not solve the problem. Security is not improved, it's just a moving target. It's simply not an aspiration of theirs unless some hostile country finds the holes and leverages exploits en masse, harming "important" people.
It should be noted that there are moreover weaknesses in the implemented standards themselves, but they're typically kept closely guarded, secret under an NDA. Cracking WPA2 and WPA3 is trivial nowadays,. especially since the weaknesses are known. There were no encryption experts involved in making either standard. Any known weaknesses + on-demand hosting = network cracked in minutes. █
