$1199 cripple locked down router demanding app & Linksys CLOUD account to use it

[JohanH]

It's built in a metal box. Five years guarantee. Free software updates for the life of the product - automatically if you so choose. OTOH it's a router and firewall appliance, not a wireless access point. And it costs more than people are usually willing to pay, though less than the thread topic product.

If you have a properly built house, there is a place where fiber or copper enters your house. In this place you put your router/firewall. This is sometimes provided by the ISP (might be called a CPE). People need to realize that it is beneficial to place a wireless access point somewhere else in the house, and not in the cabinet/room where the router is placed. Therefore, it is good to separate the function of router/firewall and wireless access point.

If you don't want to use your ISP provided router/CPE and wants to use your own router, then it already implies that you have some knowledge about networking. It also requires that you are able to replace the ISP router, which might be difficult in some managed fiber networks. In my case I use a Ubiquiti Erlite-3 (Edgerouter Lite 3) router/firewall and the ISP is nice enough to provide a bridged port in their CPE (after asking). The Ubiquiti uses a debian based OS with vyatta based firewall on top with its, maybe a bit peculiar, cmdline interface. Web GUI. No cloud crap. I know their newer products have this cloud BS and I certainly encourage people to stay away from that (should be possible to turn off the cloud stuff at least in some of their devices or not to use it in the first place; look it up!). Then I have three wireless access points elsewhere in the house, of course wired with 1 Gbit ethernet.

You can still get the Erlite-3 in some places and its not that expensive (between $100-200?). There are also MikroTik alternatives that works just as well. If my Erlite-3 breaks (been running now for seven years), I think I'll upgrade it to an ER-4.

In the past (7+ years ago) I've used these combined router/wireless combos like Asus WL-500 and Linksys routers before that, but when I got fiber they weren't up to the task and already at 100 Mbit (up/down) they already sucked. I have no experience of today's combo devices, your mileage may wary, but I'm not going back to these all-in-one bells and whistles christmas tree devices, if only for the simple reason that the incoming router is in it's separate room/cabinet where wireless does no good because of the walls.

[MrMobodies]

I have got about 6 old Wdnap 350's with a WMS5316 controllers a couple of Drayteks, with all sorts of functionality. All are N 300mbps set at low power when they on and I have a box of them and other stuff I got in joblots for spares cheap off ebay that I brought cheaply over the years.

I am perfectly happy with them they do what I set them to do.

I remembered Netgear doing something similar in 2016 for the model up but not like this. I can't find the article now but as I remember if you upgrade to a certain firmware, they had two types I think, with some of their routers which is remote access controlled from their webservers for a monthly fee you can't revert back and I think it might have been the WDNAP360 ceiling dome thing.

I think I came across a firmware for the wdnap350 that had both options and a choice would appear after a factory reset and I read I can install that firmware and downgrade to standalone on that model. That sounds nice to have choices where you could do it for mass amounts of them when needed for convenience maybe temporary use where it could be reverted but I stayed away from the models that had that limitation/restriction as I did want to waste time and money with the risk of it automatically updating and then having start an argument on the phone to get them to replace it or it being a loss where it ends becoming no functional.

A while ago I sent back a Netgear WAC124 (wi-fi access point) for exactly this reason. Although it had the capability to be managed locally in the usual way, it would refuse access to the local admin interface if it had an internet connection, and insist on using an account via a Netgear server instead.

I replaced it with a WAC104 instead, which has no such limitation.

A little better than Linksys but it still sounds like harassment to me.

Great... Downgrading the Firmware of your internet router...
The one device that will always be susceptible to outside attack, that is the first, and in most SOHO settings your only, defense... Welcome to the next botnet

*Just do not buy that crap.

I don't know what's worse. Under attack from the manufacturer with their bullshit and spying or put at risk and possibly attacked with no longer maintained firmware by people who are not the manufacturers.

* The irony is you don't have buy these things they can be given to you as part of the contract by some ISP'S like the one I mentioned Gigaclear.
The good thing is that Gigaclear told me that was not the main router, it was just a freebee to help improve the wireless situation in the home.

Joke: Say I got one of these for free. I don't want this bullshit crippling stuff in my box of goodies designed and set by principle to restrict and insult the user. I don't want other people to find it in the dumpster and "experience" this "new cloud/app ecosystem bullshit" that is forced upon them. So I think it will be better for the "ecosystem" to burn it up in my trashcan and watch that magic smoke escape.

If you don't want to use your ISP provided router/CPE and wants to use your own router

I have some given to me which I find handy when I suspect there are problems with the broadband or physical line to rule out my equipment.

It is all in the cupboard on standby which I just swap out the VDSL cables over so my ISP can run tests and they have remote access to it I think through TRS069/ACS? and yes there are options to switch it off if I wanted to. Once they they are satisfied that all the tests have been done and if there is a fault they send out Openreach to investigate further.

One flaw with their router which is a Technicolour DWA0120 is that they set it to expose the built in webserver to port 80 of the gateway IP so anybody including the proxy server I tried it with can access it. No option to switch that off in the User or Engineers menu and no telnet access to do so. The config file and be decryped and encrypted but needs to be signed with a key for it to accept it. I spoke to someone a couple of months ago and apparently I can request them to switch off port 80 web server from being access by the gateway IP if I turn on the remote access stuff and they are able to connect to it. I think they refer to that as a dictionary "attack" when trying to guess the passwords if not trying by known vulnerabilities and no password attempt lockout policy is set.

[MrMobodies]

Great... Downgrading the Firmware of your internet router...
The one device that will always be susceptible to outside attack, that is the first, and in most SOHO settings your only, defense... Welcome to the next botnet

Just do not buy that crap.

Just found this article:
https://threatpost.com/linksys-smart-wi-fi-safe-home-router-flaws-classic-configuration-vulnerable-041113/77720/

Linksys Smart Wi-Fi Safe from Home Router Flaws; Classic Configuration Vulnerable
Author: Michael Mimoso
April 11, 2013  5:57 pm

Cisco clarified today that its Linksys EA2700 home routers running the new Smart Wi-Fi firmware released last June are immune to vulnerabilities disclosed this week by a researcher. EA2700 routers, however, that are still running on the classic EA2700 configuration remain vulnerable to a host of flaws and more than 2,000 vulnerable to an authentication bypass exploit can be found on the Shodan search engine. Cisco clarified today that its Linksys EA2700 home routers running the new Smart Wi-Fi firmware released last June are immune to vulnerabilities disclosed this week by a researcher. EA2700 routers, however, that are still running on the classic EA2700 configuration remain vulnerable to a host of flaws and more than 2,000 vulnerable to an authentication bypass exploit can be found on the Shodan search engine. A Linksys representative told Threatpost via email that the Smart Wi-Fi firmware, pushed close to a year ago, is not vulnerable to a handful of serious vulnerabilities in the home routers that are still present in boxes not running the new firmware. The flaws include cross-site scripting, file path traversal and authentication bypass vulnerabilities.

“If customers use methods of setup and configuration other than the methods recommended by Linksys, such as using Web browser setup (192.168.1.1), or if customers use older firmware, they could be at risk of potential attacks,” the Linksys representative said. “Accordingly, all Linksys EA customers are strongly encouraged to upgrade to the new Smart Wi-Fi firmware.”

A quick search on Shodan, a search engine created for the purpose of finding servers, routers, network devices and more that sit online, found 2,073 home routers vulnerable to an authentication bypass vulnerability disclosed by researcher Phil Purviance this week. Users can use Shodan to filter searches to find specific equipment by manufacturer, function and even where they’re located geographically.

“You can get a list of those routers with remote access enabled, meaning the owner of the router decided he may be away from home and still need to manage his options and settings, Purviance said. “Those 2,000 devices are all running the classic version of the firmware and you can take that authentication bypass vulnerability, exploit it and got to any one of those sites, change the password and get access to it.”

Purviance reported his findings to Cisco on March 5 and after an initial response from the company asking for the model number of version of the router he analyzed, never got a second response. No patches are available that repair the bugs in the classic set up. Purviance said he dug into the administration features on the router’s embedded management website, apply.cgi, and the vulnerabilities he found range in severity and simplicity to exploit.

“Any potential issues arising from the cited vulnerabilities have been eliminated in the latest version of the Linksys Smart Wi-Fi firmware that was made available last June. “This update was made seamlessly for customers with Smart Wi-Fi accounts,” the Linksys representative said. “ Those who have not signed up for Smart Wi-Fi were alerted to upgrade manually and are strongly encouraged to update their firmware to ensure that they have eliminated any potential issues relating to the cited vulnerabilities.”

Some users apparently balked at a forced upgrade on the EA routers, which were released in April and upgraded to the new firmware in June. Users were asked to register for a cloud-based service to enable automatic updates, transitioning router management to the user’s new Smart Wi-Fi account, and off the embedded Web-enabled interface. Purviance said language in the initial terms of service indicated Cisco could monitor the new cloud-based accounts, a situation that has since changed, he added.

“*There are still a lot of people running the classic model firmware and they are provided updates separately,” Purviance said, adding that the classic firmware option is still available as a download for users who want to downgrade off Smart Wi-Fi and manage their own device. “That’s what’s vulnerable, and not Smart Wi-Fi.”

Purviance discovered four serious vulnerabilities on the routers: a cross-site scripting flaw that could enable an attacker to modify the device and firmware; a file path traversal bug that could give an attacker remote access to password or configuration files; a cross-site request forgery vulnerability that would allow an attacker to change log-in information and remotely control the router; and a source-code disclosure vulnerability where an attacker could modify the URL of the admin interface and be presented with raw source code.

“We have and will continue to urge our customers to use our recommended methods of setup and configuration, and to change their user names and passwords periodically,” the Linksys representative said.

Looks like that classic firmware wasn't going to be of any help.
*Shame they couldn't wouldn't maintain the classic firmware version to appease the "lot" of people sticking to it.