[00:00.000 --> 00:02.600]  Talking about defensive computing for a very long time.
[00:03.500 --> 00:10.960]  The URL for my blog is kind of long, but it's alias at defensivecomputing.info - there it is on Computer World.
[00:11.160 --> 00:13.840]  I used to blog on defensive computing for CNET years back.
[00:15.540 --> 00:29.420]  And again, for those of you who didn't hear it because I wasn't talking into the microphone, the full handout here is available in PDF format at my personal site because chances are I'm not going to hit slide number 81 by the time we're done.
[00:31.200 --> 00:31.920]  Level set.
[00:32.200 --> 00:34.520]  I'm going to skip level setting because this is HOPE.
[00:34.840 --> 00:39.100]  The only thing I'm going to say about level setting is about firmware, which is the operating system for a router.
[00:39.580 --> 00:45.920]  One thing that's been kind of encouraging is that here at HOPE, the last two days, I've run across three new router firmwares.
[00:46.820 --> 00:50.500]  The EFF is creating a brand new firmware based on OpenWRT.
[00:51.120 --> 00:52.320]  Looks like it'll be good.
[00:52.480 --> 00:53.380]  It's not ready yet.
[00:53.480 --> 00:55.380]  Who knows what it'll be like in six months or a year.
[00:55.740 --> 00:57.400]  And a couple others here.
[00:57.560 --> 01:00.640]  There was the first day, there was a talk at 11 p.m.
[01:00.740 --> 01:01.740]  about travel routers.
[01:02.160 --> 01:04.360]  A couple biker dudes.
[01:04.740 --> 01:11.020]  They're working on a new router with new firmware and that sounds like it's going to be great, but I have no idea when it's going to be available.
[01:15.760 --> 01:17.600]  All right, we'll skip this because it's HOPE.
[01:19.060 --> 01:20.860]  Okay, routers make a great target.
[01:21.140 --> 01:27.120]  I realize in saying this that I am preaching to the choir because everyone came here for a talk about routers.
[01:27.980 --> 01:30.360]  This was back in September 2013.
[01:30.820 --> 01:34.620]  Everyone here at HOPE has to make a mandatory reference to Edward Snowden.
[01:34.620 --> 01:39.860]  So, this came from the Snowden revelations back in September of last year.
[01:40.500 --> 01:42.240]  NSA, but of course, why do you want to hack a router?
[01:42.420 --> 01:44.880]  Obviously, it sits in between all your Internet conversations.
[01:45.100 --> 01:48.040]  You hack one device, you get access to a lot of different devices.
[01:49.780 --> 01:56.100]  Greenwald, when his book came out last May, he gave some more details about how the NSA hacks routers.
[01:56.480 --> 02:01.040]  And this is perhaps the iconic image, the image that will be remembered 30 years from now.
[02:01.320 --> 02:03.860]  This came from Glenn Greenwald.
[02:03.860 --> 02:12.700]  And this shows the NSA intercepting a Cisco router from the post office, opening up the box, and they're going to close up the box and send it to some poor victim.
[02:16.380 --> 02:21.620]  And of course, back in May, needless to say, the Chinese didn't want any of our routers.
[02:22.760 --> 02:29.780]  And that's not news because this was back from October 2012, where the United States didn't want any routers from China either.
[02:30.940 --> 02:33.820]  So routers have been a target for a long, long time.
[02:35.080 --> 02:37.020]  A compromised router, what can it do?
[02:44.380 --> 02:46.000]  The obvious thing, it can spy on you.
[02:46.140 --> 02:52.080]  The not so obvious thing, of course, is man in the middle attacks and read all your secure SSL TLS traffic.
[02:52.860 --> 02:56.680]  A number of speakers here have mentioned Moxie Marlin spikes SSL strip.
[02:57.300 --> 03:01.360]  That's child's play, because that is detected by fairly easily.
[03:02.320 --> 03:04.580]  But there are boxes that you can buy.
[03:04.800 --> 03:06.220]  This came out a couple years ago.
[03:06.420 --> 03:07.080]  It was a big scandal.
[03:07.380 --> 03:12.580]  You can buy boxes that will dynamically generate literally valid certificates on the fly.
[03:13.560 --> 03:17.900]  So there's really no way for you to know if your SSL traffic is being watched.
[03:19.240 --> 03:21.840]  Obviously, compromised router, alter non-encrypted data.
[03:21.980 --> 03:22.600]  That's pretty easy.
[03:22.840 --> 03:25.700]  And the other thing is send you to Evil Twin websites.
[03:26.400 --> 03:28.000]  This really doesn't get a lot of attention.
[03:28.280 --> 03:31.480]  Evil Twin, of course, people here know it refers to Wi-Fi networks.
[03:32.060 --> 03:37.160]  But if you ran the NSA, what would you do?
[03:37.540 --> 03:39.380]  Assuming you were competent and intelligent.
[03:41.380 --> 03:42.480]  You'd go after Tails.
[03:43.900 --> 03:46.680]  Everyone here, most people here know what Tails is.
[03:46.680 --> 03:49.760]  It's a Linux distribution that sends all the output through Tor.
[03:50.560 --> 03:54.260]  If you have any reason for privacy, Tails is the best way to go.
[03:54.520 --> 03:55.600]  You cannot make a mistake.
[03:55.800 --> 03:57.760]  That whole Tor bundle thing is ridiculous.
[03:58.300 --> 03:59.900]  If you want privacy, you go to Tails.
[04:00.020 --> 04:00.820]  You can't make a mistake.
[04:00.980 --> 04:02.500]  If you're in Tails, everything goes through Tor.
[04:03.160 --> 04:11.380]  So, of course, if you ran a spy agency, you would love to have people download a compromised version of Tails.
[04:12.260 --> 04:13.420]  And how would you do that?
[04:13.500 --> 04:14.260]  You'd infect the router.
[04:14.620 --> 04:19.180]  And you'd send them to a scam copy of Tails.baume.org.
[04:19.520 --> 04:22.080]  A spy agency created copy of it.
[04:22.260 --> 04:26.180]  They download Tails and they get a copy of Tails with a backdoor.
[04:33.650 --> 04:38.230]  And, of course, there's a lot of protection information at Tails.baume.com.
[04:38.230 --> 04:40.470]  Here it says how to verify the ISO image.
[04:40.830 --> 04:42.490]  Well, that's chapter three of the book.
[04:42.630 --> 04:46.050]  The first chapter is, are you really at Tails.baume.org?
[04:46.150 --> 04:53.350]  Because if you're at a spy agency copy of the website, they'll, of course, have their own instructions here.
[04:53.850 --> 04:56.310]  And here there's all sorts of warnings about running Tails.
[04:56.610 --> 04:59.710]  And these are very valid warnings about things that can go wrong, what have you.
[04:59.710 --> 05:04.390]  But this all assumes that you're at the real Tails.baume.org.
[05:05.490 --> 05:10.630]  Nowhere here do they say, you know, the software you're downloading may have a backdoor in it, because this is not the real website.
[05:13.370 --> 05:17.230]  How do you actually redirect someone to an evil website if you're in control of the router?
[05:17.730 --> 05:20.190]  The most obvious one is malicious DNS servers.
[05:20.490 --> 05:23.910]  You simply change the DNS resolution instead of the real...
[05:24.230 --> 05:26.610]  Now, of course, I don't know if that's the real IP address.
[05:26.610 --> 05:28.670]  You know, I checked this a couple months ago.
[05:29.690 --> 05:30.670]  How are we going to know?
[05:31.430 --> 05:32.890]  Nowhere at the Tails about...
[05:32.890 --> 05:34.950]  I mean, does anyone here know who runs that website?
[05:35.210 --> 05:36.410]  Does anyone know where it is?
[05:36.870 --> 05:37.990]  I mean, I looked back at me.
[05:38.110 --> 05:38.930]  It seemed to be in Seattle.
[05:39.350 --> 05:40.410]  But I don't know.
[05:46.610 --> 05:50.490]  There are a couple other ways that a malicious router could send you to an evil twin website.
[05:50.950 --> 05:53.330]  In the interest of time, I will skip those.
[05:55.150 --> 05:55.550]  So...
[06:03.940 --> 06:07.960]  So the best thing you can do, of course, as far as your router goes, is be a lesser target.
[06:09.140 --> 06:11.500]  Spy agencies, of course, can get into Cisco and Juniper.
[06:12.200 --> 06:17.220]  At least twice that I know of, the Cisco firmware, source code for Cisco firmware has been stolen.
[06:17.940 --> 06:22.360]  Not to mention the iconic picture that Glenn Greenwald gave us a few months ago.
[06:23.300 --> 06:24.820]  And, of course, on the home front, they.
[06:24.960 --> 06:26.540]  Now, by they, that was a bad term.
[06:26.660 --> 06:29.860]  By they, I mean either spy agencies or just your average bad guys.
[06:31.220 --> 06:33.680]  They're going to go after the most popular routers.
[06:33.880 --> 06:35.920]  That's why Windows is attacked, because most people use it.
[06:36.900 --> 06:39.580]  If a router is sold at Best Buy, you don't want to buy it.
[06:40.460 --> 06:44.260]  If there's anything you remember out of this talk, it's that one sentence.
[06:44.980 --> 06:49.260]  That is the most important sentence I'm going to say in the next 55 minutes.
[06:50.900 --> 06:55.380]  The other is that if your router is given to you by your Internet service provider, you don't want to use it either.
[06:55.380 --> 07:01.680]  Because they give away millions of them, and that makes them a prime target both for spy agencies and bad guys.
[07:02.820 --> 07:18.500]  If you are given a single box, which most people I think call a gateway, which is a combination modem and router, you can, you should be able to contact your ISP and have them dumb down the box so that it acts as just a modem, and then you can add your own router to it.
[07:19.060 --> 07:20.820]  I know I've done that with Time Warner.
[07:21.120 --> 07:23.740]  Can anyone here confirm that other ISPs will do that too?
[07:27.110 --> 07:27.910]  Comcast doesn't?
[07:28.810 --> 07:34.870]  I've read, you know, regarding Comcast's Xfinity Wi-Fi system, I have heard people say that they will do that.
[07:35.290 --> 07:39.950]  You know what I really think is any safer, considering it's still the same firmware and hardware to do it?
[07:40.130 --> 07:41.870]  Well, but it's only functioning as a modem.
[07:42.230 --> 07:45.250]  Yeah, but who's saying it's functioning as a modem in quotes?
[07:45.570 --> 07:45.870]  Yeah.
[07:46.230 --> 07:49.770]  It needs to be nothing, I guess.
[07:49.970 --> 07:51.010]  Better than nothing, yeah.
[07:55.810 --> 07:57.430]  Okay, how do you configure a router?
[07:57.430 --> 07:58.930]  There's a million different ways.
[07:59.210 --> 08:02.310]  Most of us who've done it do it with the internal administrative website.
[08:02.770 --> 08:04.850]  Needless to say, there are more smartphone apps coming.
[08:06.110 --> 08:07.670]  All the time, who has them?
[08:08.210 --> 08:10.770]  Oh, NETGEAR and Linksys have smartphone apps at the moment.
[08:11.210 --> 08:13.130]  Cloud management via vendor websites.
[08:13.850 --> 08:15.530]  This is a really bad idea.
[08:15.730 --> 08:21.210]  If your router offers that, I would not do it, because now you're trusting another person in between you and your router.
[08:29.670 --> 08:30.470]  Oh, Cablevision.
[08:30.770 --> 08:33.950]  Cablevision offers that, as does Linksys.
[08:35.350 --> 08:37.250]  You've heard of Cisco's Cloud Connect.
[08:37.970 --> 08:40.390]  That's letting Cisco's website get into your router.
[08:40.690 --> 08:42.410]  I just don't like that idea at all.
[08:43.370 --> 08:44.510]  And, of course, Apple.
[08:44.750 --> 08:46.530]  UPnP, we're going to talk about a lot more.
[08:47.610 --> 08:52.650]  Telnet and SSH, if you see those in configuration options in a router, you kind of want to turn those off.
[09:00.170 --> 09:06.190]  If you're going to use the administrative website, the internal website in the router, the first thing you need to know is what's the IP address of the router.
[09:06.750 --> 09:08.510]  Probably everyone here can figure that out.
[09:08.830 --> 09:12.310]  But those of you who can't, I blogged about this in September 2013.
[09:12.310 --> 09:14.910]  It covers all the popular operating systems.
[09:22.250 --> 09:25.550]  Yeah, any article about securing a router is going to say these obvious things.
[09:25.670 --> 09:27.570]  Change your router password and update the router firmware.
[09:30.790 --> 09:32.750]  About the firmware, a couple things to say.
[09:32.750 --> 09:33.990]  You think it's a pretty boring topic.
[09:34.110 --> 09:35.370]  Of course, you have to update the router firmware.
[09:36.230 --> 09:39.290]  First of all, some routers, the way they handle this varies.
[09:39.510 --> 09:40.590]  Some do absolutely nothing.
[09:41.070 --> 09:42.750]  Some offer you a little manual check.
[09:42.870 --> 09:44.850]  You can go online, check a box, is there new firmware?
[09:46.030 --> 09:47.550]  Some routers may check on their own.
[09:48.230 --> 09:52.290]  So as soon as you log on, there may be a blinking thing that says, hey, there's new firmware here.
[09:53.010 --> 09:56.750]  One router, I can't remember which one it was, would actually send you an email when there was new firmware.
[09:57.530 --> 09:58.550]  Anyone know who that is?
[09:58.730 --> 10:00.110]  Has anyone seen that in any other routers?
[10:02.250 --> 10:02.970]  Linksys does it?
[10:03.650 --> 10:04.250]  I can't.
[10:04.290 --> 10:04.790]  It's been too long.
[10:04.870 --> 10:05.710]  I can't remember who does it.
[10:06.690 --> 10:07.830]  Self-update automatically.
[10:08.330 --> 10:10.770]  I don't know, really, the routers that do that.
[10:11.110 --> 10:14.010]  I've seen that Verizon's Action Tech kind of says it can do it.
[10:14.050 --> 10:14.790]  I haven't tested it.
[10:15.670 --> 10:20.870]  One thing I will say about the new software coming from the EFF, they promised that it will self-update.
[10:20.870 --> 10:26.290]  And it will update itself through Tor, which if they really get that out the door, that would be a great thing.
[10:32.020 --> 10:35.660]  Okay, a lot of people don't update the firmware in the routers because...
[10:35.660 --> 10:37.860]  This really should not say new firmware is risky.
[10:37.980 --> 10:38.760]  That kind of goes without saying.
[10:38.860 --> 10:44.000]  These are defensive steps you can take if you're updating the firmware so that you don't get screwed.
[10:57.710 --> 11:01.890]  But of course, a lot of people don't update the firmware simply because it's too dangerous.
[11:02.270 --> 11:03.970]  Your Internet access is too important.
[11:04.970 --> 11:06.070]  Having a spare router.
[11:06.490 --> 11:08.070]  I know someone who has a spare router.
[11:08.230 --> 11:12.090]  I gave someone a new router, all configured, and he had an old router.
[11:12.210 --> 11:13.610]  All he has to do is swap the two routers.
[11:13.730 --> 11:15.690]  If there's anything wrong with the new one, no big deal.
[11:15.770 --> 11:16.870]  You unplug it, you put the old one back.
[11:17.090 --> 11:18.430]  Still too afraid to do it.
[11:18.750 --> 11:21.870]  Internet access is obviously very important to a lot of people.
[11:24.030 --> 11:25.810]  So, here's a step up in class.
[11:26.930 --> 11:29.430]  This is a company called PepLink.
[11:29.930 --> 11:31.730]  PepWave is a small division from them.
[11:32.210 --> 11:35.990]  And this is a safe way that you can update firmware.
[11:36.430 --> 11:37.730]  You notice here at the bottom.
[11:38.310 --> 11:40.350]  This router keeps two copies of the firmware.
[11:41.750 --> 11:45.450]  So, you can, on a Tuesday, download the new firmware and then not use it.
[11:45.850 --> 11:46.990]  You can continue running the router.
[11:47.150 --> 11:49.610]  It comes Saturday when the Internet access is not all that important.
[11:49.850 --> 11:51.650]  You boot the new firmware, run it for a while.
[11:51.650 --> 11:52.810]  If there's no problems, keep it.
[11:52.870 --> 11:55.850]  If there's any problems, you reboot and back up and run the older firmware.
[11:57.070 --> 12:02.670]  Does anybody else know other routers under $1,000 that offer you multiple firmwares?
[12:04.450 --> 12:05.350]  For cheap?
[12:06.190 --> 12:06.870]  You bet.
[12:11.840 --> 12:12.720]  Excuse me?
[12:12.820 --> 12:13.980]  The NETGEAR 401.
[12:14.520 --> 12:15.320]  The NETGEAR...
[12:16.780 --> 12:18.940]  Do you have any idea roughly how much those cost?
[12:21.100 --> 12:21.540]  500?
[12:22.880 --> 12:25.140]  Okay, let me say a few words about PepLink.
[12:25.780 --> 12:27.700]  I know it says PepWave on the thing.
[12:27.840 --> 12:29.760]  That's like a small division within the company.
[12:29.840 --> 12:30.780]  The company is called PepLink.
[12:31.000 --> 12:33.180]  And their website is peplink.com.
[12:33.420 --> 12:34.700]  I do not work for them.
[12:35.480 --> 12:42.320]  But what PepLink is, is a professionally run router company.
[12:43.660 --> 12:47.580]  And within that category, of course, there's thousands of professionally run routers.
[12:47.820 --> 12:49.880]  But they offer something that's actually cheap.
[12:50.560 --> 12:54.100]  This thing in the picture, this router, it was $130.
[12:55.720 --> 12:57.560]  And it offers you dual firmware.
[12:58.780 --> 13:02.780]  On top of that, most routers are sold to consumers based on three things.
[13:02.940 --> 13:06.500]  The number of features, how fast it is, and how much it costs.
[13:07.400 --> 13:09.720]  PepLink does not compete on any one of those things.
[13:10.580 --> 13:12.900]  They do not sell to consumers.
[13:13.180 --> 13:14.480]  They're a business class.
[13:15.880 --> 13:19.820]  The reason they're in business is they're a multi-WAN router company.
[13:19.900 --> 13:20.940]  That's what they specialize in.
[13:21.400 --> 13:23.200]  Your Internet access is really important.
[13:23.200 --> 13:25.400]  You do not have one Internet service provider.
[13:25.540 --> 13:26.760]  You have two or three or four.
[13:27.120 --> 13:32.780]  And if you have three Internet connections and one of them fails, you want to be connected to a PepLink router.
[13:32.920 --> 13:33.800]  Because that's what they do.
[13:34.080 --> 13:36.720]  They round robin across multiple ISPs.
[13:37.380 --> 13:39.920]  And if one of those ISPs fails, you don't know.
[13:39.920 --> 13:40.520]  You don't care.
[13:40.660 --> 13:41.840]  Your network keeps chugging.
[13:42.240 --> 13:43.640]  That's their claim to fame.
[13:43.780 --> 13:44.800]  That's their business model.
[13:44.900 --> 13:45.480]  That's what they do.
[13:45.720 --> 13:47.380]  They do not sell based on price.
[13:47.500 --> 13:48.840]  They do not sell based on features.
[13:49.200 --> 13:50.760]  They do not sell based on speed.
[13:51.160 --> 13:55.720]  Until roughly a year and a half ago, their cheapest router was $300.
[13:56.380 --> 14:00.540]  That supplied two ISPs and no Wi-Fi at all.
[14:01.960 --> 14:05.820]  This router, which is $130 without the Wi-Fi antennas.
[14:05.880 --> 14:07.420]  They have internal antennas.
[14:07.700 --> 14:11.180]  If you need better Wi-Fi performance, they'll sell you external antennas.
[14:11.260 --> 14:13.600]  That bumps the price up to $160.
[14:16.260 --> 14:18.080]  This has slow Ethernet connections.
[14:18.240 --> 14:19.880]  These are not gigabit Ethernet ports.
[14:20.360 --> 14:22.240]  This is not a dual-band router.
[14:22.400 --> 14:23.740]  It does one band at a time.
[14:23.940 --> 14:24.680]  It can do five gigahertz.
[14:25.220 --> 14:27.380]  But if you set it for five gigahertz, it's not going to do 2.4.
[14:27.380 --> 14:29.920]  They are not selling based on features here.
[14:30.060 --> 14:33.820]  You cannot plug a USB flash drive in here and have it share on your LAN.
[14:34.200 --> 14:36.260]  This is a business class company.
[14:36.700 --> 14:39.700]  And yet you can get something like that for $130.
[14:40.800 --> 14:44.620]  It's a big step up from Asus and Belkin and D-Link and the like.
[14:45.440 --> 14:47.600]  Is that because of the load balance as well?
[14:48.460 --> 14:48.940]  Yes.
[14:50.580 --> 14:53.380]  It's really impressive if you have multiple ISPs.
[14:53.380 --> 14:55.340]  The way it load balances across.
[14:55.800 --> 14:58.260]  On their cheap stuff, which is under $1,000.
[14:58.600 --> 15:01.760]  I think there's five different algorithms you can choose for load balancing.
[15:02.220 --> 15:07.540]  On their really expensive stuff, which are a few thousand dollars, there's like nine different algorithms for how they load balance.
[15:08.640 --> 15:09.780]  Yeah, that's what they do.
[15:09.960 --> 15:11.160]  That's what they do for a living.
[15:14.400 --> 15:20.000]  Yeah, if you want fast connections within your LAN, yeah, you can hook a gigabit switch into it.
[15:20.000 --> 15:25.500]  But that cheapy router for $130, yeah, that has the slower 100 speed Ethernet.
[15:25.780 --> 15:28.340]  Do you recommend a dealer for that router?
[15:28.860 --> 15:30.000]  Just peplink.com.
[15:30.140 --> 15:31.780]  There are very few dealers for them.
[15:34.700 --> 15:36.620]  Yeah, but they're all at peplink.com.
[15:38.160 --> 15:40.980]  SSID, there really isn't too much to say about it securely.
[15:41.260 --> 15:43.760]  The most important thing is, of course, you change the default.
[15:43.980 --> 15:47.080]  And the other important thing is you don't give away any personal information.
[15:47.080 --> 15:49.880]  This is one of my favorite SSIDs.
[15:50.220 --> 15:52.300]  Obviously, some techie set it up for his mother.
[16:01.300 --> 16:04.640]  Oh, it says, mom, click here for Internet.
[16:05.000 --> 16:06.360]  That is the SSID.
[16:09.880 --> 16:14.760]  So, yeah, if you live in an apartment building, you live in apartment 3G, don't call your SSID apartment 3G.
[16:14.820 --> 16:15.860]  Call it apartment 5F.
[16:20.580 --> 16:26.620]  When it comes here to the 2.4 gigahertz versus 5 gigahertz, everyone in the world will tell you use 5 gigahertz bands.
[16:26.800 --> 16:27.200]  It's faster.
[16:27.340 --> 16:28.020]  There's less interference.
[16:28.280 --> 16:30.380]  But there's also a security aspect to it.
[16:30.580 --> 16:35.200]  The 5 gigahertz band does not travel as far as the 2.4 gigahertz band.
[16:35.760 --> 16:45.420]  So, if there is some bad guy in your neighborhood a block or two away, he might see your 2.4 gigahertz network, but he might not see your 5 gigahertz network.
[16:45.840 --> 16:47.580]  So, it's a small security thing.
[16:47.700 --> 16:50.900]  But if you can, you want to consider turning off 2.4 gigahertz.
[16:50.900 --> 16:52.420]  It just leaks a little bit less.
[16:54.700 --> 16:55.240]  Excuse me?
[16:55.420 --> 16:57.500]  Oh, for some routers, you can crank the power down.
[16:57.740 --> 16:58.280]  Oh, that's true.
[16:58.400 --> 16:58.540]  Yes.
[16:58.680 --> 17:06.100]  For some routers, you can crank the power down so that the teenager across the street doesn't see your network.
[17:16.080 --> 17:16.440]  Okay.
[17:16.580 --> 17:17.780]  This is the most obvious stuff.
[17:18.320 --> 17:25.710]  What's not so obvious is even if you do WPA2, some routers are going to ask you a question after you choose WPA2.
[17:26.040 --> 17:27.660]  The right answer is AES.
[17:27.820 --> 17:28.970]  The right answer is CCMP.
[17:29.230 --> 17:30.540]  The wrong answer is TKIP.
[17:31.990 --> 17:36.040]  Some routers do not have an option to do just WPA2 only.
[17:36.620 --> 17:37.400]  And this is...
[17:37.400 --> 17:38.620]  You know, PEPLINK's not perfect.
[17:38.710 --> 17:39.250]  I don't work for them.
[17:39.320 --> 17:45.640]  This is the worst thing about that PEPLINK router, is the only choice they offer you is combination WPA and WPA2.
[17:46.400 --> 17:49.700]  You cannot lock out WPA from their Wi-Fi.
[17:50.360 --> 17:51.490]  It's 130 bucks.
[17:52.860 --> 17:55.580]  Now, WPA2, of course, needs a very, very long password.
[17:56.250 --> 18:02.960]  Another point, frequently, when this topic is embraced in the media, people skip over the long passwords.
[18:03.470 --> 18:04.640]  Now, let's be honest.
[18:05.400 --> 18:06.510]  How long a password do you need?
[18:06.750 --> 18:07.840]  This is from Steve Gibson.
[18:08.010 --> 18:08.710]  Perfect passwords.
[18:09.330 --> 18:10.840]  64 random characters.
[18:11.180 --> 18:12.620]  This is, of course, ridiculous.
[18:12.920 --> 18:14.340]  Even Mr. Gibson gave up on this.
[18:14.340 --> 18:16.280]  He couldn't log on to his own Wi-Fi network.
[18:21.760 --> 18:22.120]  Yeah?
[18:22.840 --> 18:27.060]  I mean, the maximum WPA2 password is, you know, the tables are generated up to.
[18:27.100 --> 18:31.220]  Because you can download the tables, and it's based on the SSID name.
[18:31.580 --> 18:34.400]  So I think they're only up to, like, 14 or 15 digits.
[18:34.640 --> 18:38.840]  So when I secure something from my customers, when they usually have 20 digits, I mean, on the same side.
[18:38.960 --> 18:40.180]  I do not think you need it.
[18:40.500 --> 18:40.860]  Yes.
[18:41.000 --> 18:42.060]  I completely agree.
[18:42.220 --> 18:44.240]  The comment was, how long does the password need to be?
[18:44.420 --> 18:48.040]  And I hear, have my notes 15 to 20 characters, is probably enough.
[18:50.500 --> 18:52.640]  There's so much bad advice about passwords.
[18:52.960 --> 18:56.860]  Of course, every article in the world says to use a password like that at the top.
[18:57.020 --> 19:01.740]  This is a miserable password, both because you can't remember it and because it's way too short.
[19:02.280 --> 19:03.560]  So here's a good password.
[19:03.680 --> 19:04.460]  New York Yankees.
[19:04.640 --> 19:07.160]  New York Yankees with two periods around each word.
[19:07.620 --> 19:09.040]  Dot, dot, new, dot, dot.
[19:09.040 --> 19:13.180]  This is both easy to remember and pretty darn long.
[19:14.620 --> 19:17.900]  So this whole idea of random passwords is just stupid.
[19:18.120 --> 19:22.540]  I've never seen so many smart people say so many dumb things, except when it comes to choosing passwords.
[19:23.720 --> 19:26.140]  All these passwords here are really good.
[19:26.240 --> 19:29.440]  The one that, like, you like being a smart ass, this is your password, this is my password.
[19:29.720 --> 19:33.100]  You know, if you put 12 greater than signs in front of it, it's a good password.
[19:33.100 --> 19:34.280]  And it's easy to remember.
[19:34.440 --> 19:36.600]  12 greater than signs and then this is my password.
[19:37.460 --> 19:41.140]  It's really long, defeats brute force, and it's easy to remember.
[19:46.700 --> 19:50.400]  And now that you've chosen a great password, don't hook up any light bulbs.
[19:50.800 --> 19:52.940]  This came out just like a week, a week and a half ago.
[19:54.740 --> 20:00.480]  It was LIFX was the name of the company and their light bulbs could be hacked and give out your Wi-Fi password.
[20:03.300 --> 20:06.960]  And does any people here have any idea what the next slide is going to be?
[20:06.980 --> 20:08.680]  about leaking Wi-Fi passwords?
[20:09.680 --> 20:11.720]  Another great way to leak a Wi...
[20:11.720 --> 20:12.560]  Cell phones.
[20:12.680 --> 20:13.960]  Cell phones.
[20:14.820 --> 20:15.880]  Yes and no.
[20:17.840 --> 20:18.440]  Android.
[20:19.240 --> 20:20.560]  Cell phone or tablet.
[20:21.920 --> 20:24.800]  Google knows nearly every Wi-Fi password in the world.
[20:25.580 --> 20:31.180]  And I say that because those of you who have an Android device, you pull out...
[20:33.290 --> 20:38.410]  If you're running Android version 4, it's under settings, backup and reset, and then backup my data.
[20:40.590 --> 20:44.610]  So yeah, Google is nicely backing up all sorts of settings on your phone.
[20:44.890 --> 20:47.510]  And including those settings are your Wi-Fi password.
[20:48.130 --> 20:49.250]  This is not a surprise.
[20:49.430 --> 20:51.070]  Apple backs up your Wi-Fi password too.
[20:51.270 --> 20:52.030]  It's part of iCloud.
[20:52.270 --> 20:53.310]  It's specifically Keychain.
[20:54.730 --> 21:00.850]  But the interesting part about Google knowing your Wi-Fi password is that they back it up in a format that they can read it.
[21:01.650 --> 21:05.470]  And of course, if Google can read it, the NSA can make Google turn it over.
[21:07.090 --> 21:09.550]  And some earlier presentation hope...
[21:09.550 --> 21:11.850]  I think there were like 600 million iPhones out there.
[21:12.750 --> 21:14.490]  Android has 78% of the market.
[21:14.490 --> 21:17.130]  So how many billion Android devices are there?
[21:17.270 --> 21:18.930]  Three or four billion Android devices.
[21:19.390 --> 21:23.590]  And most of those devices, by default, will be backing up settings to Google.
[21:24.050 --> 21:26.730]  And Google can read your Wi-Fi password.
[21:26.950 --> 21:29.730]  Which means, of course, the U.S. government can read your Wi-Fi password.
[21:30.750 --> 21:32.150]  I am not a hacker.
[21:32.370 --> 21:33.730]  I didn't discover this.
[21:34.190 --> 21:36.270]  I blogged on this September of last year.
[21:37.430 --> 21:41.690]  Basically, all this article was was a summary of other research that other people had done.
[21:42.230 --> 21:44.930]  I think this was first written about in 2011.
[21:46.490 --> 21:48.970]  I read about it from the EFF website.
[21:49.390 --> 21:51.350]  Someone named Micah Lee wrote about it.
[21:51.430 --> 21:54.330]  He tried to get a lot of stink and make it public.
[21:54.490 --> 21:55.430]  And it really went nowhere.
[21:55.670 --> 21:58.050]  He submitted as a bug to Google and that went nowhere.
[21:58.530 --> 21:59.930]  I don't know if Micah is in the audience.
[22:00.070 --> 22:01.010]  I know he was here yesterday.
[22:04.070 --> 22:06.410]  Now, of course, Google is probably not the worst company in the world.
[22:06.550 --> 22:08.530]  As I said, Apple also knows your password.
[22:08.710 --> 22:09.410]  It's in the keychain.
[22:09.850 --> 22:13.230]  Of course, Apple swears that they can't read the keychain data.
[22:14.270 --> 22:15.910]  You can choose to believe that or not.
[22:16.130 --> 22:20.950]  Even if it's true, of course, Apple can still be compelled to turn it over to the U.S. government.
[22:21.150 --> 22:26.070]  And who's to say that someone in the U.S. government can't get your Wi-Fi password even if Apple can't?
[22:27.250 --> 22:28.470]  I don't know what you do about it.
[22:28.530 --> 22:29.670]  Well, there's a number of things.
[22:29.790 --> 22:31.230]  I've got another 50 slides here.
[22:34.290 --> 22:37.230]  But yeah, this is annoying because even if you tell...
[22:37.230 --> 22:39.970]  First thing you might want to do is change your Wi-Fi password.
[22:40.330 --> 22:47.870]  But if any Android device logs on to your network and that device is set up to backup settings to Google, you're hosed.
[22:51.220 --> 22:58.340]  I guess the only good news is that probably the NSA doesn't want to send someone to stand a quarter of a mile from your house and get in.
[22:58.460 --> 22:59.220]  They can do it better.
[22:59.760 --> 23:02.780]  So this is probably an old way of getting your Wi-Fi password.
[23:02.780 --> 23:04.400]  How many people knew this?
[23:07.360 --> 23:07.840]  Wow.
[23:08.700 --> 23:09.880]  Not all that many.
[23:10.780 --> 23:11.860]  Not all that many.
[23:16.480 --> 23:18.840]  I'm not going to speak to the other passwords.
[23:24.400 --> 23:25.960]  Oh, by the way, if...
[23:25.960 --> 23:28.220]  You know, I hate Windows 8 as much as anyone else.
[23:28.440 --> 23:31.720]  But Microsoft is forcing you to log on now with a Microsoft ID.
[23:32.140 --> 23:36.480]  And as part of that, Microsoft is backing up assorted settings to their data center.
[23:36.480 --> 23:39.520]  I have no idea if they can read your Wi-Fi passwords too.
[23:39.740 --> 23:42.260]  But if they could, it wouldn't surprise the heck out of me.
[23:45.310 --> 23:48.670]  So if someone's on your local network, what's your first line of defense?
[23:49.150 --> 23:51.630]  And that is locking down local administration.
[23:52.170 --> 23:58.090]  Local administration is the normal way you configure a website, open your browser, go to the IP address of the router.
[23:58.330 --> 24:00.610]  So the worst thing you can do is just plain HTTP.
[24:01.470 --> 24:03.750]  Some routers will let you change the port number.
[24:04.130 --> 24:09.550]  So if you want to get into the administrative website, use port 22999, just something I picked at random.
[24:10.190 --> 24:15.350]  Some routers will let you enforce HTTPS if you want to get to the local administrative website.
[24:15.830 --> 24:18.050]  And, of course, the best routers will let you do both.
[24:18.910 --> 24:29.130]  Again, you can read 8 million router reviews and not one of them is going to say, oh, by the way, this router lets you lock down local administration by forcing HTTPS and giving you an alternate port.
[24:29.950 --> 24:33.410]  Every single review about router talks about speed, speed, speed, speed, speed.
[24:34.310 --> 24:35.030]  Let me ask you.
[24:36.150 --> 24:39.250]  A few hundred people here, you all have smartphones, you all have computers.
[24:40.050 --> 24:45.770]  The last smartphone you bought, the last computer you bought, how many of you really cared about the CPU speed in the device?
[24:48.210 --> 24:50.450]  I'm actually surprised that that many people did.
[24:50.790 --> 24:53.810]  But I think Wi-Fi router speed is much like CPU speed.
[24:53.870 --> 24:54.970]  It's really kind of irrelevant.
[24:56.550 --> 24:59.010]  Some routers will let you turn off wireless access.
[24:59.310 --> 25:05.150]  And that means if someone got on your network via Wi-Fi, they absolutely cannot get into the administrative website.
[25:05.650 --> 25:07.330]  That's a great security feature.
[25:07.570 --> 25:14.030]  I wish I could tell you which routers do it, but no articles that review routers discuss the security of locking down the local administration.
[25:23.850 --> 25:27.050]  The options for locking down local administration vary by website.
[25:27.530 --> 25:28.930]  And I'm just a blogger.
[25:29.030 --> 25:34.630]  If I ran a lab, I would write up which routers did what, but I don't have access to a ton of routers.
[25:43.320 --> 25:44.720]  Last questions at the end.
[25:47.450 --> 25:49.640]  Okay, of course, turn off Telnet and SSH.
[25:49.740 --> 25:51.320]  These are alternate ways to get into the router.
[25:51.740 --> 25:54.400]  And what do I mean by clean up after yourself?
[25:54.910 --> 25:55.900]  I mean three things.
[25:56.040 --> 25:59.320]  One is when you're done administrating a router, obviously log off.
[26:01.090 --> 26:01.800]  Why SSH?
[26:01.860 --> 26:02.780]  What's wrong with SSH?
[26:02.980 --> 26:04.120]  Well, it's just another way.
[26:04.220 --> 26:05.460]  If you know how to use it, fine.
[26:05.760 --> 26:08.300]  But for most people who don't, it should be off.
[26:08.420 --> 26:09.940]  You're just safer if you disable it.
[26:10.560 --> 26:11.700]  No, no.
[26:11.980 --> 26:15.320]  It's just one less way for bad guys to get into your router.
[26:17.080 --> 26:25.400]  And clean up after yourself means if you're going to the administrative website, it would be good if you did it from porn mode.
[26:26.120 --> 26:28.560]  I forget, each browser has a different term for it.
[26:28.660 --> 26:33.840]  But the mode of the browser where it cleans up all the cookies afterwards and cleans up the cache so you don't leave anything behind.
[26:41.100 --> 26:49.140]  Those of you who are techies, of course, use remote administration so that you can get into and play with the routers of your non-techie acquaintances.
[26:50.540 --> 26:53.900]  And by that I mean here, auntsally.dyndns.org.
[26:55.320 --> 26:59.880]  Annoyingly about remote administration, every router company calls it something else.
[27:00.160 --> 27:05.340]  So even though I say, oh yeah, turn off remote administration, it's hard to know what to look for.
[27:11.750 --> 27:15.050]  I actually don't agree with the thing about turning off remote administration.
[27:15.470 --> 27:21.550]  I happen to use it on a lot of people I know so that I can get into the routers because I know someday they're going to call me, I can't get on the Internet.
[27:21.910 --> 27:29.610]  And I at least like to know if I can get into their router and see what's going on, then I can kind of pinpoint where the problem is.
[27:30.010 --> 27:36.150]  So just like local administration, I want to force remote administration to go over HTTPS.
[27:36.410 --> 27:37.810]  Some routers do it, some don't.
[27:42.950 --> 27:46.770]  I guess another thing at the bottom, allow only specific IP addresses.
[27:47.570 --> 27:53.690]  It's an interesting security option so that NSA can't do remote administration, only you can do it.
[27:53.850 --> 27:56.270]  But I don't know how practical that is for consumers.
[28:03.780 --> 28:07.440]  DDNS, of course, if you're going to do remote administration, you need DDNS.
[28:07.960 --> 28:09.980]  Aunt Sally, the dyndns.org.
[28:10.100 --> 28:13.740]  By the way, if anyone uses dyndns, they've really gone downhill.
[28:14.380 --> 28:15.400]  It's been my experience.
[28:15.560 --> 28:16.580]  I have two accounts with them.
[28:16.800 --> 28:19.300]  And they've moved on to other stuff.
[28:19.420 --> 28:20.400]  They're buying other companies.
[28:20.500 --> 28:21.420]  They're moving into other fields.
[28:21.520 --> 28:26.260]  So I think they take the unpaid summer interns and they're the ones who manage their dynamic DNS now.
[28:33.330 --> 28:36.970]  Okay, DNS servers is the most boring topic here, so I'll be very quick on it.
[28:38.130 --> 28:39.330]  It's a classic attack.
[28:39.750 --> 28:45.210]  If a bad guy gets into your router, they modify the DNS servers, and then they can send you to evil twin websites.
[28:49.030 --> 28:52.650]  So the only thing to say about that is, first of all, I'm a big fan of OpenDNS.
[28:52.930 --> 28:58.230]  I would never use DNS servers from my ISP because that's not their core competence.
[28:58.590 --> 29:00.650]  OpenDNS, that's all they do, is DNS.
[29:01.170 --> 29:02.510]  They're not the only ones.
[29:02.990 --> 29:06.390]  Dine, Norton, and Komodo also offer free DNS services.
[29:07.070 --> 29:09.270]  And any of these companies have another advantage.
[29:09.470 --> 29:10.590]  Not only do they perhaps...
[29:10.590 --> 29:11.990]  Well, OpenDNS does it professionally.
[29:12.910 --> 29:16.650]  But you can use these services without signing up for them, without having an account.
[29:18.330 --> 29:24.790]  So if your ISP is watching what you do by monitoring your DNS calls, use OpenDNS.
[29:24.790 --> 29:26.590]  It's one less thing your ISP can see.
[29:27.930 --> 29:32.650]  But, of course, it's a classic attack of a router is to change the DNS servers and how do you know it happened?
[29:33.470 --> 29:37.010]  If you're an OpenDNS customer, you can go to the third line there.
[29:37.150 --> 29:41.470]  You can go to store.opendns.settings and it will tell you whether you're using OpenDNS or not.
[29:42.070 --> 29:46.170]  But here's another one of the really big things is myresolver.info.
[29:46.670 --> 29:50.170]  If you're going to write anything down, write down myresolver.info.
[29:50.670 --> 29:53.890]  Because that is a website... I don't fully understand how it works.
[29:54.570 --> 29:58.190]  That is a website that tells you what your DNS server is.
[29:58.710 --> 30:06.030]  So you can tell very easily without even going into the router, you can tell if you've been hacked or not.
[30:07.070 --> 30:07.490]  Yes?
[30:17.690 --> 30:19.030]  All right, we'll do that later.
[30:19.870 --> 30:21.670]  And it's not that you can hide your DNS traffic.
[30:22.470 --> 30:23.870]  Yeah, all right, we'll do that later.
[30:24.970 --> 30:26.170]  Anyway, myresolver.info.
[30:26.250 --> 30:29.250]  You might want to make myresolver.info your browser homepage.
[30:29.730 --> 30:35.950]  That way, every time you start up your browser, you're confirmed that you're using the DNS server you think you're using and it hasn't been changed on you.
[30:40.830 --> 30:41.590]  Guest networks.
[30:41.990 --> 30:43.470]  Some routers have it, some don't.
[30:43.570 --> 30:45.030]  It's an absolutely great feature.
[30:46.430 --> 30:51.970]  The whole idea is, of course, you can keep your personal Wi-Fi password nice and long.
[30:52.370 --> 30:55.550]  But for guests, you give them a shorter Wi-Fi password that's easier to use.
[30:55.550 --> 31:03.770]  The important thing, though, if your guest network is on all the time, it's not providing any real security at all.
[31:03.910 --> 31:05.690]  Especially if you use a shorter password.
[31:06.150 --> 31:10.410]  So some routers will offer timing.
[31:10.570 --> 31:11.550]  I've seen this on Asus.
[31:11.830 --> 31:15.790]  You can turn on the guest network and set a timer and three hours later it turns itself off.
[31:15.930 --> 31:16.930]  So you don't have to remember.
[31:17.470 --> 31:19.590]  That's a really nice security feature.
[31:19.770 --> 31:24.030]  If you ever see a review of any router that mentions it, I will have a heart attack.
[31:24.590 --> 31:26.030]  But it's a really great feature.
[31:26.570 --> 31:28.150]  Some routers will also have a schedule.
[31:28.350 --> 31:33.410]  So you can say it can only have the guest network on Tuesday if it's a kind of consistent thing that you need to do.
[31:34.430 --> 31:35.790]  So, yeah, guest networks are great.
[31:35.970 --> 31:39.330]  It's almost worth getting a new router if your current router doesn't have a guest network.
[31:39.570 --> 31:41.270]  But, of course, you have to remember to turn it off.
[31:45.710 --> 31:49.950]  And now, if all else fails, comes the question of who's on my network.
[31:51.350 --> 31:54.690]  Consumer routers do a miserable job of this, by and large.
[31:55.750 --> 31:57.030]  PepLink, I have some slides here.
[31:57.130 --> 32:00.370]  PepLink does a reasonably good job of reporting who's on your network right now.
[32:01.790 --> 32:04.390]  On Android and iOS, I'm a big fan of the Fing app.
[32:04.750 --> 32:06.710]  I don't know if people here are familiar with Fing.
[32:07.490 --> 32:08.150]  Yeah, it's free.
[32:08.350 --> 32:08.850]  It's pretty good.
[32:09.030 --> 32:09.710]  It does land scan.
[32:09.970 --> 32:10.570]  It's pretty simple.
[32:10.570 --> 32:17.550]  On Windows, Nirsoft is an excellent website offering lots of free software.
[32:17.950 --> 32:19.870]  Reasonably professionally done software.
[32:20.250 --> 32:25.770]  And he has a portable software on Windows that will also give you an inventory.
[32:26.490 --> 32:27.830]  Skydog, I'm mentioning Skydog.
[32:28.590 --> 32:31.870]  They just, like two weeks ago, got bought out by Comcast.
[32:32.130 --> 32:34.130]  They were an up-and-coming router company.
[32:34.130 --> 32:36.790]  They specialized in parental control.
[32:36.790 --> 32:39.850]  So you make sure if you have a six-year-old, they don't see any pornography.
[32:40.150 --> 32:42.190]  They were really, really good at that sort of thing.
[32:42.470 --> 32:49.130]  But the thing that I loved about Skydog, whenever a new device got on your network, it would send you an email message.
[32:50.790 --> 32:52.090]  Wow, what a great feature.
[32:52.530 --> 32:54.670]  Has anyone seen that in any other router?
[32:55.370 --> 32:59.270]  Any kind of automatic notification when a new device shows up on the network?
[33:01.090 --> 33:01.530]  Wow.
[33:01.870 --> 33:03.530]  Well, I'm sorry, Skydog is gone.
[33:04.250 --> 33:06.130]  Yeah, Comcast bought them and that's the end of them.
[33:09.390 --> 33:10.510]  Okay, here is Fing.
[33:12.330 --> 33:17.610]  If this doesn't do it justice, you can click on the router and get all sorts of detailed information about the router.
[33:17.770 --> 33:23.070]  You can also click on individual devices and it will show you some more information about those devices.
[33:23.830 --> 33:28.430]  Very simple to use, great way to... who's on my network right now.
[33:29.730 --> 33:31.330]  This is the Nursoft program.
[33:32.530 --> 33:33.830]  Not much to say about it.
[33:38.240 --> 33:40.080]  And this is your peplink router.
[33:41.600 --> 33:44.460]  Peplink router, which has a feature showing you who's on your network right now.
[33:44.580 --> 33:46.240]  It shows you the IP address, the MAC address.
[33:46.460 --> 33:47.810]  It shows you the name of the computer.
[33:48.100 --> 33:55.180]  It tries to find the name of the computer, but you can do things like, say, Susan's iPad so that it's simple and easy to tell.
[33:55.180 --> 34:00.380]  But, unfortunately, peplink is not going to send me an email message when a new device comes onto the network.
[34:01.000 --> 34:03.700]  You can see the second line says Vonage Boxy.
[34:04.100 --> 34:05.520]  Obviously, I set that name.
[34:05.700 --> 34:08.340]  That's not the default name in the Vonage VoIP box.
[34:09.120 --> 34:11.880]  Nice thing about it, it gives you upload and download speed.
[34:12.020 --> 34:16.820]  If your network seems kind of slow, you can log onto the router and see who, if anyone, is hogging the bandwidth.
[34:17.820 --> 34:22.940]  The router also supports multiple SSIDs, so it shows you which SSID a client is logged onto.
[34:23.640 --> 34:26.160]  And really nifty is the last column, signal strength.
[34:26.440 --> 34:30.460]  So you can see how good the signal is for each Wi-Fi client on the network.
[34:30.740 --> 34:37.260]  And the icons all the way in the far left, they tell you whether you're Ethernet connected, Wi-Fi connected, active or not.
[34:37.500 --> 34:40.960]  So it's really great monitoring right in the router.
[34:40.960 --> 34:42.720]  So you don't need Fing or whatever.
[34:44.720 --> 34:51.200]  It also has another feature in the peplink router that shows you every single socket, I believe is the official term.
[34:51.980 --> 34:55.950]  You go to cnn.com and it brings in ads from eight different servers.
[34:56.960 --> 34:58.980]  And you'll see all nine connections here.
[34:59.320 --> 35:02.580]  The one to CNN and the eight to the nine different ad services.
[35:02.840 --> 35:04.780]  So you can really have a good feel.
[35:04.940 --> 35:05.640]  And it's right in the router.
[35:05.760 --> 35:06.400]  No extra software.
[35:06.480 --> 35:08.900]  You really get a good feel for what's going on on your network.
[35:12.610 --> 35:14.990]  Again, I do not work for peplink at all.
[35:18.860 --> 35:20.420]  Okay, hiding on the network.
[35:21.760 --> 35:23.500]  Your router is a computer, of course.
[35:23.680 --> 35:26.920]  And this diagram only shows half the story.
[35:28.000 --> 35:29.180]  Router has a firewall.
[35:29.340 --> 35:32.260]  And the great thing the firewall does is block unsolicited incoming input.
[35:32.660 --> 35:34.580]  The firewall can also let stuff go through.
[35:34.820 --> 35:35.920]  This is called port forwarding.
[35:36.180 --> 35:38.420]  What this diagram doesn't show is the router is a computer.
[35:38.720 --> 35:43.120]  And the router can actually handle the unsolicited incoming input all by itself.
[35:43.120 --> 35:47.000]  And a lot of the bugs I'm going to talk about in the next few minutes have to do with that.
[35:47.500 --> 35:52.860]  And another great thing the router does, which is the next topic, is it throws stuff away into the bit bucket.
[35:53.580 --> 35:54.920]  Unsolicited incoming input.
[35:55.380 --> 35:57.000]  I'm just not dealing with it.
[35:57.080 --> 35:57.300]  Goodbye.
[35:58.660 --> 35:59.560]  Hiding from ping.
[35:59.880 --> 36:08.240]  Ping is a TCP IP command being abused by a lot of bad guys to find live routers, live devices on the Internet.
[36:08.240 --> 36:11.860]  Every single router has an option not to respond to ping commands.
[36:12.720 --> 36:14.720]  It's absolutely something you want to turn on.
[36:14.880 --> 36:15.800]  It's a great security feature.
[36:15.920 --> 36:16.540]  It helps you hide.
[36:16.620 --> 36:23.620]  Of course, you're not going to hide from your ISP, but you're going to hide from some guy in Russia and China who's trying to find all the live devices with a particular flaw in them.
[36:25.140 --> 36:27.580]  Unfortunately, hiding from ping, the terminology is terrible.
[36:27.900 --> 36:30.380]  Every company has a different term for it.
[36:36.060 --> 36:38.480]  HNAP, has anyone heard of the HNAP protocol?
[36:40.120 --> 36:40.720]  Wow.
[36:41.200 --> 36:43.780]  This is yet another way to access your router.
[36:45.160 --> 36:46.500]  Here's what HNAP does.
[36:47.120 --> 36:56.060]  Without any password, you just go to this folder, HNAP1, all caps, and it dumps out all sorts of technical information about your router.
[36:56.760 --> 36:59.660]  This is a terrible, terrible security feature.
[37:03.500 --> 37:06.720]  HNAP was developed by Cisco.
[37:07.380 --> 37:10.980]  Actually, developed by somebody called Pure Networks, and now Cisco kind of owns it.
[37:11.560 --> 37:14.240]  HNAP was involved in two router security issues.
[37:14.560 --> 37:29.540]  In 2010, there was an exploit of D-Link routers where the attackers used this HNAP to find which specific model of firmware that your D-Link router had, and they had specific attacks to go against that particular model.
[37:29.900 --> 37:34.280]  And the same thing happened just in February of this year, having to do with the Linksys e-line.
[37:34.820 --> 37:39.400]  There was a malware called the moon, and it would spread from one Linksys router to another.
[37:39.640 --> 37:42.100]  Of course, how did it know which Linksys routers there were?
[37:42.160 --> 37:44.900]  Because it just made an HNAP request to the router.
[37:45.960 --> 37:48.860]  As soon as you get home, this is something you want to do in all your routers.
[37:48.860 --> 37:52.340]  Go to slash 8NAP1, and hopefully you get no response back.
[37:52.580 --> 37:53.460]  That's the only good thing.
[37:55.200 --> 37:58.180]  Frankly, if you get any response back, I would throw the router out.
[38:01.470 --> 38:03.270]  Here's some more information about HNAP.
[38:03.370 --> 38:06.630]  I'm sorry you can't see the URLs, but you can download a PDF of this.
[38:12.870 --> 38:16.750]  I have not seen any router that offers to turn off HNAP.
[38:17.290 --> 38:19.330]  So the question is, does your router support it?
[38:20.810 --> 38:24.090]  If you have a consumer router, lots of luck dealing with tech support.
[38:24.630 --> 38:27.430]  Lots of luck getting an answer from tech support on any consumer router.
[38:27.870 --> 38:34.550]  I did talk to PepLink when I learned about this a number of months ago, and I was specifically told that their routers do not support HNAP.
[38:41.510 --> 38:42.730]  Okay, firewall and ports.
[38:42.870 --> 38:45.870]  Needless to say, the firewall lords over all the ports in your router.
[38:46.130 --> 38:48.910]  The second line should say ports can be open, closed, or stealth.
[38:48.910 --> 38:52.690]  You know, the firewall and the router is one of your best defenses, even if...
[38:52.690 --> 38:54.050]  Lots of clients I have.
[38:54.110 --> 38:55.390]  They have only one computer.
[38:55.530 --> 38:58.290]  And I said, get a router anyway, just to have the firewall.
[39:00.490 --> 39:02.250]  Stealth is the best status for a port.
[39:02.490 --> 39:03.490]  Stealth is the bit bucket.
[39:04.170 --> 39:07.070]  Something comes in on port 1234, it's thrown away.
[39:07.350 --> 39:08.590]  Just completely ignored.
[39:09.710 --> 39:11.090]  Closed is not quite as good.
[39:11.290 --> 39:13.790]  Closed is like someone knocks on the door and you yell, go away.
[39:14.270 --> 39:18.010]  You haven't opened the door, but someone knows that there's someone home.
[39:19.710 --> 39:23.010]  And open, of course, is almost always a mistake on a home router.
[39:23.670 --> 39:25.590]  Open is only for people who are running servers.
[39:26.250 --> 39:29.310]  Anyone with a home router, see any open ports, you've got a problem.
[39:31.390 --> 39:32.810]  Now, how do you test the status?
[39:33.010 --> 39:36.450]  Oh, by the way, one of the things bad guys do, of course, is turn off the firewall in your router.
[39:37.010 --> 39:39.070]  So how do you test if the firewall is doing its job?
[39:39.190 --> 39:40.990]  How do you test if the firewall is even on at all?
[39:41.690 --> 39:45.510]  Shields Up from Steve Gisvin has been around for 114 years.
[39:45.510 --> 39:49.370]  He hasn't really updated it, but at least he's an honest person.
[39:49.390 --> 39:51.070]  He's a trustworthy, reliable person.
[39:51.210 --> 39:52.890]  And he will do what the bad guys do.
[39:53.010 --> 39:56.230]  He will knock on the firewall for you and report on what he's found.
[39:57.110 --> 39:58.610]  You click on these gray buttons.
[39:58.770 --> 40:02.490]  The gray buttons say file sharing, common ports, and all service ports.
[40:03.250 --> 40:05.730]  We're coming to the big orange button about UPnP.
[40:05.870 --> 40:06.730]  That's a later topic.
[40:09.390 --> 40:10.190]  Wow, 340.
[40:10.850 --> 40:13.450]  This is what it looks if you get a good report from Shields Up.
[40:17.200 --> 40:18.600]  Okay, router software stinks.
[40:21.300 --> 40:25.140]  This is a big reason why if router is sold at Best Buy, you don't want it.
[40:25.960 --> 40:28.020]  Perhaps router software is developed by amateurs.
[40:28.520 --> 40:33.620]  We will see, if time allows, a number of cases where it's pretty obvious that the software is developed by amateurs.
[40:34.460 --> 40:36.560]  Perhaps the software is developed with spying in mind.
[40:36.560 --> 40:42.060]  I have one example here where it's very obvious that the purpose of the flaw was really to spy on you.
[40:42.440 --> 40:43.620]  And perhaps it's both.
[40:44.980 --> 40:49.020]  The EFF, Friday, was the first thing they said about their new firmware.
[40:49.140 --> 40:51.220]  They said all the firmwares really suck.
[40:51.520 --> 40:52.700]  And they're right, they do.
[40:53.160 --> 40:57.760]  In July 2013, there was a report from a company called Independent Security Evaluators.
[40:58.480 --> 41:00.760]  I think they looked at 13 different routers.
[41:01.280 --> 41:04.160]  Every single router, the guy who wrote the report was here yesterday.
[41:04.300 --> 41:04.980]  I don't know if he's here now.
[41:06.500 --> 41:08.340]  13 popular consumer routers.
[41:08.480 --> 41:11.320]  Every single one of those routers could be hacked from the LAN side.
[41:11.840 --> 41:15.140]  And 11 of the 13 could be hacked from the outside, from the Internet.
[41:15.980 --> 41:17.720]  It's just really disgraceful.
[41:19.140 --> 41:25.880]  I will skip a lot of these, but this ASUS password length bug shows you how amateur the people are who code this firmware.
[41:26.640 --> 41:30.820]  Which is why, really, if you care about router security, you want a business class router.
[41:30.960 --> 41:32.020]  You don't want a consumer router.
[41:34.500 --> 41:37.740]  Brian Krebs, who writes Krebs on security, probably most of you know about it.
[41:37.960 --> 41:45.400]  He was writing about some bug in ASUS router where if you stuck a USB device in there, all the files on that USB device could be accessed over the Internet.
[41:45.760 --> 41:48.140]  And, you know, that's one of a billion bugs in routers.
[41:48.520 --> 41:54.100]  But he said he was helping his friend with an ASUS router, and he changed the password on the router.
[41:54.520 --> 41:57.460]  And the router reboots and he types in the password and he can't get in.
[41:59.020 --> 41:59.800]  What the heck?
[42:00.240 --> 42:02.120]  Anyone care to guess what that problem was?
[42:04.580 --> 42:05.180]  Excuse me?
[42:06.440 --> 42:07.320]  Yes, bingo.
[42:07.660 --> 42:08.940]  I mean, he's a security guy.
[42:09.020 --> 42:09.820]  He picked a long password.
[42:09.940 --> 42:11.960]  He picked a 25 character byte password.
[42:12.860 --> 42:17.240]  Turns out, long story short, that the ASUS router only supports 16 byte passwords.
[42:18.960 --> 42:22.160]  I mean, you know, you made four mistakes to get to that point.
[42:22.260 --> 42:27.380]  Where you will accept a 25 character password, truncate it, not say anything.
[42:28.100 --> 42:32.740]  I mean, that is a level of amateurishness that's just unbelievably disgraceful.
[42:33.500 --> 42:35.820]  That was a high-end ASUS router.
[42:37.040 --> 42:40.780]  So I will let that substitute for all the millions of other stories I could tell you.
[42:41.540 --> 42:43.260]  Oh, this is the one...
[42:43.260 --> 42:44.560]  All right, I know I'm running out of time.
[42:44.560 --> 42:49.420]  This is the one that got me on this kick that consumer routers are absolutely to be avoided.
[42:50.340 --> 42:51.300]  This gray box.
[42:51.420 --> 42:52.560]  Gray box, a change you made.
[42:52.860 --> 42:53.800]  What is this message?
[42:53.860 --> 42:55.180]  I have no idea what this message means.
[42:56.060 --> 42:58.040]  This message came from this router.
[42:58.220 --> 42:59.240]  This ASUS router.
[43:00.300 --> 43:03.140]  That's why it's here now, and that's why it's not in service.
[43:03.520 --> 43:05.720]  Because this came to someone who works at home.
[43:05.880 --> 43:07.440]  Internet access is important to them.
[43:07.640 --> 43:08.480]  I log on.
[43:08.580 --> 43:09.020]  I see this.
[43:09.020 --> 43:10.400]  I have no idea what it is.
[43:10.520 --> 43:13.360]  I cannot deal with software from amateurs.
[43:13.360 --> 43:15.980]  Those of us who really need our Internet access.
[43:16.140 --> 43:17.840]  You need professionally done software.
[43:18.320 --> 43:20.060]  And ASUS is not on that list.
[43:20.940 --> 43:22.220]  I still have no idea.
[43:22.320 --> 43:23.540]  I googled this up the wing way.
[43:23.640 --> 43:24.820]  I have no idea what this means.
[43:25.060 --> 43:25.160]  What?
[43:25.420 --> 43:26.880]  You changed the IP of the gateway.
[43:27.180 --> 43:27.700]  That's why you changed it.
[43:27.700 --> 43:28.740]  No, I didn't change...
[43:28.740 --> 43:29.980]  I did not change the IP of the gateway.
[43:30.660 --> 43:31.620]  Nobody knows what...
[43:31.620 --> 43:33.620]  Nobody knows what this means in reality.
[43:39.280 --> 43:42.260]  So if anybody wants a miserable router, 20 bucks takes it away.
[43:43.280 --> 43:45.660]  But I would not recommend using it.
[43:48.320 --> 43:49.160]  The Wirecutter.
[43:49.300 --> 43:50.740]  The Wirecutter reviews routers.
[43:50.740 --> 43:52.200]  This is a great website, the Wirecutter.
[43:52.320 --> 43:54.060]  They said the best router so-and-so.
[43:54.320 --> 43:55.780]  This is a really interesting story.
[43:55.940 --> 43:57.880]  Of course, they judge routers like everyone else.
[43:57.880 --> 44:00.160]  They judge based on speed and features and price.
[44:00.400 --> 44:02.600]  And that's really not the way to judge a router.
[44:02.980 --> 44:04.360]  Security is the way to judge a router.
[44:04.760 --> 44:08.700]  And that's what's really interesting about this, is this was their second choice for the best Wi-Fi router.
[44:09.580 --> 44:10.880]  Previously, they chose...
[44:11.420 --> 44:12.480]  Actually, I think it's this...
[44:12.480 --> 44:12.720]  Oh, no.
[44:13.340 --> 44:15.060]  The next generation of this router.
[44:15.900 --> 44:17.840]  That was their best choice for router.
[44:19.880 --> 44:22.860]  And this further shows how miserable the software is on routers.
[44:22.900 --> 44:23.880]  I'm not picking on ASUS.
[44:24.000 --> 44:24.680]  This could be anyone.
[44:26.100 --> 44:29.420]  I guess they picked that ASUS router as the best router in the world...
[44:29.420 --> 44:31.580]  January of this year, give or take.
[44:32.200 --> 44:34.900]  In March of this year, the Wirecutter had an update.
[44:35.000 --> 44:36.120]  These are the updates to their website.
[44:36.580 --> 44:40.800]  They say, update your firmware immediately to prevent attacks from accessing USB storage devices.
[44:41.160 --> 44:42.620]  Alright, there was a bug in ASUS router.
[44:42.820 --> 44:43.760]  Great, they issued new firmware.
[44:44.380 --> 44:48.360]  The Wirecutter also said it's a good idea to download the firmware from the ASUS website.
[44:48.800 --> 44:49.240]  Why?
[44:49.480 --> 44:53.400]  Because the routers do a miserable job of reporting what the latest firmware is.
[44:53.400 --> 44:55.600]  I have seen that multiple times myself.
[44:55.800 --> 44:57.100]  The router says, oh, you're up to date.
[44:57.240 --> 44:59.820]  You go to the website of the vendor and there's actually newer firmware.
[45:00.740 --> 45:08.200]  Then on tax day, April of this year, they said, we have determined that the router can have severe connectivity issues on a 2.4 gigahertz band.
[45:08.440 --> 45:10.380]  And we can't recommend it anymore.
[45:11.400 --> 45:13.500]  And then in June, they wrote about it again.
[45:14.840 --> 45:16.640]  Alright, I'm late on time.
[45:16.780 --> 45:20.020]  But suffice it to say, the consumer routers, the software is miserable.
[45:23.370 --> 45:25.790]  And then there are bugs that are put there in purpose.
[45:26.450 --> 45:27.770]  This is the whoops of whoops.
[45:29.230 --> 45:30.690]  This is one of my favorite stories.
[45:30.870 --> 45:32.890]  Oh, I can't believe I'm down to 10 minutes.
[45:34.210 --> 45:37.510]  By the way, this is slide 57 and I have 81 to go.
[45:40.970 --> 45:44.450]  Okay, whoops was introduced by the Wi-Fi Alliance in 2007.
[45:44.850 --> 45:47.670]  The Wi-Fi Alliance is the same group that gave us WEP.
[45:51.490 --> 45:52.670]  I appreciate that.
[45:52.670 --> 45:53.250]  I really do.
[45:58.650 --> 46:00.170]  Whoops is actually being used.
[46:00.410 --> 46:01.590]  This is Wi-Fi Analyzer.
[46:01.670 --> 46:03.530]  This was taken to Midtown Manhattan a few months ago.
[46:03.790 --> 46:05.250]  It's on in a lot of routers.
[46:05.250 --> 46:09.410]  Basically, any routers that has WPs on can be hacked into by anyone.
[46:11.390 --> 46:12.390]  Whoops is very complicated.
[46:12.990 --> 46:15.750]  It's amazing that this got so little coverage in the press.
[46:16.390 --> 46:18.610]  Whoops operates in like four different modes.
[46:19.810 --> 46:20.970]  This is one mode.
[46:21.210 --> 46:23.090]  It supports like this little Wi-Fi thing.
[46:23.230 --> 46:24.510]  You push a button on this device.
[46:24.610 --> 46:25.730]  You push a button on your router.
[46:26.030 --> 46:28.970]  And the thing gets onto your Wi-Fi network.
[46:29.130 --> 46:30.410]  That's not a security problem.
[46:30.510 --> 46:31.890]  Because the two things have to be near each other.
[46:31.910 --> 46:32.450]  You push a button.
[46:32.690 --> 46:34.570]  This is another mode of whoops.
[46:34.570 --> 46:36.630]  It even stands for setup in S.
[46:36.750 --> 46:40.590]  So if you're on a Windows machine, it'll do the initial setup of your router.
[46:41.330 --> 46:43.310]  Then there's another mode of whoops.
[46:43.450 --> 46:46.030]  Where you actually get a pin number from some wireless device.
[46:46.190 --> 46:47.830]  And you enter that pin number into the router.
[46:48.430 --> 46:50.150]  That's not a security problem either.
[46:50.870 --> 46:52.990]  Then we come to the fourth mode of whoops.
[46:53.370 --> 46:55.110]  The fourth mode is...
[46:55.650 --> 46:59.030]  Every consumer router has a hard-coded WPS pin code.
[47:00.310 --> 47:01.950]  It's on the little label here.
[47:02.250 --> 47:03.010]  Eight digits.
[47:04.570 --> 47:09.070]  And in the fourth mode, your wireless devices give the router that eight-digit number.
[47:09.490 --> 47:11.270]  And they're on your Wi-Fi network.
[47:11.610 --> 47:15.230]  And this is a huge expletive-deleted security problem.
[47:16.030 --> 47:16.890]  Absolutely huge.
[47:17.530 --> 47:21.670]  In fact, I would go so far as I would never use a router that has whoops capability.
[47:22.810 --> 47:25.210]  Because even when you turn it off, how do you know it's really turned off?
[47:28.430 --> 47:31.290]  This got a lot of publicity in December of 2011.
[47:37.330 --> 47:38.110]  I don't know.
[47:46.080 --> 47:47.620]  Yes, I'm going to explain what the problem is.
[47:47.720 --> 47:49.100]  It's really simple and easy to understand.
[47:50.360 --> 47:54.620]  First of all, you have the problem that every router has an eight-digit number on it.
[47:54.620 --> 47:57.580]  And that eight-digit number will get you into the thing no matter what.
[47:58.160 --> 48:01.960]  So a plumber comes over to your house, turns your router over, takes a picture of the bottom of it.
[48:02.040 --> 48:03.760]  And he can now get on your network forever.
[48:05.280 --> 48:09.620]  This pin code, it works for all Wi-Fi networks on a router.
[48:09.820 --> 48:11.820]  So guest networks offer you no protection.
[48:12.560 --> 48:15.200]  This pin code trumps your WPA password.
[48:15.200 --> 48:17.560]  You have a 63-character long password.
[48:17.960 --> 48:20.080]  You change that password every day.
[48:20.360 --> 48:20.920]  Doesn't matter.
[48:20.980 --> 48:21.700]  I got the pin code.
[48:21.840 --> 48:22.540]  I'm on your network.
[48:24.060 --> 48:25.640]  You change your SSID.
[48:26.060 --> 48:26.780]  Doesn't matter.
[48:27.260 --> 48:29.760]  Like Honey Badger, pin codes don't care.
[48:30.100 --> 48:32.740]  Pin codes get into your router no matter what.
[48:33.080 --> 48:34.020]  Now how does this happen?
[48:34.100 --> 48:36.700]  Because you think it's an eight-digit number.
[48:36.740 --> 48:37.440]  How could this be?
[48:37.940 --> 48:39.760]  It's actually not an eight-digit number.
[48:39.980 --> 48:41.720]  It's actually a seven-digit number.
[48:41.820 --> 48:44.420]  The last digit is a check code or a checksum.
[48:45.080 --> 48:47.380]  And it doesn't validate the seven digits.
[48:48.100 --> 48:48.640]  Of course, even...
[48:48.640 --> 48:51.880]  Well, with eight digits, of course, you think a hundred million possible pin numbers.
[48:52.080 --> 48:54.260]  Which is probably why this didn't get a lot of publicity.
[48:55.860 --> 48:58.040]  It actually doesn't validate a seven-digit number.
[48:58.260 --> 49:01.520]  It validates the first four digits as one thing.
[49:02.020 --> 49:05.680]  And then it validates the next three digits as another thing.
[49:07.020 --> 49:07.980]  What does that mean?
[49:08.060 --> 49:10.360]  That means there's 11,000 possible pin codes.
[49:10.760 --> 49:14.060]  How long does it take a computer to make 11,000 guesses?
[49:14.940 --> 49:15.900]  Not very long.
[49:16.140 --> 49:18.440]  If whoops is active, you can get into the router.
[49:18.840 --> 49:20.700]  You just need to make 11,000 guesses.
[49:21.420 --> 49:23.160]  If you guess...
[49:23.160 --> 49:25.480]  One guess a second, it'll take you three minutes.
[49:26.240 --> 49:29.400]  Any router with whoops, you can get into in no more than three minutes.
[49:30.620 --> 49:32.660]  Why this never made a lot of news?
[49:32.820 --> 49:36.700]  I mean, it was in the tech press, but it never made it to the mainstream media.
[49:36.840 --> 49:38.340]  It's like, hack me, please.
[49:40.200 --> 49:46.620]  And it's really annoying is back in April, they modified the whoops protocol and added NFC to it.
[49:46.820 --> 49:48.600]  And this is an article at PC World.
[49:48.960 --> 49:51.960]  This article says nothing about the security problems for WPS.
[49:52.980 --> 49:55.580]  This was covered in a couple other tech things.
[49:56.200 --> 50:00.580]  You know, nothing about this WPS run from the hills if you have WPS.
[50:00.580 --> 50:02.120]  No, absolutely no.
[50:03.140 --> 50:11.020]  And you'd also think that routers after like 20, 30, 40, 100 bad pin numbers, maybe they would slow you down so you couldn't guess.
[50:11.300 --> 50:13.300]  But no, they don't slow you down.
[50:13.420 --> 50:14.800]  You can make all 11,000 guesses.
[50:14.840 --> 50:15.560]  No problem.
[50:25.750 --> 50:27.170]  That was the amateur stuff.
[50:27.310 --> 50:28.230]  Well, actually, I don't know.
[50:28.450 --> 50:30.690]  That whoops pin number thing, was that done...
[50:31.270 --> 50:33.970]  Was that bad design or was that done for spying?
[50:34.470 --> 50:42.370]  I mean, whoops came out in 2007, so maybe that was some spy agency's first generation way of getting in.
[50:43.470 --> 50:49.210]  Before, there were seven billion Android devices that would save your Wi-Fi password and give it to the U.S.
[50:49.290 --> 50:49.470]  government.
[50:50.570 --> 50:54.390]  But this came out in December of last year.
[50:54.750 --> 50:58.030]  This is no doubt about it that your routers are spying on you.
[50:58.390 --> 50:59.630]  Absolutely no doubt about it.
[51:01.970 --> 51:05.230]  Eloy Vanderboken wrote about this...
[51:05.790 --> 51:06.630]  Well, that's April.
[51:06.710 --> 51:08.630]  He first wrote about this in December...
[51:12.150 --> 51:13.090]  This was...
[51:13.090 --> 51:14.230]  Oh, Christmas of last year.
[51:14.830 --> 51:18.870]  He found that a router responded to commands sent to port 32-764.
[51:19.510 --> 51:24.630]  In other words, anything that's unsolicited and comes in should get sent to the bit bucket.
[51:25.330 --> 51:31.270]  But he was playing around and noticed that one of his routers would respond to commands on port 32-764.
[51:31.590 --> 51:32.950]  No password was needed.
[51:33.810 --> 51:40.770]  He seems to be a really smart guy, and he figured out that there were like a dozen different commands, and he could make the router do anything he wanted to do.
[51:42.870 --> 51:45.330]  This got some publicity around Christmas time.
[51:45.890 --> 51:47.470]  There were 24 routers.
[51:47.570 --> 51:52.870]  Other people started testing, and 24 routers were found to also have port 32-764 open.
[51:53.110 --> 51:54.430]  I mean, this is a back door.
[51:54.430 --> 51:56.650]  This is like a glaring thing, a back door.
[51:57.370 --> 52:06.770]  The companies that shipped routers with port 32-764 are guaranteed to be spying on you, and those routers were from Cisco, Linksys, NETGEAR, and Diamond.
[52:07.470 --> 52:11.130]  I would never employ a router from any one of those companies.
[52:11.570 --> 52:14.150]  Cisco, Linksys, NETGEAR, and Diamond.
[52:16.030 --> 52:22.090]  The original testing found that port open on the LAN side, but further people found it was open on the WAN side too.
[52:24.370 --> 52:28.730]  And of course, it got publicity, and there was new firmware issued.
[52:30.470 --> 52:36.430]  And then in April, Mr. Vanderboken tested that new firmware.
[52:37.410 --> 52:41.210]  And sure enough, that updated firmware blocked port 32-764.
[52:42.490 --> 52:46.050]  So any security person who looked at it and said, okay, yeah, they fixed the firmware.
[52:46.050 --> 52:48.330]  But they did not fix the firmware.
[52:48.730 --> 52:52.410]  This is so obviously done by a spy agency, it's amazing.
[52:52.950 --> 52:54.590]  You can read his description there.
[52:54.690 --> 52:55.670]  That's the URL at the bottom.
[52:56.450 --> 52:58.930]  It turns out there's a secret password.
[52:59.530 --> 53:01.170]  A secret bunch of bits.
[53:01.550 --> 53:07.070]  And if you send those bunch of bits to one of these routers, it will reopen port 32-764.
[53:07.410 --> 53:09.350]  They didn't even change the port number.
[53:09.530 --> 53:13.150]  And it accepts the exact same commands as always.
[53:13.930 --> 53:19.570]  And the really interesting thing is that secret bunch of bits is not a TCP IP datagram.
[53:20.150 --> 53:21.490]  It's an Ethernet thing.
[53:22.670 --> 53:29.250]  Which means that people in Russia are not going to get into my router in my apartment and open port 32-764.
[53:29.290 --> 53:30.790]  You can't send it over TCP IP.
[53:31.150 --> 53:33.470]  You can only send it as an Ethernet.
[53:33.630 --> 53:34.670]  Now what does that mean?
[53:34.850 --> 53:38.810]  That means if you're already on my network, you can issue that command and open up the port.
[53:38.810 --> 53:41.250]  And, of course, Google knows every Wi-Fi password in the world.
[53:41.450 --> 53:43.930]  And, of course, you've got WPS so you can easily get on my network.
[53:44.610 --> 53:48.230]  Well, the other thing it means, who else is Ethernet connected to your router?
[53:48.510 --> 53:50.110]  Your Internet service provider.
[53:50.850 --> 54:00.290]  So your Internet service provider can send an Ethernet broadcast and turn on port 32-764 for all the routers that are vulnerable to it on your network.
[54:00.950 --> 54:04.510]  And, as Mr. Vanderbalken says right here, it was deliberate.
[54:04.690 --> 54:05.670]  No doubt about it.
[54:06.950 --> 54:08.870]  I repeat those companies again.
[54:10.230 --> 54:16.630]  That was Cisco, NETGEAR, Linksys, and Diamond.
[54:18.910 --> 54:24.930]  So this was not an amateur thing, as the secret password is Ethernet only.
[54:24.930 --> 54:27.950]  And it's a kind of non-standard Ethernet datagram.
[54:30.310 --> 54:33.050]  Okay, UPnP, another huge security hole.
[54:33.330 --> 54:35.210]  I know I have one minute left.
[54:36.630 --> 54:39.730]  Okay, UPnP is a protocol to simplify the discovery.
[54:40.770 --> 54:41.790]  I'm on 69.
[54:42.070 --> 54:43.470]  All right, I got pretty much for it.
[54:44.770 --> 54:45.830]  UPnP is everywhere.
[54:46.110 --> 54:48.510]  It's on routers, printers, NAS devices.
[54:48.810 --> 54:50.790]  UPnP is not necessarily a bad thing.
[54:51.330 --> 54:53.810]  UPnP was designed for LANs.
[54:54.690 --> 54:56.350]  And, as such, it has no security.
[54:56.950 --> 54:58.790]  In and of itself, that's not such a big deal.
[54:59.870 --> 55:05.110]  But CERT, in 2011, warned about devices that are exposing UPnP on the Internet.
[55:05.990 --> 55:12.510]  So having UPnP on the Internet is like going in for surgery and having the doctor work on the wrong leg.
[55:13.670 --> 55:15.930]  UPnP is supposed to be LAN side only.
[55:16.990 --> 55:24.350]  Somehow, again, I don't know if this was for spying or just amateurness, but a lot of devices are opening UPnP to the Internet where it doesn't belong.
[55:25.310 --> 55:29.890]  Security firm Rapid7 scanned the entire Internet every week for five months in 2012.
[55:30.210 --> 55:33.970]  They found 80 million devices on the Internet that would talk UPnP.
[55:34.690 --> 55:36.150]  There should be no devices.
[55:36.670 --> 55:39.250]  It was designed for LAN use only, period.
[55:41.750 --> 55:45.090]  Unbelievable why you do not want a consumer-grade router.
[55:47.230 --> 55:50.370]  ShieldsUp will test for UPnP if you're exposed on the Internet.
[55:50.870 --> 55:52.850]  That's what the big orange button was earlier.
[55:53.910 --> 55:58.790]  Rapid7, the security company, they have two scans for whether UPnP is available.
[55:59.370 --> 56:03.110]  The one in the bottom left corner, the orange button, it says scan my router is obvious.
[56:03.590 --> 56:15.650]  The other thing, download ScanNow, ScanNow is Windows software, free software from Rapid7, which you can scan, you can use to test other people's routers to see if they're exposing UPnP on the Internet.
[56:17.050 --> 56:18.310]  Oh, VPN routers.
[56:18.470 --> 56:19.730]  Oh, this is such a great topic.
[56:20.830 --> 56:28.370]  I'm out of time, so I will say in three seconds, if you care about security, you may want to buy a second router.
[56:28.890 --> 56:31.210]  That second router will be a VPN router.
[56:32.090 --> 56:35.570]  When I say a VPN router, I mean a router that can be a VPN client.
[56:36.110 --> 56:38.190]  The term is also used for VPN servers.
[56:38.350 --> 56:40.510]  I don't think it's a big deal having a VPN server in your router.
[56:40.750 --> 56:43.050]  But you want a router that can be a VPN client.
[56:43.230 --> 56:45.630]  And then you sign up with some VPN company.
[56:46.090 --> 56:50.170]  And everything that you send through that router goes to the VPN company.
[56:50.370 --> 56:53.790]  This is a great way to hide what you're doing from your Internet service provider.
[56:56.230 --> 57:02.370]  Thomas Drake noted the first day how the US government is in bed with all the Internet service providers.
[57:02.370 --> 57:07.250]  So if you don't want them spying on you, you send everything through a VPN router.
[57:07.450 --> 57:10.350]  And I'm really sorry I'm out of time because this is such a sexy topic.
[57:11.750 --> 57:13.030]  But I do know we have to go.
[57:13.150 --> 57:13.830]  So thank you very much.
[57:13.830 --> 57:13.970]  Thank you very much.