750-3.100-1217, unsecure firmware validation check

Technical Support for Routers
14

I am not a security expert so I don’t know all the details, and I think GL.inet routers are some of the best in the world right now, but I thnk it’s not a very big investment to improve the security from average or maybe OK to excellent.

Just like the firmware and hardware is much better than most of the normal routers, GL.inet should also make their security (and privacy) much better than the other companies.

It only takes one incident where firmware was changed or hacked, and the whole reputation can be spoiled for a long time. The risk of bad security is bad for business!

15

Its looks for me the gl firmware auto update process are neither by secured by actual sha256 nor by since many years broken MD5.

GL secured his webpage a little bit, some days ago. A this can be only one first step. If I remember right:

  • The unsecure TLS 1.1 and older are now deactivated. Thanks.
  • The actual TLS standard, TLS 1.3 are still not supported.
  • A long list of weak shipper suites are still used (The list of used weak shipper suites its much shorter than one or two weeks ago)
16

Thanks for your feedback.
I will try to improve the security again, after done, I will reply this thread.

1 Like
17

Hi, how about this now, SSL Server Test: dl.gl-inet.com (Powered by Qualys SSL Labs)
TLS 1.3 are supported, no weak cipher,
Thanks for your suggestions!

2 Likes
19

Very nice Leo :partying_face: :partying_face: :partying_face:

1 Like
20

Thanks a lot, Leo.
Can you please also take a look at www.goodcloud.xyz if you can. There the general situation is already quite good. There the choice of the chipper suites can possibly be improved a bit.

21

Done.
Thank Henry again for your advice. :smiley:

1 Like
22

Thanks a lot, Leo. Thats looks now excellent for me.

On other point for possible improvements are the actual by gl used validation check for firmware by MD5.

It can be, it’s possible, to optimize the security in this point a little bit too from good to excellent, by replace the MD5 by sha256.

VBR

23

I have given this advice to the firmware development team, they will improve the side.

24

For some customers are, improving safety from Good to Excellent is an important argument for their purchase decision.

Thank you, Leo.

Addendum:
Is there already an approximate timetable ?
THX

Addendum:
Push up from the Easter Bunny

1 Like
25

Push up from end of April.
Thank you, Leo.
Is there already an approximate timetable ?
THX

26

I have urged relevant colleagues today, and there is no timetable yet. Thank you for your patience.

27

Today I discovered by chance a little How Too about the differences in the technical implementation of an integrity check by e.g. MD5 and SHA256, which is probably at least a partial solution for.

Just in case someone is interested in this for e.g. own projects. Experienced programmers, will surely know even more uncomplicated ways of implementation.

1 Like
28

Does it good news on father day about a more secure firmware update handling ?

A small partly how to:

1 Like
31

Now we have the half year jubilee of "unsecure-firmware-validation-check reporting on gl forum. Thats time for a party. Lets open champagne. :heart_eyes:

Ok. the bug report can be much older. Its not possible to check the bug reports from weeks of testing gl products, because the bug tracker was deleted:
GL.iNet - Connecting The World To Secure Wi-Fi :grimacing:

How ever. Today ist time for a party.
Looks forward.

32

There any news of fixing this security issue ?

THX

33

We conducted internal exchanges and discussions, and only optimized subsequent new products. (E.g. GL-X300B etc.)

34

Now for remembering the small partly how to for fixing this ooooooolllllllllllllld and easy to fix security issue:

The shareholder and the costumer will love the improvement of the products.

THX

35

Small remembering of unsecure firmware validation check security issue…

Full list of 3.104 test result can found on:

36

Looks like the firmware team are working on it since GL-MT1300
check the link below
https://dl.gl-inet.com/firmware/mt1300/testing/