|
The Netcomm NB1300 is not that secure. It's already had one security problem noted , and to look at the current firmware, they have a fairly poor workaround for it.
In my opinion, there's no substitute to turning all services off to the Internet by default. Things such as HTTP (port 80), FTP (port 21), Telnet (port 23), and SNMP shouldn't be visible to the Internet at all. Unfortunately on the Netcomm, all of these and more are visible. By default, the HTTP interface denies access to the Internet - but FTP doesn't (in the latest firmware, there's a routing rule that diverts incoming FTP connections to 192.168.1.255, the broadcast address for the subnet). Telnet is disabled by default, so that's okay. SNMP is enabled by default, and worse yet - there doesn't appear to be a way to disable SNMP!
Unfortunately the majority of end users wouldn't go past the "Basic Setup" screen, where they input their account details, save and reboot, and hey presto! Instant Internet. So unfortunately there may be a situation where
a) People not running the current firmware are by default vulnerable to known exploits, and/or
b) Anyone running a Netcomm NB1300 may be vulnerable to as-yet undiscovered - or old and forgotten - exploits.
Unfortunately, a security solution that returns a 403 "Access Denied" error on port 80 (HTTP) is not a solution. It's a potential problem waiting to happen.
Remember, though, what I said in my original editorial about the problems with the Netcomm NB1300. I really do love my Netcomm NB1300. I just don't love Netcomm's support, and I don't like their security at all. I didn't mention the security previously because it was a non-issue while the device was dead. How can I love a device that's so poorly secured?
The answer is that I don't rely on its security. I let it do what it's really designed to do - connect me to the Internet. Under the "Misc Configuration" of the NB1300's Advanced Settings, I've set DMZ to "enabled". I have then configured the DMZ server to my wireless router's IP address. This router just so happens to double as a firewall. And by default, all its services are OFF to the Internet. So it doesn't even show as a blip on the radar - all services are totally invisible, or operating in "stealth" mode. To be totally accurate, the only port which shows up is port 0 - and this is via the ShieldsUP! service which is the only scanner I know of that checks for it. It doesn't really appear to be a serious security concern at this stage.
Not necessarily the most elegant solution, but it certainly works better than Netcomm's really poor workaround.
But let's backtrack for a second. One purpose of the Netcomm NB1300 is to permit an Ethernet connection to the ADSL network, allowing the connection to be shared between multiple PC's. I imagine that the majority of people out there wouldn't be too interested in the prospect of buying an additional hardware-based firewall for their small network, and that furthermore this would hurt the chance of them purchasing an NB1300.
Well, I do have a solution to this. Again, it's not elegant, but it certainly does work. You still set the DMZ and DMZ server. But if you don't have the benefit of a hardware-based firewall, you can set it to any unused IP address (such as 192.168.1.254, which is outside the default DHCP range). This still has the effect of turning off all inbound services, and your router won't be visible at all - not even port 0.
My main reason for diverting to the hardware-based firewall is for testing purposes - I need the logs and other functionality provided by the router. If you don't care about this, you can still buy what is a relatively cheap ADSL modem with a fairly hefty warranty (36 months with registration), and be reasonably assured of the security by implementing this simple (if somewhat clumsy) workaround that is nonetheless a major improvement on the default security.
|