Slashdot Log In
Netgear Routers DoS UWisc Time Server
Posted by
michael
on Fri Aug 22, 2003 12:23 PM
from the RISKs-fodder dept.
from the RISKs-fodder dept.
numatrix writes "For the last few months, hundreds of thousands of netgear routers being sold had hardcoded values in their firmware for ntp synchronization, causing a major denial of service to the University of Wisconsin's network before it was filtered and eventually tracked down. Highlights how not to code embedded devices." A really excellent write-up of the incident.
Related Stories
[+]
Technology: D-Link Firmware Abuses Open NTP Servers 567 comments
DES writes "FreeBSD developer and NTP buff Poul-Henning Kamp runs a stratum-1 NTP server specifically for the benefit of networks directly connected to the Danish Internet Exchange (DIX). Some time last fall, however, D-Link started including his server in a hardcoded list in their router firmware. Poul-Henning now estimates that between 75% and 90% of NTP traffic at his server originates from D-Link gear. After five months of fruitless negotiation with a D-Link lawyer (who alternately tried to threaten and bribe him), he has written an open letter to D-Link, hoping the resulting publicity will force D-Link to acknowledge the issue. There are obvious parallels to a previous story, though Netgear behaved far more responsibly at the time than D-Link seem to be."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
and now... (Score:5, Funny)
oh, and fp.
Obligatory Scooby Doo reference (Score:5, Funny)
So who got fired? (Score:4, Interesting)
Yah right. Some hapless low level programmer probably got all the blame for putting test data in there in the first place.
Re:So who got fired? (Score:5, Insightful)
Bah.
This is one 'simple mistake' by one company that namaged to send a constant "250,000 packets-per-second (and over 150 megabits-per-second)".
Now I know Netgear is a pretty big outfit, but there are LOTS of companies like that out there, and these little mistakes can add up. How much network traffic could be avoided with proper programming?
Also, this kind of makes me think about the useless network activity my XP box (bleh) tries to send out. Multiply that by millions and millions, and you get a number a whole lot bigger than the one above.
Who pays for all that wasted bandwidth?
Parent
Re:So who got fired? (Score:5, Insightful)
Parent
Re:So who got fired? (Score:5, Insightful)
Netgear reported that the non-UW addresses were used for debugging by the developers.
Here's the interesting part: at least two of those are 12.* addresses --- cablemodems with attbi.com. So if you want to know who the developer responsible is, it might be a reasonable guess it's whoever lives at those IP addresses!
Parent
Re:So who got fired? (Score:5, Insightful)
This was a big screwup - when an NTP query fails, you don't start retrying every second until it comes back. You don't hardcode a single server address for it. And you don't put this in 700,000 pieces of released hardware.
Parent
Poor uWisc (Score:5, Funny)
Now the
Bad form in general (Score:5, Insightful)
Or any other kind of software for that matter.
I did that to myself once (Score:5, Funny)
If they did it to my NTP server... (Score:5, Funny)
Alas, not true... (Score:5, Informative)
This is a case of ill-designed, badly written, poorly debugged, wretchedly tested code. The article details the testing of a code fix that still didn't fix things properly. On the bright side, Netgear is trying to Do The Right Thing now, and they deserve credit for that.
Parent
Hasn't /. learned? (Score:5, Funny)
In other news at the University... (Score:5, Funny)
Our usage graph...You Jerks! (Score:5, Interesting)
http://www.cs.wisc.edu/cgi-bin/cricket/grapher.cg
Yeah, I work at the CSL at UW Computer Sciences, and the tracking of this netgear issue was quite an interesting tale. Had us stumped for quite some time.
Parent
Re:Our usage graph...You Jerks! (Score:5, Funny)
Go ahead, give us another, I dare ya!
Parent
Re:Our usage graph...You Jerks! (Score:4, Insightful)
don't get me wrong, I love the irony, but your network admins are having enough troubles on a Friday already.
Parent
Re:Our usage graph...You Jerks! (Score:5, Informative)
The load is fine. It's already subsiding. We can handle slashdottings, heh.
Look at the weekly graph, we had 2 this week already!
Just slows down for a while, but doesn't break anything.
Parent
Re:Our usage graph...You Jerks! (Score:5, Funny)
ShortSpecialBus, eh? ;-)
Parent
I wonder what NetGear's liability is. (Score:5, Interesting)
Re:I wonder what NetGear's liability is. (Score:5, Insightful)
As for the damages, those are somewhat vague. Sure, maybe they could be made to pay for the bandwidth used. The big hit would probably be punitive damages unrelated to the actual loss.
This would be a fun case and I would encourage them to sue. So many frivolous lawsuits floating around - this one would actually have some merit.
Parent
Re:I wonder what NetGear's liability is. (Score:5, Insightful)
It would probably be deductable, passing some of the cost on to we taxpayers; but would sit alot better with public perceptions of the company.
Set up a few CS scholarships or funding a chair at the University would help.
They could turn it into a publicity coup and end up paying out less in the long run (and screw the lawyers too). Some (not all) insurance companies have finally discovered that it's usually cheaper to negotiate with the plaintiff right away, avoiding all of the sabre rattling and lopping off a third (or more) of the total probable cost.
Litigation is rarely the best answer.
Parent
Re:I wonder what NetGear's liability is. (Score:5, Interesting)
I mean, we're talking 150+ Mbps here, for months on end. That's $15K/mo in bandwidth, assuming they have a really good deal and pay only $100/Mbps/mo.
Parent
Re:I wonder what NetGear's liability is. (Score:5, Informative)
Parent
Re:I wonder what NetGear's liability is. (Score:5, Informative)
Parent
Now did NetGear get permission (Score:4, Interesting)
Re:Now did NetGear get permission (Score:5, Informative)
Check out the NTPd man pages- I believe this server is a second echelon mirror.
Parent
Analysis Tools used in this article.. (Score:5, Interesting)
RRGrapher, FlowScan and Cflow being ones I have never messed with..
Cool.. new tools to play with!
Delicious irony (Score:5, Funny)
NTP should be responsibility of network server (Score:5, Informative)
It's not about just embedded devices... (Score:5, Insightful)
Highlights how not to code embedded devices
I think this highlights a "how not to code" idea, period. In 1986, when I was taking a BASIC (boo, hiss) course in high school, I learned that values should be expressed as variables even if the coder does not expect them to change. So instead of using (32 feet/second^2), one should instead declare g once, using whatever units are appropriate, and thereafter refer to g instead of a hardcoded value. If g changes, the coder need only update one line.
Note: I am not a programmer/coder/developer in any sense of any of the words, so technical nits should remain unpicked; however, if I am completely out in left field, please feel free to point that out.
Re:It's not about just embedded devices... (Score:5, Insightful)
So you're not in left field, it's just that the developer who wrote the software apparently did exactly what you said, which was not relevent to the mistake at hand, which was more about the faulty implementation of the NTP service, and the fact that it was hardcoded to a single IP address.
Parent
SEGA's online game servers (Score:5, Insightful)
It's not a new story, but I think it bears repeating as a showcase of stupidity.
Parent
Re:It's not about just embedded devices... (Score:5, Funny)
Parent
Re:It's not about just embedded devices... (Score:5, Funny)
oh, and we laughed long and hard at the guy who put down:
Parent
Netgear should bear the cost... (Score:5, Insightful)
And then, on friday august 22 2003.. (Score:5, Funny)
Simple Fix (Score:5, Funny)
After 6 seconds, the netgear will crash and burn as a result of the Y2K38 problem and the requests will be no more.
Think Strata (Score:5, Informative)
Unfortunately, the code droids seem to think that there's something magical about being at Stratum 2 instead of Stratum 3 or Stratum 4; also, they seem perfectly willing to take advantage of a nonprofit consortium (the owners/operators of public Strat 1 clocks) instead of spending the $500 or so on hardware to service their own customers, who presumably paid them for something.
Anyone else remember the Good Old Days when it was considered polite to ask first before using someone else's clock?
[Truechiming since 1987...]
Mentioned on ntp.org mailing list a while ago.. (Score:5, Informative)
David L. Mills wrote on 2003-06-26 10:55:
> Guys,
>
> I find myself on the review team for an incident taking place at U Wisconsin/Madison. Apparently, the Netgear folks have manufactured some 700,000 routers with embedded SNTP clients configured to use the public U Wisconsin NTP server. The server address is unchangeable and the client cannot be disabled. If that isn't bad enough, if the client gets no replies, it starts sending packets at one-second intervals until forever and without backoff.
>
> The U Wisconsin folks determined some 285,000 different IP addresses are now sending between 300 and 700 packets per second requiring between 150 and 400 megabits per second. Apparently, the principal eason for this flux is misconfiguration of the firewall component of the router. This is costing them $266 per day.
>
> The Netgear folks were slow to respond until U Wisconsin folks emailed the entire senior management and others known to be U Wisconsin alum. Netgear says they have no way to recall those routers and no way to insure the products are updated from the web site. The products cost between $20 and $40 depending on rebate.
>
> U Wisconsin have considered several ways to deflect the tide, the most promising may be noting the source port 23457 unique to these products and tossing them at the doorstep. The products do not use DNS and are not configurable. Another way considered is to configure a subnet visible to BGP and convince the ISPs to punch holes in the routing fabric. Send money.
>
> I never thought it could get as bad as that. My reasoned recommendation was to fire up the lawyers and sue the bastards for costs and punitive damages and to injoin the company from selling any products until proved safe. There is apparently some standards group that allegedly reviews and certifies new products for Internet use. The Netgear products were all certified, which surely says nothing about the standards group.
>
> Include me in any replies; I am not on any ntp.org list.
>
> Dave
Poor UWisc (Score:5, Funny)
Then the e-mail server (from the helpdesk requests)
Then the webserver (from
What next?
It generated costs on the other side too (Score:5, Interesting)
Aparently there are a lot of Netgear users in Germany who are stuck with horrendous bills now. I wonder if Netgear is going to pick those bills up?
Spytime (Score:4, Insightful)
This is par for the course for Netgear. (Score:5, Informative)
Story:
I used to work/volunteer for DynDNS.org. The Netgear firmware client for DynDNS tried to update regularly (I believe every 5 minutes) whether or not the IP address had actually changed AND whether or not it got a response. Once enough of these got out into the market, this became quite a problem for DynDNS, especially with users complaining that we "blocked" their hostnames updated with the Netgear client when their router advertised specifically that it worked with our service.
I believe after a year or so of nagging the Netgear people, they finally released a firmware update that actually fixed the problem.
Thank you, UWisc and Netgear (Score:5, Insightful)
To Netgear, THANK YOU for not calling upon the DMCA, filing NDA law suits, etc.
It was resolved in a diplomatic and professional manner...and the write up explaining the entire incident was educational and informative.
Now, if it had been SCO or Microsoft involved......
To Netgears Credit...Okay maybe not.. (Score:5, Informative)
This specific issues was raised back in may... I can say within that same week they had already started testing firmware to fix the issue. The issue comes with the huge break between Netgear engineers and Netgear support. Umm often times the supports reps do not know of the release of the product until like 2 days or 3 days after its already hit the market. On top of that there is very little communication between the two on firmware and whats the latest version. Its been only in the past couple weeks have they really started to communicate.
Along with that Netgear did not have a device testing program until i would say about 3-4 months ago, before that it was just people there who had the time to test products... woudl test them. I know being one of those who has and still does test there products, that the communication is not very stable and that sometimes issues like these get short-cutted for other major issues such as security and hardware stability.
I am also sure anyone in the hardware market understands the rush that sometimes comes with products; in netgear this is not different. I can this was an issue that was not expected and was fixed as soon as it was reported. It should have never gone out as is and the products should have been tested throughly in the consumer enviorment. But, to Netgear's credit the company does sell pretty good products and there customer support although you may not always be able to get your answer to the issue or may not be able to sometimes understand the reps any and all issues do esclate to people who can fix them. If you issues are not getting fixed at that point the president of the company does read your mail and does forward them to the Head of the customer support. I can say that issues like these will become less of a problem now that Netgear has started a beta program and engineers are required to speak to support engineers on a regualr basis
Indeed (Score:5, Funny)
"/* Huge Bodge */"
"/* Kludge */"
"/* Magic numbers are cool */"
Parent
Re:Indeed (Score:4, Funny)
/* Too drunk -- debug later */
Parent
Re:Err why ? (Score:5, Insightful)
Parent
Re:Err why ? (Score:5, Interesting)
Home centric routers do not tend to have their clocks set before shipping as there is no assurance that a battery keeping that clock powered will be doing so ver the entire span of time from manufacture to customer plugging it in. Even if it did the drift involved would give some inaccuracy as well.
There are two correct solutions. One is that Netgear should operate their own time server and hard code that server as a secondary or fallback time server. The primary time server should be aquired from the internet service provider when they get their network ip address via dhcp.
-Rusty
Parent