TP-Link blocks open source router firmware to comply with new FCC rule

http://arstechnica.com/information-technology/2016/03/tp-link-blocks-open-source-router-firmware-to-comply-with-new-fcc-rule/

by jhack • 10 years ago

166 99 10 years ago

arstechnica.com

giancarlostoro• 10 years ago

I wonder if the blocking is simple to circumvent. If people circumvent it, the fault is not TP-Links, they had no idea or whatever, right? Either way I'm sure people would "root" these devices eventually, it usually happens. That or I could see a market in e-bay for older routers.

mindcrime• 10 years ago

Good point. I mean, these are low margin devices.... how much is TP-Link going to spend to try and prevent rooting?

Moto74512• 10 years ago

I just bought one of the affected TPLink models. Personally I hope this means more vendors ship a good quality copy of OpenWRT a la Buffalo (though I ended up sticking with their modified version) as an officially supported firmware. People who buy premium routers are aware enough of the benefits that it is worth it for Buffalo to ship it on their devices. I can't see it not being a value add for others.

cortesoft• 10 years ago

Wait... the article says the change isn't happening until June 2nd of this year.... how do you already have one of the affected models?

pingec• 10 years ago

So far I think tp-link locked down just the web interface. I believe it is still possible to flash via tftp and some other methods.

When tp-link plug these holes there will still exist many exploits possible to get root access and if not we will have to flash it through SPI.

Edit: here is one of the first exploits available: https://forum.openwrt.org/viewtopic.php?id=63123

qb453• 10 years ago

This can be easily "fixed" by making the SoC check RSA signatures on flash contents.

It all really depends on how much the FCC will be willing to bother hardware vendors whose products end up as popular hack platforms.

dconrad• 10 years ago

Appears that TP-Link's heart is not in this -- they're doing the minimum to comply with FCC rules.

Will be interesting to watch the arms race between OpenWRT and the reluctant ODMs.

awalton3• 10 years ago

Appears that TP-Link's heart is not in this -- they're doing the minimum to comply with FCC rules.

The FCC has commented that the minimum is significantly less than what TP-Link actually implemented. See https://ifixit.org/blog/7571/fcc-routers/ (and the linked FCC amendment) for more information.

moefh• 10 years ago

TP-Link appears to be doing the minimum as in "minimum effort", as opposed to "minimum restriction to firmware modifications".

The article you linked shows that people saw it coming:

Open source projects might not be fully out of the woods yet, though. A few commenters on the FCC’s post have pointed out that some manufacturers might choose to lock down the whole router—as opposed to just the radio—as a cost-saving measure, even if that’s not what the FCC intended.

mtgx• 10 years ago

At the very least they could start selling some DD-WRT routers to appease the critics and make them forget all of their other products are closed, but they aren't even willing to do that.

zanny• 10 years ago

This is why I always buy Buffalo routers. They are marginally more expensive, but in the same way I will intentionally buy laptops that ship with Linux as a price premium, I'll also buy routers that ship open source firmware by default because my money sends a message.

It does not matter that I replaced Ubuntu on my Galago with Arch or the DDWRT on my wzr-n600 with OpenWRT, becauase I'm on the books at these companies buying hardware running open source software.

No1• 10 years ago

It's amazing to me that instead of seeking out and prosecuting the handful of people causing problems near airports, the FCC wants to prevent everyone in the United States from running open source router firmware.

toomuchtodo8• 10 years ago

Regulating the proper use of a shared public resource (RF spectrum) is sort of the FCC's thing. Tragedy of the commons, your rights end where the next person's begin, that sort of jazz.

This will probably evolve into the baseband firmware being closed, and the higher abstractions being open (with an API to interface to the baseband). Just like cellphones. Which is acceptable unless you're unrealistic about necessary regulations.

EDIT: If you don't believe regulation is required, think about tens or hundreds of thousands of wireless devices in the wild that can cause RF interference with no ability to get them recalled.

That time Netgear negligently hardcoded the address of University of Wisconsin's NTP server comes to mind: http://pages.cs.wisc.edu/~plonka/netgear-sntp/

aftbit2• 10 years ago

It's pretty inconvenient for people who want to experiment with e.g. mesh networks, ham radio, etc as mentioned in the article. Also, it seems a bit silly, as true SDR prices are going to keep going down. You can already buy a HackRF for $300 or a YardStick for $150.

I'd be in favor of requiring a significant technical burden to enable access to the wireless hardware. Maybe make people open the case and solder a jumper. But there should always be a path forward for experimentation.

AnthonyMouse8• 10 years ago

Regulating the proper use of a shared public resource (RF spectrum) is sort of the FCC's thing. Tragedy of the commons, your rights end where the next person's begin, that sort of jazz.

Right. So they should go after people who actually misuse the spectrum, and not people who install their own firmware without doing that.

Or go after the people who are distributing firmware that misuses the spectrum.

This will probably evolve into the baseband firmware being closed, and the higher abstractions being open (with an API to interface to the baseband). Just like cellphones

The problem is including separate hardware to lock only the baseband is more expensive than locking the entire device. Smart phones cost several times what consumer-level routers do, and that's after the phone is subsidized by advertising and app store revenue.

Lawtonfogle2• 10 years ago

It is the same kinda of idea of banning big scary guns instead of going after the people who use guns to commit crimes (and also ignoring that the people who do commit crimes often aren't even using the big scary guns).

Regulators gonna regulate!

01Michael10• 10 years ago

What country do you live in? In the US, gun violence is a real serious crime and the police will use all their resources to go after criminals yet we are a world leader in gun violence. It's probably something to do with guns being so unregulated, plentiful, and easy to get here...

seanp2k2• 10 years ago

Plus, if we limit that ability, no malicious people will figure out how to buy a single-board computer with some type of open radio platform </s>

mkhpalm• 10 years ago

Are there any documented cases where people were near airports causing such problems with things like OpenWRT, DD-WRT, etc?

Something tells me that cases demonstrating the need for such a ruling are hard to come by.

awalton3• 10 years ago

...and now Nobody will buy TP-Link routers, once the Amazon reviews are filled with 1 stars.

The market will likely sort this out for itself.

CommanderData• 10 years ago

I'll make sure my next router is not TP-Link. I'm upgrading in about a month.

ak4g• 10 years ago

From their FAQ, the change will only happen on routers produced after June of this year. So technically, the best time to buy a TP-Link router is right now!

mynameisvlad• 10 years ago

Hah, yeah right. The general consumer simply doesn't care they can't flash open source firmware. For every 1 star review from someone who does care, there'll be plenty of 5 star reviews from regular users who have their needs filled by the router with default firmware.

happycube• 10 years ago

They all have to do this.

awalton3• 10 years ago

No, they don't: https://apps.fcc.gov/kdb/GetAttachment.html?id=zXtrctoj6zH7o...

zymhan• 10 years ago

No, they do not, they just chose to take the easy way out and prevent flashing an open source firmware.

rpgmaker• 10 years ago

It seems it would be only a matter of time before other manufacturers join TP-Link on this.

qb453• 10 years ago

There is no way to comply with those regulations without prohibiting software updates on current generation of WiFi chips because they don't enforce regulatory constraints in hardware - it's driver's job.

I expect all other vendors to do the same, at least for now. Market can't sort this out.

fucking_tragedy• 10 years ago

The cheap option is to lock down everything, other manufacturers will follow suit.

The average person doesn't care.

We thought the same thing about privacy and user data mining, but look where we are.

jacquesm• 10 years ago

At some point the FCC and the open source community are going to clash violently with some reluctant vendor caught in the middle.

zokier2• 10 years ago

I thought the point is right here right now?

aftbit2• 10 years ago

This is the worst part:

Cisco argues that open source software could be consistent with the FCC's goals. "There is nothing in the Commission's existing or proposed rules that would limit or eliminate the ability of a developer to use Open Source software, including software that controls radio emissions," Cisco said in an FCC filing in November.
But this would require a more locked-down approach than one in which users can modify the firmware, Cisco said. "The ability to review source code is not inherently incompatible with the notion of locking the integrity of a product against modification or tampering," Cisco wrote. "It is perfectly possible for a product to have source code that is capable of review by the public while that same code is secured inside the device against change by the end-users."

That misses many of the important goals of open source (and points back to the "open source" vs "free software" debate). It's not just about being able to view the existing software, it's about being able to control the systems that process your data.

For example, what if the manufacturer stops supporting the hardware? Today, you can just keep updating openwrt and avoid any security issues. After 2016, that won't be possible.

_yp• 10 years ago

This is exactly what the GPLv3 protects against.

toomuchtodo8• 10 years ago

Which government regulation overrides.

rhizome• 10 years ago

See also: "Shared Source"

https://en.wikipedia.org/wiki/Shared_source

nickpsecurity8• 10 years ago

Glad to you brought this to my attention. My proprietary vs OSS essay promoting hybrids was going to change OSS to shared source to avoid confusion of established OSS definitions. Now, I suddenly find Microsoft has a brand of intiatives called Shared Source. They had to pick the most generic, intuitive thing I could come up with. This will probably cause confusion at some point. (sighs)

Might get away with it but maybe need alternatives. If not "open source" or "shared source," what's a generic phrase for software that includes the source but not necessarily OSS principles.

hc000• 10 years ago

This is interesting, big companies are moving their enterprise switch / routers to open source software and Cisco is trying to lock it down. I think long term, Cisco will lose this battle.

geographomics3• 10 years ago

Is this really that much of a problem? Circumventing the block sounds like it could be a rather interesting technical challenge.

drdaeman2• 10 years ago

Not really.

Reverse engineering things can be a fun challenge - but not if your purpose is not to have fun analyzing it, but to do something else, like actually use the device you bought. If RE is not something you want to do but you have to - it's more like frustrating than interesting.

qb453• 10 years ago

This, and also it can become a whack-a-mole game with vendors threatened by the FCC, possibly ending up in shit like encrypted firmware. Go ahead and hack that.

geographomics3• 10 years ago

If you're buying a device to replace the stock firmware with something customised to your liking, then you're already in the hacker mindset, so having to tinker that little bit harder surely shouldn't be much of a burden.

DannyBee• 10 years ago

So, then, i guess they are going to stop using GPL/LGPL software or will soon be enjoying the wrath of the SFLC.

Time to go give some money to bradley :)

nickpsecurity8• 10 years ago

I just bought a TP-Link wireless adapter due to specs, reviews, and OSS support. Then I read this crap. That's just great. There's actually an obvious solution to this that gives us plenty freedom and meets FCC regulations. I'm not sure why companies aren't doing it. I plan to approach some of them or SOC providers this year to see if they might help us and them out.

wmf• 10 years ago

Does the obvious solution cost one cent more?

nickpsecurity8• 10 years ago

It might cost less, about the same, or slightly more. It's not clear without more information from their side. Let's just say the techniques I considered are widely applied in industry in cost-sensitive HW. Even products build around 8-bit SOC's use similar techniques sometimes.

flyinghamster• 10 years ago

If this is going to be the "new normal" then I'm thinking that the best way to go would be to use a low-power PC or ARM system with two NICs as my router, and use dedicated access points for wireless. I'm not going to put up with crappy router firmware.

wtallis• 10 years ago

You should still want the benefits of open-source wireless. Only the open drivers will benefit from new algorithms for per-packet transmit power control (https://github.com/thuehn/Minstrel-Blues) and queuing/QoS that is designed for wifi (http://thread.gmane.org/gmane.linux.network/401202). Plus, the open drivers get bug fixes to the point that they're actually stable.

puppetmaster3• 10 years ago

This is the most depressing news for human race during my lifetime.

I see this as sign of coming total control, followed by lack of initiative and stagnation of humanity.

KiDD• 10 years ago

BOO!

visualphoenix• 10 years ago

All the more reason to support the Turris Omnia [1]. Open hardware / software [2]:

  [1] https://omnia.turris.cz/en/

  [2] https://github.com/CZ-NIC/turris-os

  [3] https://www.indiegogo.com/projects/turris-omnia-hi-performance-open-source-router#/

transfire• 10 years ago

Not to worry! Next they'll require an open backdoor into every network.

bcook• 10 years ago

The FCC ruling seems logical. The earliest "sky is falling" reaction comes from TP-Link's initial attempt to comply, and even TP-Link's response is logical and somewhat subdued compared to the alternatives.

TP-Link's response is hopeful in my opinion, compared to what router's were 10 years ago. We are fighting for improvement, and the FCC ruling is simply a speedbump. The current mentality is openness, as I see it.

wsha• 10 years ago

How hard is it to import a European router to the US? Is that illegal? I would think as long as one operated it within the FCC's limits it would be legal to use it.

ycmbntrthrwaway2• 10 years ago

The problem is that most likely these routers will be locked as well because of mass production.

datashaman• 10 years ago

I wonder if this will actually be restricted to US models only, or whether we will all suffer the same fate.

TP-Link blocks open source router firmware to comply with new FCC rule

Related Stories