Tag: router

Article – From the horse’s mouth

AVM earns more industry recognition for their Fritz!Box devices

AVM

AVM is delighted to win two Connect awards (Press Release)

My Comments

AVM has just earned two Connect awards for their German-designed home-network technology.

The first of these was for the Fritz!Box routers and mesh setup. No wonder they would earn industry recognition for their home-network products especially since they were the first company to break the mould regarding home-network routers by supplying self-updating firmware.

The issue of self-updating firmware became very important due to the fact that most of us aren’t updating our home-network router’s firmware regularly and it was a security hole. This is thanks to the “out-of-the-box” software coming with bugs and weaknesses that can be exploited by hackers against the typical home network.

Another step in the right direction was to implement distributed-wireless networking through a free software update rather than requiring customers to replace their AVM home-network devices. This was about providing a function update to the Fritz!Box modem router’s FritzOS firmware to open up this functionality. There was even the ability to roll out the functionality to Fritz!WLAN Repeaters and Fritz!Powerline access points to bring on the simplified distributed-wireless functionality to them all. It also applied to some recent-model Fritz!Box modem routers to cater for the reality that an older router can be “pushed down” to be an access point while the new router works as the edge of your home network.

But they also earned awards for their IP-based telephony equipment which was considered important as European telcos are moving towards IP-based telephony and away from the traditional telephone system. One of the products was a CAT-iQ DECT cordless handset that worked with their Fritz!Box modem routers that had DECT hase-station functionality for VoIP telephony. This had abilities similar to what you would expect of a mobile phone of the “feature phone” class.

What is being shown here is that the European companies are coming through on functionality innovation when it comes to the home-network “edge” router or infrastructure devices for your home network.

Articles

UK mulls security warnings for smart home devices | Engadget

New UK Laws to Make Broadband Routers and IoT Kit More Secure | ISP Review

From the horse’s mouth

UK Government – Department of Digital, Culture, Media and Sport

Plans announced to introduce new laws for internet connected devices (Press Release}

My Comments

A common issue that is being continually raised through the IT security circles is the lack of security associated with network-infrastructure devices and dedicated-function devices. This is more so with devices that are targeted at households or small businesses.

Typical issues include use of simple default user credentials which are rarely changed by the end-user once the device is commissioned and the ability to slip malware on to this class of device. This led to situations like the Mirai botnet used for distributed denial-of-service attacks along with a recent Russia-sponsored malware attack involving home-network routers.

Various government bodies aren’t letting industry handle this issue themselves and are using secondary legislation or mandated standards to enforce the availability of devices that are “secure by design”. This is in addition to technology standards bodies like Z-Wave who stand behind logo-driven standards using their clout to enforce a secure-by-design approach.

Home-network routers will soon be required to have a cybersecurity-compliance label to be sold in the UK

The German federal government took a step towards having home-network routers “secure by design”. This is by having the BSI who are the country’s federal office for information security determine the TR-03148 secure-design standard for this class of device.  This addresses minimum standards for Wi-Fi network segments, the device management account and user experience, along with software quality control for the device’s firmware.

Similarly, the European Union have started on the legal framework for a “secure-by-design” certification approach, perhaps with what the press describe as an analogy to the “traffic-light” labelling on food and drink packaging to indicate nutritional value. It is based on their GDPR data-security and user-privacy efforts and both the German and European efforts are underscoring the European concern about data security and user privacy thanks to the existence of police states within Europe through the 20th century.

… as will smart-home devices like the Amazon Echo

But the UK government have taken their own steps towards mandating home-network devices be designed for security. It will use their consumer-protection and trading-standards laws to have a security-rating label on these devices, with a long-term view of making these labels mandatory. It is in a similar vein to various product-labelling requirements for other consumer goods to denote factors like energy or water consumption or functionality abilities.

Here, the device will be have requirements like proper credential management for user and management credentials; proper software quality and integrity control including update and end-of-support policies; simplified setup and maintenance procedures; and the ability to remove personal data from the device or reset it to a known state such as when the customer relinquishes the device.

Other countries may use their trading-standards laws in this same vein to enforce a secure-by-design approach for dedicated-function devices sold to consumers and small businesses. It may also be part of various data-security and user-privacy remits that various jurisdictions will be pursuing.

The emphasis on having proper software quality and integrity requirements as part of a secure-by-design approach for modem routers, smart TVs and “smart-home” devices is something I value. This is due to the fact that a bug in the device’s firmware could make it vulnerable to a security exploit. As well, it will also encourage the ability to have these devices work with highly-optimised firmware and implement newer requirements effectively.

At least more countries are taking a step towards proper cybersecurity requirements for devices sold to households and small businesses by using labels and trading-standards requirements for this purpose.

Increasingly, as the cities become more dense, most of us will be either living in an apartment or looking towards doing so. In some cases, some of you may be living in a larger house in a rural or peri-urban area but maintain an apartment as a city-based “family house” if you or your family are making frequent trips downtown.

There will be issues that will impact how you set up your personal IT and home network in these apartments in order to make sure that it can coexist with your neighbours’ networks. Let’s not forget that those of you who are active in your building’s management committee may face discussions and questions about building-wide IT including the Internet Of Things. Here, I will be regularly publishing articles that may be of relevance to you and your situation.

When you are thinking of “downsizing” towards that small apartment, you may find that your needs change as far as your home network is concerned. As well, you may have to set things up so that your network coexists properly with your neighbours’ home networks especially as far as data privacy / security and network performance is concerned.

In most cases, setting up your home network and Internet connection at your apartment may be a simple task with you just installing a wireless router to use with your portable devices and, in most cases, a HomePlug AV500 powerline network segment for desktop computers and home-entertainment equipment.

But not all apartments may come across as a simple setup. For example, you may come across places with internal walls or plenums that are constructed of dense materials like double-brick, cinderblock or reinforced concrete or use metal as part of their construction, which can impede reliable Wi-Fi wireless signal reception.

As well, you need to be sure with HomePlug powerline or Wi-Fi wireless technologies that your operation of these technologies doesn’t impede on your neighbours’ use of them. This includes being sure that your data on your network stays private while theirs also stays private.

Equipment

Wireless Router

Most recent-spec Wi-Fi routers may serve you well for apartment-based networks

You can get by with most Internet routers, whether you buy them yourself or have them supplied as part of your Internet service. This may be true for a studio, one-bedroom or small two-bedroom location but you may have to consider something with improved Wi-Fi wireless performance for larger two-bedroom or three-bedroom spaces.

It is more so if your apartment follows the typical path of having the Internet connection like the telephone socket installed at one end of the dwelling which is opposite to another end where a lot of your living takes place.

Wireless connectivity

But you need to be sure that the Wi-Fi wireless functionality is of current specification. You may not need to worry about whether the router uses external high-gain antennas because of the smaller area that it is expected to cover. But I would make sure that this functionality works across two bands simultaneously especially as the 5GHz band is still seen as “new territory” for network coverage and can facilitate high throughput. Such a router will be described as 802.11a/b/g/n simultaneous dual-band or the routers that have 802.11ac functionality will be simultaneous dual-band devices.

Internet (WAN) connectivity for next-generation services

If your building is provisioned with next-generation broadband Internet service, find out whether the equipment supplied in your apartment includes router functionality or is simply a modem or optical-network terminator. In the latter situation, you would just need to use a broadband router with an Ethernet WAN (Internet) connection. It is also worth noting that a lot of FTTB (fibre-to-the-building / fibre-to-the-basement) setups will implement VDSL2 for the copper path to your apartment so you would need to use a modem router that supports this technology on the WAN side. This is a feature that is becoming available with newer mid-range and high-end DSL modem routers and is slowly trickling to economy equipment as this technology becomes more common.

In some cases, you may be lucky enough to have an FTTB setup which implements Cat5 Ethernet wiring to all of the apartments like with Spirit Telecom in Australia. The same would hold true for an FTTP (fibre-to-the-premises) setup which simply uses an optical-network terminator. Such setups would simply use a broadband router with an Ethernet WAN connection.

It is also worth noting that a lot of premium DSL modem routers including some equipment offered by carriers are offering a “dual-WAN” or “multiple-WAN” functionality where they have two different paths for connection to the Internet. This is typically an Ethernet and a DSL connection with the ability for you to select between these connection types using the configuration Web interface that they provide. Some of these modem routers have one of the Ethernet ports able to be switched between a LAN (home network) connection or a WAN (Internet) connection rather than a dedicated WAN Ethernet port and you would have to make sure you select the right type of connection for the purpose in mind.

When you move in to a new building as part of your downsizing efforts, you may need to find out from whoever is in charge of the building such as the owners corporation whether it has been provisioned for a fibre-based next-generation broadband service. Here, you would need to know what technology is being used along with whoever is providing the Internet service. This is so you can be sure you have the right equipment for the service.

That headline Wi-Fi Internet service offered by your building

Those headline Wi-Fi Internet services offered by the apartment building will work well with smartphones, tablets and computers only and are best used for casual Internet use

Avoid the temptation to use for your main Internet service that free Wi-Fi service that your building offers as a headline amenity. The kind of developments that typically offer this kind of service are “resort” apartment developments, retirement villages or so-called “residence” apartments let out on a similar business model to a hotel. It also includes hotels that have rooms and apartments available to let for long-term residence but in the same “inn-style” business context with rent; light, heat and power; telecommunications, food and similar living expenses as one payment to that hotel.

This is because of the fact that most of these networks aren’t secure, typically being set up as open wireless networks with a Web-based login experience and intended for casual login. If these networks are properly set up as a public-access network, they will be set up with client isolation so that client devices cannot discover each other across the network.

Therefure, they don’t play well with anything other than a regular (desktop or laptop) or mobile (smartphone or tablet) computing device. I encountered this problem through an online conversation from someone who bought the Sony CMT-MX750Ni network-capable micro music system that I reviewed and couldn’t run its integrated Internet radio and online content functionality and further correspondence that I had with the commenter revealed that this stereo was installed in a “resort” apartment which had this kind of free Wi-Fi Internet access. They ended up having to use it with an iOS device connected to the Wi-Fi network and running a content app for online content.

There is still the security risk of having all the network traffic associated with everyone in the building using that network being “sniffed out” especially in an improperly-configured network, along with the risk of a commonly-known password that is rarely changed.

These Wi-Fi internet services are best used when you want to use Internet-based services from your laptop, tablet or smartphone while in a common space. But you won’t be able to use your home network’s resources from a device connected to one of these Wi-Fi Internet services.

Your home network

Wired-network segment

It may be worth having your apartment wired for Ethernet if you are buying “off the plan”

It is important to consider establishing a wired-network segment alongside your Wi-Fi wireless network segment. This is more important with the arrival of Smart TVs and network-connected video peripherals so you can be sure that they work properly and provide enjoyable viewing. In some cases, if you are locating a desktop computer or network-capable printer away from the router, you may find that a wired network segment may do the job.

If your apartment is being newly built such as when you buy one “off the plan”, it may be worth considering having an Ethernet connection installed if you can afford it. Here, you could have it set up to link to the main living area, the bedrooms and / or study / office space. Here, this is important for larger spaces like two-bedroom or larger apartments, dual-level maisonettes and the like. In this context, the areas you will need to cover are where the router will be and where you will be watching TV or using games consoles or similar equipment.

HomePlug networks can work well with apartment setups as a “wired no-new-wires” network

On the other hand, you can set up a HomePlug AV500 or better powerline network segment to cover your apartment. This is more important if you are on a tight budget or are dealing with a small apartment, and would earn its keep with existing developments.

Some of you may think that you could use a HomePlug powerline network segment to temporarily extend your home network from your apartment out to a common area or your neighbour’s apartment. You wouldn’t see reliable operation if you are doing this in a larger building due to the way the building is wired for many households or the fact that the building’s electrical subsystem is also serving various pieces of  “big-time” electrical equipment like lifts or building-wide heating / air-conditioning equipment which can yield electrical interference.

Wireless access point

You may find that your your home network’s Wi-Fi wireless segment can cover your apartment easily but there are some situations where these places can yield patchy coverage especially for smartphones and tablets.

For example, your apartment may have one or more interior walls made of a dense material like double-brick or concrete and these could impede the Wi-Fi coverage. This can also include where a building uses metal ducts or plenums running from floor to ceiling in the apartment for central heating and air-conditioning, garbage disposal or other purposes. It also includes where you are dealing with pre-1960s buildings where fireplaces used to exist or still exist but in a cosmetic manner. Similarly, you may be living in a “maisonette” or similar-styled apartment where your apartment is across two levels and your network’s coverage may not span both levels properly.

The compact Devolo dLAN 550 WiFi HomePlug wireless access point – fills in the Wi-Fi gaps

Here, you may have to consider implementing an extension wireless access point to improve your network’s reception in those patchy areas. Typically the HomePlug wireless access points that use your apartment’s AC wiring as the backbone can answer this need very easily, providing just the right amount of coverage to fill in that dead-spot. Similarly, some wireless range extenders that can be set up to become access points for a wired backbone can provide that same level of coverage. At the most, you will typically end up with using two wireless access points in your setup – one that is part of the router as well as one extension access point.

How do I set this up?

The Wi-Fi wireless network

Distributed Wi-Fi setups like this NETGEAR Orbi can assure coverage across that large apartment, penthouse or two-level maisonette

In this area, you may have to identify a vacant operating frequency for the network using a Wi-Fi finder app, available for most regular-computer platforms and Android mobile platforms. Here, the channel you use would be the one where there is the lowest signal strength because no nearby networks are using that channel.

But you may find that some wireless routers, access points or distributed-Wi-Fi systems may offer this functionality as part of their setup procedure or may even automatically tune themselves as part of an “easy-setup” routine.

Then you determine a unique SSID (wireless network name) and passphrase for your network and configure your router and other wireless-network equipment to work to these specifications. Some of the routers, especially those offered by ISPs, may have a unique pre-defined SSID and passphrase, but it may be worth changing the SSID on these devices or. if you are comfortable with it, connecting your client devices to this new SSID configuration.

Shared-Internet-access setups

Some of you may use FON, Telstra Air or similar “shared Internet access” setups which require your home network router to be part of a wireless public-access network. Such services have it that you offer bandwidth to other users that aren’t part of your household, then are able to get bandwidth for free due to you offering that bandwidth to others.

This is achieved by it maintains the Wi-Fi access for your home network along with a separate Wi-Fi local network for this public-access network, typically by having two SSIDs on the same frequency – one for the public-access network and the other for your home network.

You may find that other people in the street can’t use the public-access network as expected because your router is located high up and away from street level. This can manifest with the remote device used by the person on the street acting as though it is in a fringe area and exhibiting patchy reception. It is something I have experienced in Docklands where it was a hit-and-miss affair to use the Telstra Air service offered by an apartment dweller living in one of the buildings that was facing a public walkway from my smartphone outside the building.

On the other hand, the only people who would benefit are others who are walking up and down the corridor outside your apartment.

The HomePlug powerline network

You may have to use the SYNC or SimpleConnect buttons on your home network devices like this WD LiveWire HomePlug AV switch to assure reliable secure connectivity in your apartment-based HomePlug setup

Here, this network may be a simpler affair where you just use the SimpleConnect buttons on the HomePlug adaptors to create a new network segment with its own encryption. This is a procedure that I bad described in this IT assistance article where I was instructing my former pastor over the phone about how to set up a HomePlug segment for his desktop computer when he moved to a new location. But it is imperative to perform this process when you are setting up a HomePlug segment for the first time so as to avoid your data “creeping on” to your neighbour’s HomePlug segment or vice versa.

If you are adding other HomePlug devices, you need to follow the routine for using SimpleConnect buttons to add these devices – press the button on the new device then on the existing device while watching for the lights to flicker in a certain way.

When it comes to connecting a cluster of co-located network-capable equipment together like a home-entertainment system, you can either purchase a HomePlug-Ethernet switch that has multiple Ethernet connections. On the other hand, you can simply get by with a desktop Ethernet switch connected to a HomePlug adaptor to bring all the equipment in that cluster online – most of these desktop Ethernet switches do cost very little to purchase for a five-port Gigabit type.

HomePlug AV2 like what is offered by this Devolo dLAN 1200+ adaptor may provide more stable operation when competing with large motors in the building (European setup)

Most apartment setups may be able to get by with the HomePlug AV500 powerline networks but you may find that HomePlug AV2 1200 MIMO-based technology may suit your needs better. This may be of relevance for those of you who may benefit from the extra bandwidth or who find that the highly-robust technology may cope with the high concentration of heavy-duty motors used in these buildings for things like air-conditioning or lifts better.

Other notes

If you are using a network-attached storage device or something similar, it may be preferable to connect it directly to the router rather than via a Wi-FI or HomePlug network because this assures a more reliable connection when it comes to making sure files arrive at the NAS complete.

Conclusion

An apartment can come across as a simple place to set up a home network within but there are some issues to work out so that you have a reliable secure home network that coexists with your neighbours’ home networks easily.

There needs to be a standard filetype to simplify the process of upgrading your home network router without reconfiguring your home network

An issue that will crop up through the life of a home network is to upgrade the router. This will be brought on with replacement of carrier-supplied equipment with retail equipment, replacing that half-dead router that you are always powering off and on many times a week, or upgrading to higher-performance equipment.

But you will end up having to transcribe out configuration data from your old equipment so you can enter it in to your new equipment especially if you want to avoid having to reconfigure other network equipment on your same home network.

Most routers offer a way for users to back up the current configuration details. This is typically to allow a user to do things like perform a factory resent or to test a configuration without losing a prior known-to-work state.

The process typically requires the user to download a configuration file to the computer they are configuring the router from in a similar manner to downloading a resource from the Web. But there isn’t a consistent file schema for storing this data in a manner for transferring to devices supplied by different vendors. In some cases, you may not be able to transfer the configuration data to newer equipment from the same vendor such as to install a newer router model.

AVM have taken steps in the right direction by allowing users to save a configuration from an older Fritz!Box router and upload it to a newer Fritz!Box router running a newer version of the Fritz!OS firmware. It is also to factor in allowing the router to persist your configuration to a newer version of the firmware.

But what can be done to make this work better would be to use a standard file format, preferably an XML-based schema which could be used for storing a router configuration. This would have to be agreed upon by all of the vendors to provide true vendor interoperability.

There would also be issues about providing multiple methods of storing this data. It could be about maintaining the traditional HTTP download / upload approach with Web clients on the same local network. Or it could also be about transferring the data between a USB Mass Storage device and the router such as to facilitate an out-of-box install.

Such a setup could allow for a range of scenarios like simplifying the upgrade path or to make it easier for support staff to keep information about different configurations they are responsible for.

The configuration data would have to cater for WAN (Internet) and LAN details including details regarding Wi-Fi wireless network segments, advanced network setups like VLAN and VPN setups, VoIP endpoint setups as well as general and security-related data.

Of course an issue that will crop up would be assuring the user of proper network security and sovereignty, something that could be assured through not persisting the management password to a new router. Also you won’t be able to keep Wi-Fi channel data especially if you deal with self-optimising equipment, because you may have to face an evolving Wi-Fi spectrum landscape.

What will need to happen is to provide methods to allow seamless upgrading of devices that serve as your network-Internet “edge” so you can simplify this upgrade process and get the most out of the new equipment.

Expect a lot more out of the router that comes with your Internet service when Technicolor gets its way

The device that represents the network-Internet “edge” for your home network i.e. the router won’t just be serving that function in a standalone way anymore. Here, it will work in tandem with other Internet-side and network-side computing devices to become a highly-sophisticated “hub” for your home network.

One of these drivers is to provide a simplified customer-support process, especially for those of us who use carrier-provided equipment at the edge. Here, the support and provisioning process can be fulfilled by the router supplying information to your carrier or ISP regarding your Internet service’s and home network’s performance.without wasting time requiring the customer to supply this information during a support call. This may be considered controversial but has value regarding the support and troubleshooting process which can perplex those of us who aren’t competent with technology such as a lot of older people.

It also encompasses the fact that distributed Wi-Fi will be the “new norm” for the home network, whether through multiple access points connected to a wired or dedicated-wireless backbone, the use of one or more wireless range extenders or a mesh-driven distributed wireless network. Here, it may be about simplifying the process of commissioning the “satellite” wireless devices and making sure that they are performing as expected to assure maximum Wi-Fi coverage across your premises.

The other factor is for a call to provide for always-maintained software in these devices thanks to issues being raised regarding the security of our home networks and the Internet. It was underscored through the recent distributed denial-of-service attacks against various Internet services and blogs using the Mirai bot network that was running compromised software on routers, network cameras and the like which hosted poorly-maintained software to facilitate these attacks.

Let’s not forget that the home-network gateway device will be expected to do more in conjunction with cloud services. Here, they want to provide this kind of service in the same context as the “app-store” commonly associated with mobile computing platforms but increasingly associated with regular computing platforms, and an increasing number of dedicated-purpose devices like printers. It is where a customer can add on extra functionality to their home-network router after they have bought and installed that device rather than buying and installing a new device to achieve this goal.

I was learning about this thanks to a news release offered to me by Diego Gastaldi from Technicolor Connected home regarding this topic. Technicolor came in on this game thanks to buying in to Thomson who supplies a lot of the customer-premises equipment provisioned by telcos and ISPs for their broadband Internet service, especially the triple-play services. This company had presented at Mobile World Congress some of their new concepts for the home-network gateway devices that will be pitched to the likes of Telstra or Bouygues Télécom for their services along with how they can add that extra value.

This is in conjunction with Technicolor announcing their solutions for managed distributed Wi-Fi setups along with devices supporting wireline broadband and mobile wireless broadband on the Internet (WAN) side. The latter trend existed mainly with small-business equipment but its appeal for the home network is being underscored with the “quick-to-provide” goal for an interim wireless service before a wireline service is rolled out, a “fatter pipe” for broadband service by aggregating wireline and mobile broadband services; and always-available broadband for business, e-health / ageing-at-home and the smart home’s security.

The typical applications that will be called out would be to provide business-style “unified threat management” for the home network as a network security measure. Or they could be about joining a “community wireless” platform like Fon where they can share Wi-Fi bandwidth with guests or customers.

But they are also highlighting applications like monitoring elderly loved ones at home to be sure they are OK. Earlier on in 2010, I had a conversation with a representative from Ekahau regarding their Wi-Fi-based Real Time Location System in a residential or small-business environment. This was more so with their T301BD Wi-Fi Pager Tag, pitched primarily as a name tag with duress-alert abilities for healthcare and similar enterprise-level applications, being used as part of an “ageing at home” or similar home-based care scenario. Then I had noticed initial doubt about this kind of application in the home but such setups could be made real with distributed Wi-Fi and them being offered on a cloud-driven “as-a-service” model.

By using a multiple-computer “cloud” approach, there isn’t a requirement to overload a router device with extra processing circuitry which would require a large device to be designed. Typically this would be fulfilled by the use of one or more data centers connected to the Internet like the Amazon Web Services approach Technicolor are using. But, as the compact network-attached-storage maintains its appeal as an on-premises network storage hub with most of these devices offering “remote access” or “personal cloud” functionality, this kind of “cloud” approach could encompass these devices along with other “function-specific” hubs like smart meters or security systems.

But what is happening is that there will be more expectations out of the router device that sits between the home network and the Internet with it being a “gateway” to more online services.

If you are running a recent NETGEAR router, make sure its firmware is up to date

Article

Netgear Patches Its Router’s Security Holes, Download Your Updated Firmware Today | Lifehacker

From the horse’s mouth

NETGEAR

Original Security Advisory

Models affected

My Comments

NETGEAR had faced a serious problem with some of its recent-model routers due to a security exploit in the firmware that drives these network-Internet “edge” devices. Previous coverage about this issue had required you to use another router for your home network to stay secure.

This has had NETGEAR rush out firmware updates for each of these affected routers in order to mitigate the recently-discovered security exploit.

A problem that besets most of the commonly-available home-network bardware is that firmware updating requires you to visit the manufacturer’s site, download the firmware as a special file package for your device, then upload that package to your device via its Web-based management interface. This can daunt some computer users who haven’t much experience with these kind of hardware maintenance tasks.

Personally, I would like to see steps taken to support automatic firmware upgrades such as what AVM are doing with their Fritz!Box devices, or at least the ability to click on a button in the management interface to start the download and update process for the device’s firmware. This is a practice that is being implemented in most of the European-made modem routers, along with most consumer-electronics devices like Smart TVs and set-top video peripherals.

There is also the issue of protecting the update files so that you aren’t installing malware on your device and it may involve processes like authenticity checks for software delivered as part of a firmware update or functionality add-on.

The update procedure

The update procedure will require you to download the updated firmware package using your regular desktop or laptop computer. Here, they recommend that you connect your regular computer directly to the router using an Ethernet cable if you can do so for the download and update process to be sure that this process works reliably.

Follow the link listed in this article to the NETGEAR-hosted support page for your router’s model. You will see the link for the firmware package you need to download. Here, you download that firmware package to your “downloads” folder.

Then, once you have downloaded the firmware from the NETGEAR site, you log in to your router’s management page from that same computer using your favourite Web browser. For these routers, the URL is http://www.routerlogin.net. Subsequently, you have to visit the ADVANCED tab, then the Administration option, then the Firmware Upgrade option.

In that screen, you click the Browse button, which will pop up a file-system dialog box where you have to find the firmware file that you downloaded in your “downloads” folder. Once you have selected the firmware file, click the Upload button to transfer the firmware to your router, whereupon it will commence the updating process. Leave the router alone during this process so as not to interrupt this critical process. You will see a progress bar to indicate how the upgrade is progressing.

Once this update procedure is done, a good practice would be to regularly visit NETGEAR’s support pages for your particular router and check for newer firmware on a regular basis. Then, if there is newer firmware available for your device, update it following the instructions on their Website or the general instructions listed in this article.

Conclusion

The increased awareness by industry and computer media regarding software quality and data security for dedicated-purpose devices connected to the Internet along with consumer / small-business network-infrastructure devices is going to make companies who design these devices or the software that runs them wake up regarding these issues.

Article

eero: A Mesh WiFi Router Built for Security (Product Review) | Krebs On Security

My Comments

A common issue raised in relation to home-network routers is that they aren’t really designed for security. It applies more to the equipment that is sold through the popular retail locations like the electronics chains.

This is due to issues like firmware that isn’t always kept up to date along with an insecure “out-of-box” management-console login experience. The latter situation manifests typically in the form of a default username and password that is common across a product range rather than unique to each device.

The eero router which is effectively a Wi-Fi mesh system has answered these issues courtesy of the following: firmware that is updated automatically and a secure-setup routine based around an enabling code sent to your phone. The former method has been practised by AVM with their latest firmware for the Fritz!Box routers with these devices automatically updating. The latter method has been practised through the use of a mobile-platform app where you enter your name, email address and mobile phone number. This requires you to receive a one-time password from your smartphone by SMS. You enter this to the mobile app before you determine your home network’s ESSID and passphrase.

This kind of login experience for the management Web page could be very similar to a well-bred two-factor authentication routine that comes in to play for some online services whenever you add another device or, in some cases, as you log in. Here, the FIDO U2F standard or support for Google Authenticator could be implemented in a router to permit secure login to the management page.

As for Wi-FI implementation, this router implements a proprietary mesh technology with each extender implementing separate radio transceivers for both the backhaul link and the client-side link. This allows for full bandwidth to be served to the Wi-Fi client devices. Each router device also has two Ethernet ports with one of those being configured for WAN (Internet) connection. Personally, I would like to see both ports switch to LAN mode on an eero router if it is serving as a repeater. This would earn its place with video peripherals, printers or desktop computers.

What I see of this is a step in the right direction for improved security for small networks and other manufacturers could learn from eero and AVM in working on a secure setup routine along with automatically-updated firmware.