Re: 32 bit fix? (Was Re: Meltdown – Spectre)

[Dave B]

Hi.

Many of those appliances are marketed as being able to make your files
available to you, even when you're not at home.  (Music, photos etc.) 
They come with crude mobile app's (among other things, to monetize the
user) and the security/authentication varies from so so, to nil.  
(Guess what most users opt for, because "it's difficult" to do it
securely.)   Remember, we're talking about Joe Public, not a sysadmin!

That, and they either punch holes in the router using UPnP, or people (I
know one) place them in a DMZ, again, because it's easy, and "it just
works."   What else is then exposed, who knows?

The rest as they say, one day will be history.   Using Shodan, it is not
difficult to find admin login pages on the public internet, for all
sorts of bits of equipment and other gadgetry.

Take care.

Dave B


On 10/01/18 12:37, Daniel Feenberg wrote:
>
>
> On Wed, 10 Jan 2018, Dave B via freebsd-questions wrote:
>
>> Hi Ed.
>>
>> Understood.   There's "a lot" of FreeBSD based kit out there, running on
>> 32 bit hardware.  A lot of NAS's for one.   (I don’t suppose any of
>> those commercial "appliances" will ever be updated though.)
>>
>
> Are NAS's a worry? Wouldn't the typical NAS login have root already?
> Why would anyone other than the system admin have a login on the NAS
> box at all? If the NAS isn't used as a web browser or MUA, how would
> the malware get to be run by an unprivileged user?
>
> I understand that the vulnerability can be demonstrated in Javascript,
> but this would be an attack on the client running with the privileges
> of the web browser. That isn't something that would happen on the
> typical system services appliance such as a NAS box, switch, or router.
>
> daniel feenberg
> NBER