Consumer Routers Still Suck

The talk walks through several years of offensive research on consumer routers and networking gear, from mainstream Netgear and TP-Link models to ISP-supplied modems and newer app-managed devices. The presenters describe their approach to each device: find debug ports, get a shell, pull the firmware, then hunt for bugs. Many of the flaws were old bug classes such as command injection, buffer overflows, format strings, and missing CSRF checks, and some devices exposed services over IPv6 that the vendors had not accounted for.

A recurring theme is the supply chain. Shared firmware from one original manufacturer, such as code reused across ISPs and brands, meant a single flaw could affect many vendors across several countries. A path traversal in Buffalo routers traced back to code that dated to the mid-2000s. Other examples included a VPN feature in an app-managed router that exposed other customers' networks, a cloud management API with an object reference flaw that returned after being fixed, and a vendor SDK bug inherited from a chipset maker. The talk also covers botnets and threat groups using compromised home routers as proxies, and a mass bricking event.

The closing argument is that these devices keep failing because of unclear ownership and tangled supply chains, which make disclosure hard. The presenters point to software bills of materials and regulation as partial fixes, and suggest that consumer routers are a low-cost place to learn offensive techniques using common reverse engineering and web testing tools.