US bans new foreign-made consumer internet routers

[Fishrrman]

https://www.bbc.com/news/articles/c74787w149zo

US bans new foreign-made consumer internet routers
3.24.26
Kali Hays - Technology reporter

The US has banned new foreign-made consumer internet routers over national security concerns.

In an update on Monday to a list of equipment seen as not secure enough for use, the Federal Communications Commission (FCC) added all consumer-grade routers made outside the US.

It puts routers - which are used widely in homes and businesses to connect computers, phones, TVs and other devices to the internet - on a par with foreign-made drones, which were banned at the end of last year.

"Malicious actors have exploited security gaps in foreign-made routers to attack American households, disrupt networks, enable espionage, and facilitate intellectual property theft," the FCC said.

While people will still be able to use foreign-made routers they already own, the ban applies to all "new device models."

The ban stems from growing concern over the last year that routers were a point of easy-access for malicious actors.

TP-Link, a router brand made in China that is a best-seller on Amazon, became the subject of some US political anxiety last year after a spate of cyberattacks.

Any new router made outside the US will now need to be approved by the FCC before it can be imported, marketed, or sold in the country.
[...]
The vast majority of Internet routers are assembled or manufactured outside of the US, often in Taiwan or China.

The FCC ban applies even if a router is designed in the US, but built abroad.

Popular brands of router in the US include Netgear, a US company, which manufactures all of its products abroad.

One exception to the general absence of US-made routers is the newer Starlink WiFi router. Starlink is part of Elon Musk's company SpaceX.

The company says the Starlink routers are made in Texas.

More at URL above...

Poster's comment:
I read elsewhere that the ban extends to ethernet switches, as well.
Wondering if the cost of existing stock routers is going to zoom upwards in the interim...?

[MeganC]

Smart move. 

[DefiantMassRINO]

The problem is that, since 2000, the Chi-coms have embedded their chips, with possible backdoors,  in US, NATO, European Union, etc., telecommunications infrastructure used by civilians, Government, and Military.

The Globalist free traders played right into the Commies' hands.  The Chinese Communist Party used greed and corruption to have the US compromise itself from the inside ... as commies do.

If Taiwan falls, it will be from within, and not a Chi-com invasion.  A new Taiwan regime with invite the Chi-coms in for 'security' and 'humanitarian aid'.  That will the the Chi-coms' in.

History has many examples of nation-states inviting in their eventual conquerers.

[MeganC]

The problem is that, since 2000, the Chi-coms have embedded their chips, with possible backdoors,

The other aspect to this problem is that the NSA wants sole control over those back doors. 

[Weird Tolkienish Figure]

Dont' get me wrong, there are legitimate reasons to ban foreign made routers sometimes... but this will make the price of routers go up.

[DefiantMassRINO]

... or help diversify technology supply chains away from China to other nations, preferrably in other regions to mitigate geo-political and natural disaster risks.

Dont' get me wrong, there are legitimate reasons to ban foreign made routers sometimes... but this will make the price of routers go up.

[Weird Tolkienish Figure]

... or help diversify technology supply chains away from China to other nations, preferrably in other regions to mitigate geo-political and natural disaster risks.

Doesnt' specify China though.

[roamer_1]

Dont' get me wrong, there are legitimate reasons to ban foreign made routers sometimes... but this will make the price of routers go up.

Boy, and how! Another of those 'cart before the horse' moves that Tumpy and friends are so fond of.

It would be kind to create an alternative before these imperial bans,since literally ALL popular routers and switches are made in China or Taiwan. And if you include Chinese chips included in assembly, you can pretty comfortably include ALL routers and switches.

This is INSANE,

[roamer_1]

... or help diversify technology supply chains away from China to other nations, preferrably in other regions to mitigate geo-political and natural disaster risks.

Abracadabra! How long do you think that will take?

[roamer_1]

The other aspect to this problem is that the NSA wants sole control over those back doors. 

Before ratcheting on the tinfoil too tightly, it is reasonable to inform the folks that these back doors have not been reliably proven... Super secret maybe might be...

[DefiantMassRINO]

An OpenSSL vulnerability that was slipped in with code deployed Dec. 31, 2000, fron Frankfurt (where the US has a cyber installation) was exploited by the NSA and rumored to have been planted by the NSA.

The vulnerabilities are in the software and the firmware used to encrypt data and route traffic.

The Ruskies stole Windows source code from Microsoft in 1999.  I'm sure they had fun with it in the 2000's.

Exploits hardcoded in hardware don't adapt as frequently as needed to overcome mitigation measures.

Common software libraries which execute with elevated privileges in shared memory is where the Black Hats' get their biggest returns on investment.

The Solarwinds exploit was caused by the vendor's negligence in securing, testing, and authenticating its source code.  They presumed their Internet accessible source code repository was safe.  The greatest threat to IT security is the presumption that something is secure and can be trusted without thought.

Security needs to be multi-layered so there are reduntant layers to mitigate the vulnerability or failure of another layer.

Security is expen$ive in dollars and time, that's why it's so prolific for organizations to let security lapse - to save time and money.

[roamer_1]

An OpenSSL vulnerability that was slipped in with code deployed Dec. 31, 2000, fron Frankfurt (where the US has a cyber installation) was exploited by the NSA and rumored to have been planted by the NSA.

The vulnerabilities are in the software and the firmware used to encrypt data and route traffic.
[...]

That sounds all spooky n shit, but here's the truth of it:

ALL hardware/software contain vulnerabilities. ALL.

It's almost impossible to 'hard code' hardware. The field changes and morphs so fast that your hardwired code is rendered useless in months. and if discovered, it is extraordinarily easy to send data to nul.

And unlike governments, the machinery in business and residential does not last that long. Even long lasting net appliances are forced out in well under a decade, simply by the march of tech. So the percentage in hard wiring is low.

And lastly, virtually all embedded code can be read and back-engineered with an EEPROM - In fact, someone with better skilz than me could reprogram and rewrite it. An ubergeek friend of mine just altered the coding in a single chip he had to rewrite because the chip he needed to fix a board on an old CNC machine was no longer available (a machine from the late 90s/ early 00s) - He bought a new chip, and then hacked it to make it do what the old chip did.

So yeah. ALL machines have vulnerabilities. And almost all of those vulnerabilities can be corrected. And those which can't are swiftly deprecated anyway.

This is a giant boogeyman.

[MeganC]

Before ratcheting on the tinfoil too tightly, it is reasonable to inform the folks that these back doors have not been reliably proven... Super secret maybe might be...

Edward Snowden already went down this path.

https://www.reuters.com/world/us/spy-agency-ducks-questions-about-back-doors-tech-products-2020-10-28/

(EXCERPT)

SAN FRANCISCO, Oct 28 (Reuters) - The U.S. National Security Agency is rebuffing efforts by a leading Congressional critic to determine whether it is continuing to place so-called back doors into commercial technology products, in a controversial practice that critics say damages both U.S. industry and national security.

The NSA has long sought agreements with technology companies under which they would build special access for the spy agency into their products, according to disclosures by former NSA contractor Edward Snowden and reporting by Reuters and others.

These so-called back doors enable the NSA and other agencies to scan large amounts of traffic without a warrant. Agency advocates say the practice has eased collection of vital intelligence in other countries, including interception of terrorist communications.

[Kamaji]

[DefiantMassRINO]

AI Overview

     Reports indicate the NSA exploited the "Heartbleed" vulnerability in OpenSSL for roughly two years, beginning around 2012, to stealthily steal passwords, encryption keys, and other sensitive user data before it was publicly disclosed. This effort was part of a wider NSA initiative, often identified as the Bullrun program, designed to undermine encryption standards.

    Heartbleed Exploitation: The NSA allegedly discovered the Heartbleed bug (a vulnerability allowing memory dumps of servers) shortly after its introduction into OpenSSL, using it as part of their intelligence gathering arsenal.

    Widespread Impact: The flaw affected a massive portion of the internet (Secure Sockets Layer and Transport Layer Security protocols).

    Other Potential Efforts: Beyond Heartbleed, the NSA was implicated in manipulating cryptographic standards, such as promoting a random-number generator with a potential backdoor in security standards.

    Official Response: Despite reports from Bloomberg and others citing anonymous sources, the NSA and the White House denied using the Heartbleed bug for surveillance at the time.

The incident highlighted a critical debate regarding the NSA's role: identifying vulnerabilities to protect systems versus exploiting them for intelligence.

####

There's a talk that was given in Belgium / Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he'd do it if he had to create holes in software:


http://www.youtube.com/watch?v=fwcl17Q0bpk

He's talking specifically about OpenSSL quite a lot (basically saying it's too complex to ever be secure and probably received many "security patches" from NSA employees).

The entire talk is an eye opener. He explains how NSA shills are reading reddit / HN and poisoning communities / standards / protocols / etc. How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things.

He talks about shills submitting a few correct patches over the months / years, slowly gaining reputation among the community and then misusing that trust to submit (not so) subtle patches introducing security holes on purpose.

He mentions a few of the "common mantra" repeated often (including here) by people who have an interest in the status quo.

He explains why SSL/TLS is broken and says that the "SEC" part of "DNSSEC" is not going to be that secure ; )

I think that the problem is much worse than most people think and that Poul-Henning Kamp is closer to the truth than the ones constantly repeating "bug happens" as if nothing malicious was ever going on.

###

AI Overview
+4
OpenSSL Alternatives | Top Alternatives of OpenSSL

Top OpenSSL alternatives include LibreSSL (for security/cleaner code), BoringSSL (for modern TLS/QUIC), libsodium (for ease of use), and mbedTLS (for embedded systems). These libraries offer SSL/TLS protocol support, enhanced security features, and smaller footprints for specialized cryptographic needs.
Top OpenSSL Alternatives

LibreSSL: A fork of OpenSSL by the OpenBSD project designed to provide a more secure, streamlined library with legacy code removed.

BoringSSL: Google's fork of OpenSSL, focused on supporting modern web standards (TLS 1.3, QUIC) and used in Chrome and Android.

libsodium: A modern, portable, easy-to-use crypto library (a fork of NaCl) aimed at providing high-level cryptography without the complexity of OpenSSL.

mbedTLS: An open-source, portable, and easy-to-use TLS library specifically optimized for embedded devices and small-footprint applications.

WolfSSL: A lightweight, embedded SSL/TLS library designed for speed, size, and portability, often used in IoT.

GnuTLS: A secure library implementing SSL, TLS, and DTLS protocols, widely used in GNU projects.

AWS-LC: A general-purpose cryptographic library maintained by AWS, forked from BoringSSL/OpenSSL, designed for performance and FIPS compliance.

Key Comparison Areas

Security & Clean Code: LibreSSL is often favored for replacing legacy OpenSSL code.

Ease of Use: Libsodium is widely considered easier to use for developers.

Embedded/IoT: WolfSSL and mbedTLS are preferred for constrained environments.

Modernization: BoringSSL and AWS-LC are actively maintained for current web protocols.

###