But is it exploitable? Exploring how router vendors manage and patch security vulnerabilities in consumer-grade routers

Conference item

Millions of consumer-grade routers are vulnerable to security attacks. Router network attacks are dangerous and infections, presenting a serious security threat. They account for 80% of infected devices in the market, posing a greater threat than infected IoT devices and desktop computers. Routers offer an attractive target of attacks due to their gateway function to home networks, internet accessibility, and higher likelihood of having vulnerabilities. A major problem with these routers is their unpatched and unaddressed security vulnerabilities. Reports show that 30% of critical router vulnerabilities discovered in 2021 have not received any response from vendors. Why?
To better understand how router vendors manage and patch vulnerabilities in consumer-grade routers, and the accompanying challenges, we conducted 30 semi-structured interviews with professionals in router vendor companies selling broadband and retail routers in the UK. We found that router professionals prioritize vulnerability patching based on customer impact rather than vulnerability severity score. However, they experienced obstacles in patching vulnerabilities due to outsourcing development to third parties and the inability to support outdated models. To address these challenges, they developed workarounds such as offering replacement routers and releasing security advisories. However, they received pushback from customers who were not technically capable or concerned about security. Based on our results, we concluded with recommendations to improve security practice in routers.

Authors: Chalhoub, G; Martin, A

• Publication status: Published
• Peer review status: Peer reviewed
• Publisher: Association for Computing Machinery
• Host title: EuroUSEC '23: Proceedings of the 2023 European Symposium on Usable Security
• Pages: 277-295
• Publication date: 2023-10-16
• Acceptance date: 2023-07-17
• Event title: 2023 European Symposium on Usable Security (EuroUSEC 2023)
• Event location: Copenhagen, Denmark
• Event website: https://eurousec23.itu.dk/#
• Event start date: 2023-10-16
• Event end date: 2023-10-17
• DOI: 10.1145/3617072.3617110
• ISBN: 9798400708145
• Language: English