• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

FCC bans sale of some foreign-made routers in the US

MrGuvernment said:
Feel like the future, for those of us who can, will literally end up being a single VLAN for every single device on our networks :D. I am already at 14 VLANs on my network...(home lab testing stuff is 4 of those...)
Click to expand...
Just add a 'hospitality gateway'. :D These are designed for hotel use so they by default block all traffic between devices. They're pretty cheap used on ebay, but they will also limit traffic to a certain extent since they may be 100Mb, etc.
 
DanNeely said:
repurposed old desktops is a solution capable of addressing at most something like 0.01% of the switch/router market. The businesses that disposed of them as old won't take them back because someone stuffed a few extra parts inside.

On the consumer side, the overwhelming majority want something that's tiny, uses minimal power, and works with them in completely brain off mode.

That leaves the tiny sliver of the potential market who are willing to trade up in size/power consumption to a(nother) desktop pc, willing to accept using hardware old enough that it's getting to the bad part of the bathtub curve, as well as being willing and capable of administering a system designed by networking geeks for networking geeks. The problem there is that most of those people are also capable of stuffing a few NICs into an old box they already own, and doing the initial setup/config for the network admin tools as well.
Click to expand...
There's so many different 'roll your own' router solutions and companies like netgate and firewalla have even built businesses around it. I think if these were cheap enough in the consumer realm, they would fill a niche. Especially since a lot of the cheaper 'unwanted' desktops are of the lower power pentium/i3 variety and end up discounted severely just to prevent from becoming nothing but a holding cost.
 
My house was wired for Ethernet(!) and the builders put a TP-Link in the ceiling. I didn't trust it from day 1 but new house expenses, just wasn't a priority, so I set it on a vlan only for IoT. Replaced it with a cheapish $100 Ubiquiti AP. Works great, looks great.
Minus the gigantic hole from the enormous TP-Link :(
 
sphinx99 said:
https://www.cnet.com/home/internet/fcc-bans-foreign-made-routers-as-national-security-risk/

Is this real? Did April Fools hit early or something?
Click to expand...

“FCC Grants Netgear Conditional Approval For Routers​

BeauHD 11 hours ago		33
The FCC has granted (PDF) Netgear the first exemption from its foreign-made router ban, allowing the company to keep selling new consumer router models made outside the U.S. through Oct. 1, 2027. PCMag reports: The Defense Department reviewed Netgear's application for an exemption and found that its products "do not pose risks to US national security." The FCC's order doesn't elaborate on why. Netgear is based in San Jose, California, although its products are made in Asia. The exemption, known as a conditional approval, lasts until Oct. 1, 2027. It covers a large range of future Wi-Fi models from Netgear, spanning the R, RAX, RAXE, RS, MK, MR, M, and MH series, the Orbi consumer mesh, mobile, and standalone routers under the RBK, RBE, RBR, RBRE, LBR, LBK, and CBK series, as well as cable gateways and cable modems under the CAX and CM series.

The exemption isn't a full green light for the future product models from Netgear. The FCC says the company still needs to go through the normal Commission-regulated equipment authorization process for each device. The Oct. 1, 2027 date effectively amounts to a deadline for Netgear to receive FCC certification for the router models; each certification is also permanent, enabling the product to be sold in the US on an ongoing basis. This also suggests that Netgear has an 18-month period to receive FCC certifications for future products.”
 
Just saw the email come through before midnight.
Screenshot_20260415-063139.png
 
Man, what a tool. He totally doesn't understand the reason. It was due to the existing law enforcement backdoors already mandated on all devices for the past several decades being discovered and exploited by enemy nations, mainly China and Russia. When you send all your manufacturing specs to China and have them load your firmware too, this is what happens.

Only watched the first few minutes though because he's annoying and adding conjecture. So apologies if he covers that aspect.
 
w1retap said:
Man, what a tool. He totally doesn't understand the reason. It was due to the existing law enforcement backdoors already mandated on all devices for the past several decades being discovered and exploited by enemy nations, mainly China and Russia. When you send all your manufacturing specs to China and have them load your firmware too, this is what happens.

Only watched the first few minutes though because he's annoying and adding conjecture. So apologies if he covers that aspect.
Click to expand...
I have a number of problems with that. Firstly, China doesn't make all the routers. In fact, China doesn't make most routers. “Chinese-origin imports accounted for just 1.1% of the total US router import value in 2025, despite widespread assumptions to the contrary” Second, I'm not worried about China and Russia, but I am worried about this country who has bought our entire government and has used hacking tools against USA citizens.

I'd be OK with this decision if it meant forcing all router software to be open source. If we're worried about backdoors then it'll start in the software of said router.
01yrAOdBSz4y1K8hra7GyVM-2.fit_lim.size_1024x.png

 
Last edited:
Yes, China has been falsifying import/export records to get around origin of manufacture for over a decade now, also moved some manifacturing out of China because it is too expensive there for assemby with new generation employees not wanting to do it for low pay.

However it still is a giant threat they largely control a good portion of the market through the CCP whether it is inside their country or not. Look no further than the businesses themselves and the senior leadership / board member key stakes. You should be far more worried than you are if you saw the memos on the data they've been harvesting.. It didn't just impact consumer grade stuff for many years, but enterprise grade as well.

But yes, it is one of the reasons I don't use a COTS router.
 
w1retap said:
Yes, China has been falsifying import/export records to get around origin of manufacture for over a decade now, also moved some manifacturing out of China because it is too expensive there for assemby with new generation employees not wanting to do it for low pay.

However it still is a giant threat they largely control a good portion of the market through the CCP whether it is inside their country or not. Look no further than the businesses themselves and the senior leadership / board member key stakes. You should be far more worried than you are if you saw the memos on the data they've been harvesting.. It didn't just impact consumer grade stuff for many years, but enterprise grade as well.

But yes, it is one of the reasons I don't use a COTS router.
Click to expand...
Ok but it's stupid. Whenever I hear China and Russia as the boogie man, I'm reminded of Edward Snowden. I don't doubt that China and Russia have put backdoors in... everything, but what about USA? EU is avoiding Windows and other American services because they have similar concerns towards USA. Especially when USA's current administration wants to use laws meant to monitor foreigners are now going to be used on American citizens.

Going back to this being stupid, what about modems? What about cable DOCSIS modems? What about Switch's? What about WiFi access points? We should start banning those too. Going after specifically the router just seems like another method to spy on USA citizens. To make this even more dumber, the main IC chips components used to make them are from Broadcom, Qualcomm, Realtek, and Atheros. I think Rockchip and AllWinner are made in China, so it would be easier to just ban routers made with those. Which is fine because they tend to be the worst anyway.

It's fine anyway because modern routers suck and tend to want you to log into their cloud website. Been meaning to just build my own router. Been lazy by installing Open-WRT on cheap routers.
 
The EU does it as well.. I don't know why you're under the impression they don't. They're been actively implementing spy tools on their citizens and openly doing so.

Everyone is their own boogeyman, but we don't want adversaries having an advantage over us.
 
DukenukemX said:
If we're worried about backdoors then it'll start in the software of said router.
Click to expand...
Not entirely true. A network device could have a second microprocessor sniffing packets, injecting packets, or otherwise acting on the network stream with no software intervention.

Open fw might allow you to spot this, but won't prevent it.
 
Nobu said:
Not entirely true. A network device could have a second microprocessor sniffing packets, injecting packets, or otherwise acting on the network stream with no software intervention.

Open fw might allow you to spot this, but won't prevent it.
Click to expand...
This was how Cisco was exploited during the supply chain attacks not too long ago. It was a span port tapped into the backplane that was able to be remote accessed. It would of course persist even if you completely wiped the device and reflashed it. It was only found after internal inspections were performed.
 
Nobu said:
Not entirely true. A network device could have a second microprocessor sniffing packets, injecting packets, or otherwise acting on the network stream with no software intervention.

Open fw might allow you to spot this, but won't prevent it.
Click to expand...
Yea but that's too obvious. You act like nobody actually opens up routers and inspects them? The Open-WRT and DD-WRT take these apart and examine them for the purpose of installing open source firmware. There is no chip. There is firmware and maybe Chinese made chips like Allwinner and Rockchip. It's much easier to get away with firmware with backdoors than putting in an extra microprocessor that not only adds cost but probably slows down the router.

The only time something like this might have happened was in 2018 when Super Micro Computers found malicious microchips on server motherboards. I say maybe because it was a Bloomberg article that Supermicro, Apple, and Amazon had strongly denied. While it can be done, it isn't something that won't be noticed.

View: https://youtu.be/AAii7RxG1NY?si=MV2PsSkt4m5pIXH4

I've soldered smaller crap than this. Seriously, 0201 SMD components are smaller than a grain of sand.
ASA_Bottom_circle2.png
 
DukenukemX said:
Yea but that's too obvious. You act like nobody actually opens up routers and inspects them? The Open-WRT and DD-WRT take these apart and examine them for the purpose of installing open source firmware. There is no chip. There is firmware and maybe Chinese made chips like Allwinner and Rockchip. It's much easier to get away with firmware with backdoors than putting in an extra microprocessor that not only adds cost but probably slows down the router.

The only time something like this might have happened was in 2018 when Super Micro Computers found malicious microchips on server motherboards. I say maybe because it was a Bloomberg article that Supermicro, Apple, and Amazon had strongly denied. While it can be done, it isn't something that won't be noticed.

View: https://youtu.be/AAii7RxG1NY?si=MV2PsSkt4m5pIXH4

I've soldered smaller crap than this. Seriously, 0201 SMD components are smaller than a grain of sand.
View attachment 800916
Click to expand...

I've opened up several of my own routers/devices. If you don't know what to look for or aren't looking for it, that doesn't mean a thing. Maybe they put it under another device which has a bit of room under it, maybe it's an advanced job where the malicious device is built into the PCB itself and not a separate device.

Obviously, these are unlikely to be present on most consumer devices. Such a thing would be difficult to pull off with even minor scrutiny. But it is possible, and could be done on a smaller scale, or with just a few devices in the supply chain.
 
Nobu said:
I've opened up several of my own routers/devices. If you don't know what to look for or aren't looking for it, that doesn't mean a thing. Maybe they put it under another device which has a bit of room under it, maybe it's an advanced job where the malicious device is built into the PCB itself and not a separate device.

Obviously, these are unlikely to be present on most consumer devices. Such a thing would be difficult to pull off with even minor scrutiny. But it is possible, and could be done on a smaller scale, or with just a few devices in the supply chain.
Click to expand...
It's nearly impossible to get away with. Someone who knows what they're doing is going to open up the router and find a tiny component that doesn't belong. Like I said, most routers will end up on DD-WRT and Open-WRT hands to try and put their firmware on it. Even still, do you think packets sent to China will go unnoticed? ISP's will know, and someone who knows their network traffic will know.

This is why it's entirely done in firmware, and stays dormant until called upon. Which is why I'm fine for pushing for open source router firmware, in order to solve this problem. Home routers are fucking stupid anyway since most manufacturers stop updating them, and they usually have vulnerabilities. The reason I've been thinking of just building my own router is because I'm sick of the vulnerabilities. If I have to pay a high cost for a shit router and can't install OpenWRT, then I'll build my own. I'd rather be able to install and update my routers software instead of depending on the manufacturer. They do not have incentives to keep their products updated and secure. None of this solves the real issue which is that home routers are awfully insecure.

Speaking of vulnerabilities, this is most likely the problem for China routers like TPLink, which probably prompted this eventually FCC ban. This whole things sounds like the same excuse why USA went after TikTok. Senators mention Salt Typhoon which went after Cisco and not Chinese routers like TPLink. Then you have the Quad7 botnet which effected TPLink routers due to a vulnerability. You know, routers not getting updates and fixes. Wasn't a Chinese backdoor, but a Chinese vulnerability. Either way, there's no evidence of China spying on US citizens through routers. US government has made claims, but provided no evidence. You can make the argument that vulnerabilities made by China is meant to be exploited, but so far TPLink has about the same amount of vulnerabilities as any other router manufacturer.

This seems more like USA wanting to inject their own backdoor, which good luck with that, or USA is upset that TPLink had a 36.5% market share in the US. Which is odd considering that most people use whatever router their ISP gives them, which is probably not even considered in that estimate. The only people buying routers are either nerds like us, or people who want to avoid paying the $10 per month fee to their ISP. I'd believe the US government if they forced router manufacturers to update their products firmware for security for up to several years, no matter what. That to me would solve the real issue with home routers.
 
You're still off base with your assessment.. the US has had the CALEA backdoor for several decades built into our equipment. It isn't about "wanting to inject their own backdoor". It is because China & Russia discovered and utilized this, build their botnets to utilize it, and also built their own backdoors based on it, as per InfraGard reports. There are also dozens if not hundreds of other reports from CISA, CVE notices, CSDC documents, etc which show all of the exploits. It has become a continous whack-a-mole game of discovering and patching. Just in a past few years we've started to outright ban different brands and put them on the NDAA blacklist, and this is the next step.

But no, you won't notice your packets going anywhere unless you're using a IDS outside of your firewall, and your ISP won't care about what leaks from your internal network either. The only way an ISP *might* care is if your IP address is sent to them by the feds as known to be part of a botnet.

You are correct about most people not caring and just using their ISP provided equipment.. which is exactly why the problem needs to be fixed. If the general public cared as much about cyber security as the 'nerds', we'd have much less of an issue.
 
Last edited:
w1retap said:
You're still off base with your assessment.. the US has had the CALEA backdoor for several decades built into our equipment. It isn't about "wanting to inject their own backdoor". It is because China & Russia discovered and utilized this, build their botnets to utilize it, and also built their own backdoors based on it, as per InfraGard reports.
Click to expand...
This is why a backdoor is never a good idea because someone else will find it and use it. It's like an exploit that is put there intentionally, which is asking hackers to play find and seek.
But no, you won't notice your packets going anywhere unless you're using a IDS outside of your firewall, and your ISP won't care about what leaks from your internal network either. The only way an ISP *might* care is if your IP address is sent to them by the feds as known to be part of a botnet.
Click to expand...
My ISP cared because they called me about suspicious activity. This was when I ran Windows years ago.
You are correct about most people not caring and just using their ISP provided equipment.. which is exactly why the problem needs to be fixed. If the general public cared as much about cyber security as the 'nerds', we'd have much less of an issue.
Click to expand...
Yea but, wouldn't ISP's detect if their routers had some strange activity?
 
DukenukemX said:
Level1Techs Wendell did some testing and Netgear is worse. I didn't know this but TP-Link is based on OpenWRT, but not entirely. He pointed out that these routers are terribly insecure and he used a LLM AI to figure it out.

View: https://youtu.be/IfOgnDTRmnA?si=TDel16TK4SIrXm49
Click to expand...

Yeah, you can take the firmware binary and just set an AI off on a fuzzing adventure. It'll find a ton of shit. Sadly, just about anything with firmware is vulnerable to this.

Even worse, in practice (I work in the field) 99% of clients have hundreds of device with default creds / factory passwords - and they're often on flat networks.

It's a time bomb - and it is not just consumer routers.
 
You must log in or register to reply here.
Back
Top