
A new YouGov survey of 16,474 people from across 14 European countries, including the United Kingdom, has very unsurprisingly found that only 10% of respondents expressed mistrust towards European router manufacturers. The figure rises to 38% for manufacturers from the USA, 52% for China and 67% for Russia. But many don’t know where their broadband router is built.
Looking specifically at British respondents and the results aren’t all that different from the overall figures. At 70%, British consumers were shown to feel the greatest mistrust towards Russian manufacturers, followed by China (59%), the USA (36%) and finally European manufacturers only attracted a mistrust score of 11% (slightly above the average from all countries).
However, modern routers are built with components from all across the world – particularly China, which raises a question mark over the real origin of the hardware and software you’re buying. The survey, which was commissioned by FRITZ! (clearly a vested interest), noted that respondents across the entire panel were often unaware of whence the routers originate.
Advertisement
For example, only 14% of respondents knew that devices from TP-Link originate from China and 16% mistakenly thought that the company is European, while 51% were not sure. Similarly, 49% of respondents were also unsure about the company Netgear. Only brands such as Starlink and Huawei could be associated with the correct countries of origin much more frequently: Starlink – USA (55%), Huawei – China (77%). Europe’s largest manufacturer, FRITZ!, was correctly identified by only 26% of respondents in the UK.
“It is also interesting to note the perceived origin of router manufacturers for devices rented from a [broadband ISP]. In all of the participating European countries, the majority of respondents assume that rental devices from major providers are routers produced in Europe, even if they aren’t,” said the study.
All of this has relevance, and not only for security, because users were found to attach great importance to whether a device is developed and manufactured in Europe. More than half (55%) of those surveyed stated that this is important or very important to them. The figures are largely consistent across the individual countries.
Advertisement
What Russian routers?
Virtually 100% of consumer routers are made overseas, mainly China but increasing numbers are from Southeast Asian nations like Vietnam and Thailand. My Virgin Media hub 5, supplied by Sagemcom, was made in China. I believe the VM hub 5x is also supplied by Sagemcom and made in China. My previous VM hub 3, supplied by Arris, was made in China. And speaking of Arris: my VM STB, previously a V6 and migrated to a TV 360, was supplied by Arris – and also made in China.
None of them are trustworthy unless we can install our own software on them. European ones are likely to be the most buggy and slow.
If you don’t trust any of them, then build your own. I did think about that, I may still do at some point.
How do you know that European ones are buggy and slow?
I have a TPlink one, which is Chinese.
The only ones I know that are Europena are Sagemcom and Technicolor, there no doubt are others.
Linksys used to have a HQ in the U.K, don’t know if they still do
Unless you are an expert and are capable of personally validating all of the software you run on it, this isn’t necessarily true.
Open source is not a panacea. Heartbleed is one such example of how it didn’t matter if the code was out in the open, as it needed the right set of eyes to look at it and find the problem.
The average ISP and the reputable name-brand 3rd parties are probably putting more effort into infosec than you can. Especially now that it is a legal requirement imposed upon them. I’m acutely aware of one major ISP that has for years maintained all control over code signing for what goes into their boxes, rather than whoever the manufacturer happens to be.
@Ivor, all I am saying is if they don’t trust any of the pre-built stuff on offer than build your own. I never said that Open source is a panacea. You have more control with building your own, the software you use and hardware.
I agree that ISPs have to be more effort into security now, the same with other online devices.
All software has bugs and commercial routers are fundamentally built from open source software anyway. I pulled up the attributions for my Zen supplied eero and find 288 declared open source libraries including the kernel itself. I can for example see they use mbedtls 2.8.0 (a library similar to openssl but for embedded systems) which has outstanding critical and high CVEs. Openwrt, a completely open operating system, is already on mbedtls 3.6.6 with no outstanding CVEs. eero may well have assessed the CVEs and determined that they pose no risk for how they are using the library and for those of the other 287 libraries. Then again, they may not – there is no transparency and no way for anyone else to validate it short of trying to design an exploit. IMO, completely open operating systems are fundamentally more trustworthy then closed ones.
Then there is the other aspect of trust. Is the router doing only what it is supposed to be doing with nothing malicious running in the background? In the past I would’ve trusted European and US routers far more than Chinese routers in this respect. But in the mass surveillance age, not really anymore. For sure in this respect we need to move to open systems.
I didn’t say that closed source is more secure. I said that this equipment is more likely to have the right people looking at it to fix or mitigate issues, as compared to someone whose technical skill is often barely capable downloading an openwrt or pfsense image, installing it onto a box that could have been subject to a supply chain attack, and then assuming they have total security.
There is also an operational angle. OK, maybe Openwrt have updated the package you’ve cherry picked for your argument, but who’s to say that all of their users have updated their own devices? Reputable manufacturers and ISPs have legal obligations to analyse, fix/mitigate and force a rollout of new firmware should that be necessary.
Eero is perhaps the “worst” example you could have picked, because Amazon’s security capability is a lot better than most.
My “router” is Chinese Topton or something running pfsense.
Whatever people use just don’t use whatever junk your ISP supplied you with.
Almost all issues people have with their Internet connections are down to their cheap routers.
My router was cheap, well cheapish and have been fine for the most part in the last 3 years or so. Now and again it needs a reboot, but then that should be done to all routers now and again.
I know a fair few people that use ISP supplied routers, some are not great, the original one zzoomm supplied for a start, the one they supplied now is much better. I have seen routers from ISPs work for years, certainly the BT and Plusnet ones. While i am not a fan of the BT routers, I think they are bloated, they do seem to keep going. Maybe that is because of the updates.
My brother had a Shell router for years and when Talk Talk took over their customers, my brother still kept the router. Not a problem with it. The U.I was not great, but it is not something that most people will use much. I only went in there to change the SSID and password.
A lot of people are not going to spend £500 or so on a Topton or any other computer just for a router, I am glad it is working for you. It is a way i was thinking of going and still is, but still not sure if I would spend that amount of money on one. For me it would just be something muck around with.
The TPlink router I have now is to be honest, fine and does what I need.
What causes you to say the BT ones are bloated? What features and code are deployed that you consider unnecessary? How big should an optimised code base be?