Cisco Pushes Out New Cloud Firmware Without Customer Consent

[Zaune]

DSLReports.com, via Techdirt.

Reddit users have noticed that Cisco has started automatically pushing the company's new "Cloud Connect" firmware update to consumer routers -- without customer approval. Annoyed users note that the update won't let consumers directly log into their routers anymore -- they have to register for a new Cloud Connect account. The only way to revert to directly accessing the device you paid for? You have to unplug it from the Internet.

Click for full size
As an additional annoyance, the terms of service for the new Cloud Connect service give Cisco the right to track and sell your network traffic and Internet activity to third parties:

...we may keep track of certain information related to your use of the Service, including but not limited to the status and health of your network and networked products; which apps relating to the Service you are using; which features you are using within the Service infrastructure; network traffic (e.g., megabytes per hour); Internet history; how frequently you encounter errors on the Service system and other related information ("Other Information"). We use this Other Information to help us quickly and efficiently respond to inquiries and requests, and to enhance or administer our overall Service for our customers.

We may also use this Other Information for traffic analysis (for example, determining when the most customers are using the Service) and to determine which features within the Service are most or least effective or useful to you. In addition, we may periodically transmit system information to our servers in order to optimize your overall experience with the Service. We may share aggregated and anonymous user experience information with service providers, contractors or other third parties...
Some users who don't want the firmware update are being told that there's nothing Cisco can do, while others are being directed to manually roll back their firmware if they don't like the new service or TOS (meaning you won't get useful future upgrades). One gets the sense that the backlash to this rather presumptuous move is going to start really rolling once it gets a full head of media steam. It's just one more reason to install third party router firmware -- assuming your device can run it.

Guess who I won't be buying from any time soon.

[General Zod]

Isn't all this tracking illegal?

[Zaune]

Maybe. But can you afford to take them to court over it?

[General Zod]

Maybe. But can you afford to take them to court over it?

That's what class action lawsuits are for, but fortunately I don't use Cisco equipment.

[Enigma]

Does this affect every router they've made or just newer ones? I've got a Linksys router but its pretty old.

[Sephirius]

Flash your router to DD-WRT.

gg cisco

[TheHammer]

The smart money is that this will be rolled back soon with an apology from Cisco.

In fact, it seems they're already scrambling to do so...

http://www.eweek.com/c/a/Enterprise-Net ... ce-132323/

Cisco officials also are looking to better explain issues surrounding the automatic firmware updates and Connect Cloud options. On the company’s Website, officials laid out instructions for returning the router’s firmware to its original status and ensuring that users no longer get automatic upgrades. Users also can call Linksys customer support at 800-326-7114, and a customer service agent will walk them through the process of reverting the router back to its traditional set up.

Wingo also addressed it in his blog. “Cisco Connect Cloud was delivered only to consumers who opted in to automatic updates,” he said. “However, we apologize that the opt-out process for Cisco Connect Cloud and automatic updates was not more clear in this product release, and we are developing an updated version that will improve this process.”

Wingo said that Cisco takes the feedback it’s gotten seriously, but hoped that despite the problems, users will “give Cisco Connect Cloud a try, though. I think you’ll find it’s a great way to simplify how you connect, control and interact with your connected devices, including personal entertainment and home appliances.”

[Pendleton]

Wingo said that Cisco takes the feedback it’s gotten seriously, but hoped that despite the problems, users will “give Cisco Connect Cloud a try, though. I think you’ll find it’s a great way to simplify how you connect, control and interact with your connected devices, including personal entertainment and home appliances.”

No dice. It's hard enough making a secure computer these days without having my damn router betray me too. Sticking with my five year old Netgear for a while yet.

[General Zod]

Does this affect every router they've made or just newer ones? I've got a Linksys router but its pretty old.

Only newer models, apparently. http://www.extremetech.com/computing/13 ... discretion

All the same I'd be leery about buying anything owned by Cisco in the future.

[darthdavid]

Flash your router to DD-WRT.

gg cisco

Which, honestly, you should have done in the first place anyway since it's better all around.

[EnterpriseSovereign]

Glad I don't use comcast Cisco gear- how they ever thought that they'd get away with monitoring your internet usage and selling your info to the highest bidder is beyond me

[Skgoa]

They are also one of the biggest suppliers of network survailance and censorship hardware.
Anyways, more important than this instance of overreach is the fundamental problem that there even are these kinds of backdoors in Cisco's product at all. It's not even an error - Cisco routers arrive pre-hacked by design. And we have no way to ever know whether all of these backdoors have been found by the public. Though as they say, nobody has ever been fired for buying IBM. (or in case of networking equipment: Cisco)

[Questor]

OK, just to be clear to everyone. This was consumer equipment only, the stuff that used to say "linksys". Not traditional cisco pizza boxes.

That stuff's the same old hard to configure mess it always was.

[Skgoa]

Yeah but that stuff still comes with backdoors build into it at the factory.

[Questor]

Most of them are rather well documented though, and are required by law. I don't ever see Cisco pulling this kind of thing in the enterprise environment.