Recently, my neighborhood was blessed with fiber-optic broadband by Turkey’s brand-new ISP Tellcom.
Providing download speeds up to 100 Mbps (which is what I signed up for), Tellcom’s QuikNet is a huge improvement over TTNet’s lousy ADSL service, which is what most people in Turkey currently use.
Obviously, I was one of the earliest switchers, and after being a customer of probably one of the worst ISPs in the world for years simply because I had no other choice, I was almost glad to pay the $150 termination fee, and now I finally have a real broadband connection.
But there’s one drawback.

The QuikNet subscription package includes a Pirelli DRG A226G broadband router. Yes, it’s the same company who produces the Pirelli tires and publishes the famous Pirelli Calendar. Before opening the subscription pack, I had no idea Pirelli produced anything other than car tires, but apparently they have a whole business in broadband routers and cabling. They even make mobile phones!
It didn’t take me long to decide that the DRG A226 is the worst router I’ve ever used. Period.
The DNS server crashed constantly, requiring me to restart the router. The Wi-Fi connection almost never worked on the first try, and DHCP was, well, unpredictable at best. Oh, and the UPnP forwarded ports were never closed, not even after a restart.
I naively thought that maybe my router came with an old firmware, and a new version was available that fixed all this. The Pirelli Broadband website has absolutely no information about firmware updates. In fact, all the information available on the website about the router is limited to the 98×161px JPEG image you see above, and a PDF User’s Manual.
Then I found a “Firmware Upgrade” section in the router’s web interface, but it wasn’t very helpful, as you can see:

But on closer inspection, the interface revealed an URL which didn’t come up on any of my previous Google searches: update.pirelli-discus.com. It looked like an automatic update server, but apparently it wasn’t working.
I thought “hmm, maybe I can find firmware upgrades if I go to www.pirelli-discus.com.”
I was wrong. The domain had expired, and Pirelli didn’t even bother to renew it. I was not only frustrated, but also shocked. How can you forget to renew a domain which is responsible for distributing firmware upgrades to thousands of routers worldwide? Can you imagine Microsoft forgetting to renew the Windows Update domains? Or Kaspersky forgetting to renew the Kaspersky Anti-Virus Database update domains? The results could be disastrous.
These domains are responsible for distributing software updates, which are usually automatically installed onto users’ computers and executed, and unless the updates are digitally signed, anybody who acquires control of these domains can distribute executable code onto millions of computers without breaking a sweat.
Now I know Apple uses digital signatures for its software updates, and I can only hope that companies like Microsoft, Kaspersky and Symantec do the same. As for Pirelli, I highly doubt that they employ any form of cryptographic security.
I now own the pirelli-discus.com domain, and I wonder if I can distribute firmware upgrades using this domain. I never mean to use the actual paths of course, so Pirelli users need not worry, at least for now. But if it works, and if someday I do what Pirelli did and forget to renew this domain, then anybody can purchase it, and Pirelli users will be in trouble.