Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

ctrl.blog

Post reply on HN
Print view View original

171–180 of 245 posts

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#171

Post by phikai »

mikerg87 wrote: post #109

Honest question. How would you begin discovering this kind of leakage? Do you need some sorry of tap that records protocols and Mac addresses? Do these firmware emplacements have this as a built in feature. With so many IOT devices being plugged in seems like this would be handy

I noticed it based on Pi-Hole [0] and seeing the excessive DNS Requests to those URLs... started googling and found this post which I thought summed it all up nicely. Looking at the author's post, it also appears they noticed it due to Pi-Hole as well.

EDIT: It was a different post that someone had seen this via Pi-Hole. Not sure how the original author discovered it.

[0] https://pi-hole.net/

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#172

Post by Drisc0 »

mort96 wrote: post #91
ksec wrote: post #69

Earlier quoted context omitted.

Apple Airport is probably the best router I have ever owned. Not the fastest, but extremely Stable, based on NetBSD and from a company that makes money on my hardware rather then my Data. I really hope they will have an 802.11ax version once they iron out all the crap that is going on in there.

My biggest issue with Apple routers is that you _need_ an Apple device to do anything with them. I have an AirPort Extreme, and while I'm not opposed to having Apple devices, I also don't exclusively buy from them, but rather what I deem to be the best product for my purposes at the time of purchase. That currently means an iPhone, an iPad, and a Dell laptop running Linux, but has in the past included both Apple lapt…

I've had good luck running the windows airport utility in wine if that's all that's holding you back.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#173

Post by zaarn »

kees99 wrote: post #130

firmware sends six DNS requests and one NTP query every 5 seconds (...snip...) TP-Link has hardcoded the following non-configurable NTP servers and server pools in their firmware: (...snip...) au.pool.ntp.org, nz.pool.ntp.org Wait... so TP-Link is effectively DDoSing NTP pool? Also, as pointed out in another thread here, vendor using country prefix instead of applying for their own prefix is a violation of: http://ww…

A NTP request every couple seconds is similarly in violation of the vendor guidelines, once every 10 minutes or less often is stated.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#174

Post by cleeus »

mort96 wrote: post #150
cleeus wrote: post #74

Earlier quoted context omitted.

I consider that a feature ;) TP-Link plastic routers have nice cheap hardware and they make it really easy for you to flash it with LEDE/OpenWRT.

Well, it's not a feature. You can both provide official firmware over HTTPS (or provide checksums for them, or both), and let people flash custom firmware, at the same time.

Your are right, of course.

Maybe what I wanted to express was more like this: TP-Link has a sloppy attitude towards the security of their stock firmware. It might work, but it is full of security holes. HTTPS and checksums/signatures wouldn't change that.

Maybe they could do everything right with their firmware and provide top notch security and updates. But then their firmware would be a factor for market differentiation and at that point they would be incentivized to put effective code signing schemes in place. Other market players do that. Look at AVM Fritz Box products - nice hardware, security updates for many years and the result is: they are known GPL offenders and have strong code signing in place.

Instead TP-Link delivers you crap firmware on nice and cheap hardware and they don't care what you run on it.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#175

Post by JustSomeNobody »

cannam wrote: post #141
JustSomeNobody wrote: post #140

Earlier quoted context omitted.

Powerline Ethernet is not really a good solution either. If you don't use your phone jacks, take the cover off one and check if it's actually using Cat5 or greater. You can then use those for network if you replace the connectors.

> Powerline Ethernet is not really a good solution either. Why is that?

It's very finicky about line quality, it likes to be on the same circuit (doesn't cross breakers), and it doesn't live up to the claimed speeds.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#176

Post by rrauenza »

0xcde4c3db wrote: post #159
cheald wrote: post #147

Earlier quoted context omitted.

LEDE is basically an OpenWRT fork which is being actively developed. The biggest draw is that it's actively developed, and managed in a Linux-style package manager setup, rather than monolithic baked firmwares that you have to flash wholesale. Patching against things like KRACK was as simple as just invoking the package manager. DD-WRT and Tomato are both old tried-and-true alternatives to vendor firmwares, and they…

Just to be clear, OpenWRT isn't 100% abandoned, but it's basically just a handful of sporadic package version bumps and backported bug fixes, which might not ever make it into an official numbered release. If the counts on GitHub are accurate/comparable, LEDE has almost 2000 more commits than OpenWRT. The OpenWRT website also seems to be semi-abandoned (the front page has had a spam post on it for over a month; it lo…

I naively bought the Linksys WRT 1900AC about when it released because it claimed dd-wrt support at release.

Then the dd-wrt folks mentioned that Linksys never actually gave them hardware ... and if I recall, hadn't really been included in the plans to support it at all.

So then I waited and found whenever I looked for the dd-wrt firmware, it always had lots of caveats and known issues.

I gave up. Shelved it and bought a pfsense box for the internet and use a Ubiquity wifi AP.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#177

Post by technofiend »

johnbellone wrote: post #152
technofiend wrote: post #107

Earlier quoted context omitted.

>Or better yet, buy a bunch of Ubiqity UniFi's Warning: do not follow this advice; Ubuiqiti products are like potato chips in that you can never eat just one. Oh I'll get the AC PRO access point, you think. Five minutes later you've set it via quick QR code scan and the UniFi app. That was painless! No wonder people recommend these things. Oh wait I need to make some more device tweaks but UniFi won't do it.. better…

I agree. I purchased some Ubiquity gear a few months back after a condo purchase, and ran into few problems: - UniFi brand works well for setup, but the cloud controller is necessary for command/control management outside of iOS/Android app. - EdgeRouter is not a UniFi product and does not act as a cloud controller. - EdgeRouter X does not deliver 48V PoE; upgrade was needed to power the AC-PRO. - EdgeRouter UI is ho…

My response was tongue in cheek but seriously I recommend budgeting a VM or Raspberry PI to run their controller software which offers the most configuration options.

https://www.ubnt.com/download/unifi/

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#178

Post by ausjke »

Just replace its firmware and load the router with LEDE/openwrt instead.

LEDE is an Openwrt fork, and it might merge back to Openwrt sometime.

LEDE is under active development and its newest release is 17.01.4 https://downloads.lede-project.org/releases/

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#179

Post by jimmies »

tambourine_man wrote: post #135
ktta wrote: post #9

PSA Anyone with commodity routers, repeaters, etc. please check out LEDE project https://lede-project.org . Check if your device has support here - https://lede-project.org/toh/start LEDE firmware is amazing. You will be able to do a lot more with your router and they have quick security fixes. The recent krack vulnerability was fixed within 2 days after the announcement.

Anyone care to explain the pro/cons of DD-WRT vs Tomato vs OpenWRT vs LEDE vs etc?

LEDE has a very active anti-bufferbloat research people working with it.

LEDE has, in general, active, managed, and unified development. You'd have to hunt down a specific Tomato/DD version that works for you. Sometimes the latest version of DD/Tomato works, sometimes it doesn't. LEDE? Just download the latest stable release, done.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#180

Post by dnebdal »

herpderperator wrote: post #59

Don't bother with repeaters. Get normal access points, and install several of them if you need to disperse the range around a large area/building/complex. If the SSID and security passphrases match, clients will roam seamlessly between the different APs. I suspect the reason people buy repeaters is that they don't realise that this is possible, or they don't want additional cabling. Repeaters add latency and I can't…

In this specific case, the RE650 is sold as a repeater - but it also has an access point mode. If it wasn't for TP-Link's approach to software, it would be a nice enough AP: I get good speeds and coverage out of mine, and it's small enough that you can just plug it into a wall socket somewhere you can run a network cable to.

Oh well, I'll probably have to get an ubiqity or something.

Post reply on HN