Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bambu Lab - Setting the Record Straight About Our Security Update

blog.bambulab.com

Post reply on HN
Print view View original

41–50 of 122 posts

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#41

Post by parasubvert »

People seem to be missing that FTP and MQTT are generally insecure protocols. I think FTP is probably the bigger issue than MQTT. This kind of stuff is common in home IOT networks but would never pass security audit on a corporate network.

Bambu is growing up, serving more corporations beyond the hobby community, and probably has been asked to beef their security up to make it easier to deploy their printers securely.

Moving to Mutual TLS via a controlled client like Bambu Connect is a pretty industry standard approach to secure, authenticated communication that doesn't require an internet connection, it is done with digital signatures offline.... and thus it can be done over a LAN. It's how many web APIs inside a corporate network are secured. It's how web browsers are secured. Microsoft, Mozilla, Google, Apple, etc. all send you revised certs/keys regularly in your OS or browser patches. Client authentication via x.509 cert signature or subject verification isn't super common on the public web but it does happen a lot with mobile apps or thick client apps, or some websites, e.g. SAP's many websites often use it to verify you're a customer.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#42

Post by LouisvilleGeek »

nullc wrote: post #26
the_mitsuhiko wrote: post #21

Earlier quoted context omitted.

I'm not sure why you would need to give it internet access. I think even the firmware updates work via SD card.

They just introduced firmware updates via SD card in the most recent released version, prior to that you had to put the printer online and associate it with an account to get firmware updates. But yes today there is no need to use their cloud services unless you want to control the printer with their phone app. And the printer works totally fine completely isolated from the internet. The now aborted proposed update w…

Bambu Companion (unfortunately iPhone only) does more than Handy and works on LAN. Using it today in fact! https://www.youtube.com/watch?v=LZpDQN9zgUI

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#43

Post by parasubvert »

vvanders wrote: post #39
the_mitsuhiko wrote: post #22

Earlier quoted context omitted.

That is obviously correct, but this is a meaningful improvement over what their initial plan was.

I don't really see what having a "developer mode" offers here beyond the existing solution. The current mqtt is already locked down with a unique password and AFAIK the endpoint was read-only anyway. Don't get me wrong I'm glad they're responding to feedback but the feedback shouldn't have been required in the first place. I'm all for better security on products(esp ones that heat up to 300C!) but interoperability wi…

Developer mode is just "how it works today" mode. It's insecure, and uses private APIs, and thus shouldn't be used, but people will anyway, so they're listening to their customers.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#44

Post by satvikpendem »

rowanG077 wrote: post #34
the_mitsuhiko wrote: post #22

Earlier quoted context omitted.

That is obviously correct, but this is a meaningful improvement over what their initial plan was.

That doesn't seem obvious to me. It's not unthinkable their plan is: - Want to introduce x, but we are worried what our userbase thinks. - Introduce something way more ridiculous y that subsumes x. - Rollback y but not x because of backlash. Now they look like a company that listens to their users and they got what they wanted.

Ah the classic door in the face technique

https://en.wikipedia.org/wiki/Door-in-the-face_technique

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#45

Post by madeofpalk »

rowanG077 wrote: post #34
the_mitsuhiko wrote: post #22

Earlier quoted context omitted.

That is obviously correct, but this is a meaningful improvement over what their initial plan was.

That doesn't seem obvious to me. It's not unthinkable their plan is: - Want to introduce x, but we are worried what our userbase thinks. - Introduce something way more ridiculous y that subsumes x. - Rollback y but not x because of backlash. Now they look like a company that listens to their users and they got what they wanted.

They’ve suffered real brand damage. Any of the changes (original, or these) seem like they would win over unconvinced potential customers, yet they’ve actively turned some away.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#46

Post by LeFantome »

The play here is obviously that they want 3rd party services to use Bambu Connect instead of direct protocol integration. They will make Connect easy and direct too much work. That is what all the Panda talk was about. That way, when Bambu inevitably changes the model ( eg. Subscription ), we will have to pay to get access to the ecosystem. But Bambu will be able to claim that it is not them. We still support developer mode they will say, it is the evil third parties that do not.

We need to make sure that dev mode becomes the de facto default. Don’t fall for connect.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#47

Post by parasubvert »

sho_hn wrote: post #40
iLoveOncall wrote: post #23

Earlier quoted context omitted.

> I think the OrcaSlicer maintainers should tell Bambu Lab to pound sand with this change. Hum, the alternative is OrcaSlicer stops working with Bambu printers...

> Hum, the alternative is OrcaSlicer stops working with Bambu printers... Which is fine, no? Plenty of other good printers available.

Um no? First, Bambu is the best, by far. Secondly, Orca Slicer is a fork of Bambu Studio and the vast majority of its users are Bambu customers that want extra features.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#48

Post by blutack »

parasubvert wrote: post #30
blutack wrote: post #16

Does anyone know or can see an actual concrete security concern with the current implementation of LAN mode? https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md Right now, the printer's local MQTT server can only be accessed from the local IP using an 8 digit password obtained through through the physical display. I can't personally see any fundamental issue with this design assuming the implementation is corr…

To me this whole thing feels like they're trying to pass audit to sell Bambu printers to corporations that require secure communications. Mutual TLS with client certs is nearly universal, which is what they're trying to do with Bambu Connect. On the other hand, MQTT isn't a very secure protocol, plus the printer also uses FTP which is mostly banned on corporate networks these days.

I wasn't aware of any specific vulnerabilities in the basic MQTT design (assuming it's over TLS).

I agree that MTLS for embedded m2m/IOT auth against MQTT is pretty standard (see AWS IOT, Azure etc) but do paper printers used in enterprise which have displays typically require MTLS for printing?

Surely any corporation with a security team would VLAN and null route these things anyway - only the enterprise targeted X1E model has an ethernet port, all the others are WiFi only.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#49

Post by axegon_ »

Bambu lab printers are truly awesome in terms of what they can do for a very reasonable price. Having said that, I have never upgraded mine nor have I ever connected it to the internet and never will. Nor will I update it. If it takes me 15 minutes to get an ssh client running on an esp8266 that can connect to an poorly secured server and execute shell commands, there is no way I'm letting a proprietary chinese hardware and software anywhere near my home network. But this is just a side hobby of mine, so I can live with carrying around an SD card. But I can see how something like that can be a major blow to business owners. I am not entirely sure if this blog post is just a response or sneaky backpedaling from bambu labs after the backlash they received over the last few days.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#50

Post by sarchertech »

This stuff isn’t gonna stop until we regulate it.

I bought a miku baby monitor specifically because they were the only manufacturer that had the feature I wanted that promised to never charge monthly fees to use it.

Well then they went bankrupt and a company bought them, forced an over the air update that disabled every feature that made the thing worth buying (for $399), and sent out a letter demanding monthly payment to reenable the “advanced” features.

Market forces won’t fix this. Recurring revenue is just too tempting. It also doesn’t matter how well intentioned a company is, the moment they go out of business, someone will buy their assets and force monthly fees on their former customers.

Post reply on HN