Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wanted to spy on my dog, ended up spying on TP-Link

kennedn.com

Post reply on HN
Print view View original

161–170 of 181 posts

Re: Wanted to spy on my dog, ended up spying on TP-Link

#161

Post by TomaszZielinski »

Gigachad wrote: post #113
selinkocalar wrote: post #89

IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning. Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.

There are countless routers in between you and your destination which you can't audit anyway. End devices long since consider the routers to be compromised and have everything verified and encrypted in transit. So unless your router is participating in a DDoS or mining bitcoins it doesn't really matter how secure it is.

I mean, your router is the single key to your kingdom—-your local network. If you don’t treat all your local devices as hostile (which is a reasonable thing to do but almost no one does it), then having your router in shape is somewhere in the important to critical range.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#162

Post by wpm »

I love little projects like this, but man does this make me glad things like Thingino exists. Installing the firmware takes like 5 minutes, a little self-hosted web configurator pops up, you put in an SSID and a password, the camera reboots, and its yours. We should not have to reverse engineer crap like this.

https://thingino.com

Re: Wanted to spy on my dog, ended up spying on TP-Link

#163

Post by lo0dot0 »

mtlynch wrote: post #14
micah94 wrote: post #5

So we're at the point that finding hardcoded admin passwords is no big deal.

It's a hardcoded default password, not a permanent backdoor. If I'm understanding the post correctly, the user changes it as part of the onboarding flow. This is the way most apps work if they have a default password the user is supposed to change.

"if you don't know what you're doing don't do it" vs. "Secure out of the box"

Re: Wanted to spy on my dog, ended up spying on TP-Link

#164

Post by lo0dot0 »

selinkocalar wrote: post #89

IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning. Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.

Fritzbox brand and possibly others updates itself automatically by default. ISPs often also control the devices they ship to clients and install updates as part of a "fleet management".

Re: Wanted to spy on my dog, ended up spying on TP-Link

#165

Post by Joe_Cool »

the_biot wrote: post #151
drnick1 wrote: post #108

Earlier quoted context omitted.

Actually, pfsense kind of has a shitty reputation in the FOSS community and opnSense is preferred. But I don't like the limitations of BSD systems in terms of hardware compatibility and performance, so I build my router using a plain Linux distro (Debian).

That's the first I've heard of pfsense having a bad reputation, can you explain? (I haven't used it, genuinely want to know)

They also did this: https://web.archive.org/web/20160314132836/http://www.opnsen...

And WIPO had to take the domain away from them: https://en.wikipedia.org/wiki/PfSense#OPNsense

Re: Wanted to spy on my dog, ended up spying on TP-Link

#166

Post by johncolanduoni »

dracotomes wrote: post #147
johncolanduoni wrote: post #125

Earlier quoted context omitted.

Many IoT devices (or Windows when the LAN network location is set to “Private”) expose a wider surface area to local network addresses. Having a competent firewall on your residential router is still useful, especially for those that have no idea how to configure their endpoints securely. Comparing a residential router to a network operator’s router is spurious: those routers don’t perform any sort of filtering for t…

Is there any residential router that exposes internal endpoints be default? I've yet to come across one that does not have a deny-any policy on it's WAN interface and has incoming destination NATs setup up. What use is reducing the attack surface of a device which only ever initiates connections? Edit: also there are network operators that block customer traffic on certain ports liike NetBIOS, SMB or SMTP to name a f…

If your home router is compromised (which is what the parent comment was talking about, considering it mentioned CVEs) the attacker who now controls it can easily make connections to devices on your network via the router’s local address.

As for how the router that is theoretically not accepting incoming connections from the internet itself gets compromised in the first place: among other issues some routers can be RCEd by a webpage visited by someone inside the LAN[1]. That’s just one example, you can find tons of these if you search for router vulnerabilities. In practice out of date routers end up in botnets frequently.

It has nothing to do with network operators blocking SMB traffic; the attacker can communicate with the router via whatever C2 mechanism they put in the malware, which probably won’t even involve opening a port on the router. The SMB or what have you to the endpoint would be entirely within the LAN.

[1]: https://www.malwarebytes.com/blog/news/2023/02/arris-vulnera...

Re: Wanted to spy on my dog, ended up spying on TP-Link

#168

Post by Liquid_Fire »

concats wrote: post #146
jraph wrote: post #62

Earlier quoted context omitted.

I've been blocking by default bigger media files with uBlock Origin to avoid needless resource usage. Cover images are typically blocked, and they are usually useless anyway. It's too bad people spend energy for generating them now.

>> It's too bad people spend energy for generating them now. How do you mean? Some quick back of the napkin math. Creating a 'throwaway' banner image by hand, maybe 15 minutes on a 100W CPU in Photoshop: 15 minutes human work time + 0.025 kWh (100W*0.25h) Creating a 'throwaway' banner image by stable diffusion on a 600W GPU. In reality it's probably less than 20 seconds to generate, but let's round it up to one full…

To add to the sibling comment, your CPU is not going to be using 100 W (if it can even reach that!) for more than a few seconds in total during 15 min of typical Photoshop use.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#169

Post by marci »

concats wrote: post #146
jraph wrote: post #62

Earlier quoted context omitted.

I've been blocking by default bigger media files with uBlock Origin to avoid needless resource usage. Cover images are typically blocked, and they are usually useless anyway. It's too bad people spend energy for generating them now.

>> It's too bad people spend energy for generating them now. How do you mean? Some quick back of the napkin math. Creating a 'throwaway' banner image by hand, maybe 15 minutes on a 100W CPU in Photoshop: 15 minutes human work time + 0.025 kWh (100W*0.25h) Creating a 'throwaway' banner image by stable diffusion on a 600W GPU. In reality it's probably less than 20 seconds to generate, but let's round it up to one full…

It all depends on the scale you use. At the individual, sure. But it's like cars. They keep getting more effecient, yet total energy consumption keeps increasing.

The further we can go, the further we will go.

The more CPU power we get, the more JS heavy websites get.

The more images we can generate, the more we will generate.

The more we can do, the more we do, whether we should or not.

Post reply on HN