TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
1–10 of 128 posts
Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
#2It's probably fair to assume that most of their other camera models are affected by the same or similar issues. It looks like they pump out quite a few models that I image have similar firmware.
This page[1] lists the C200 as last having a firmware update in October, but also lists the latest version as 1.4.4 while the article lists 1.4.2. It seems like they have pushed other updated in this time, but not these security fixes.
[1]https://community.tp-link.com/us/smart-home/kb/detail/412852
Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
#3This is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities? There must be many millions sold. Quite handy for some intel agencies.
I assume any Wi-Fi camera under $150 has basically the same problems. I guess the only way to run a security camera where you don't have Ethernet is to use a non-proprietary Wi-Fi 1000BASE-T adapter. Probably only something homebuilt based on a single board computer and running basically stock Linux/BSD meets that requirement.
Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
#4Very interesting, I had a go with Ghidra and AWS Amazon Q, used it to reverse the video feed on a toy drone. I did not think to look for GhidraMCP, would of made it a lot quicker.
Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
#5As soon as i read the author used grok as an ai assistant, i was somehow less interested to keep on reading. Not because of the usage of ai, but the chosen provider. (I don’t know whether grok is just the best choice for this kind of work.)
Is it wrong to judge people for their choice of ai providers?
Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
#6As soon as i read the author used grok as an ai assistant, i was somehow less interested to keep on reading. Not because of the usage of ai, but the chosen provider. (I don’t know whether grok is just the best choice for this kind of work.) Is it wrong to judge people for their choice of ai providers?
Which AI providers have access to real-time Twitter data?
Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
#7As soon as i read the author used grok as an ai assistant, i was somehow less interested to keep on reading. Not because of the usage of ai, but the chosen provider. (I don’t know whether grok is just the best choice for this kind of work.) Is it wrong to judge people for their choice of ai providers?
I think when your political views cloud your ability to take in information on an objective level, it might be bad.
Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
#8As soon as i read the author used grok as an ai assistant, i was somehow less interested to keep on reading. Not because of the usage of ai, but the chosen provider. (I don’t know whether grok is just the best choice for this kind of work.) Is it wrong to judge people for their choice of ai providers?
I think when your political views cloud your ability to take in information on an objective level, it might be bad.
You can just not like Elon, doesn't have to be political at all.
Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
#9As soon as i read the author used grok as an ai assistant, i was somehow less interested to keep on reading. Not because of the usage of ai, but the chosen provider. (I don’t know whether grok is just the best choice for this kind of work.) Is it wrong to judge people for their choice of ai providers?
It's worth interacting with all models. In my experience, for programming questions grok delivered better answers than ChatGPT (and Claude) often enough that at some point I wasn't sure which model I should be asking first.
Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
#10It's probably fair to assume that most of their other camera models are affected by the same or similar issues. It looks like they pump out quite a few models that I image have similar firmware. This page[1] lists the C200 as last having a firmware update in October, but also lists the latest version as 1.4.4 while the article lists 1.4.2. It seems like they have pushed other updated in this time, but not these secur…
I looked at some older Zyxel products and came to the same conclusion a while back. There's a whole industry of labeling generic hardware as being part of someone's else ecosystem
https://www.hydrogen18.com/blog/hacking-zyxel-ip-cameras-pt-...
https://www.hydrogen18.com/blog/hacking-zyxel-ip-cameras-pt-...