Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

github.com

Post reply on HN
Print view View original

81–90 of 96 posts

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#81

Post by OptionOfT »

drnick1 wrote: post #4

This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited.

Which is very hard, because most of these devices don't work locally. They communicate via the cloud to your app.

In most cases companies don't want to give you Matter or HomeKit, because it means they cannot sell you more through their app.

Wyze has ads everytime you open it. So does Honeywell. Hell, even the internet-loved Ecobee has a banner that shifts everything down most of the time that you open the app. And for that last one, you _have_ to use their app to control the fan, as they don't expose separate fan controls over HomeKit...

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#82

Post by neogodless »

AndyMcConachie wrote: post #28

Why do people keep buying all this garbage and putting it in their homes?

TP-Link in particular because you can throw in an SD card and pay no subscription cost for many of their cameras, while a lot of other brands require monthly commitments to use most of the features.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#83

Post by BLKNSLVR »

inigyou wrote: post #59
locknitpicker wrote: post #29

Earlier quoted context omitted.

> This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. TP-Link is a prominent maker of network hardware, including home and mesh routers.

And their network hardware is illegal to import into the USA because it's full of backdoors.

So, TP-Link isn't sold as consumer level devices in stores in the US?

It's had the Huawei treatment?

It's one of the primary networking electronics brands in Australia.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#84

Post by mlhpdx »

Good, they used UDP for a one off request /response (maybe) exchange. Bad, they included precise location information.

I can see how rough location information is helpful for support and business information. Maybe country, maybe even zip code. But precise GPS was a bit overkill. Maybe it was easy, maybe it was nefarious, but not encrypting it over the wow was just plain dumb. I guess there is a razor for that.

How would this exfiltration happen though? Aren’t these cameras going to be behind a firewall? Without a request originating internally no external packet will make it past, right? Does the firmware make the first request? If so, I missed it.

I’m more mystified by the fleet wide certs. Old manufacturing tech that makes per-device firmware difficult, perhaps?

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#85

Post by drnick1 »

OptionOfT wrote: post #81
drnick1 wrote: post #4

This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited.

Which is very hard, because most of these devices don't work locally. They communicate via the cloud to your app. In most cases companies don't want to give you Matter or HomeKit, because it means they cannot sell you more through their app. Wyze has ads everytime you open it. So does Honeywell. Hell, even the internet-loved Ecobee has a banner that shifts everything down most of the time that you open the app. And f…

> Which is very hard, because most of these devices don't work locally.

Then don't buy those devices. All of my home devices are either Zigbee (local-only) or were bought specifically because they can be reflashed with open firmware to liberate them from the cloud.

> Hell, even the internet-loved Ecobee has a banner that shifts everything down most of the time that you open the app.

I don't want such apps. The only app I need is Home Assistant, and installing proprietary software on my phone (running GrapheneOS) is out of the question.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#86

Post by RetroTechie »

holgerschurig wrote: post #21
qurren wrote: post #14

Earlier quoted context omitted.

HomeKit will take care of the VPN/remote access part, sure, but your devices still need to communicate with the HomeKit device, and that's usually over Wi-Fi, which puts the devices on the public internet, and carries the same security risk. There are various non-internet protocols for IoT devices, none of them good: * Zigbee: Requires some technical understanding to set up, devices randomly disconnect for hours even…

> Zigbee Requires no technical understanding. At least not more than e.g. a WIFI router. > devices randomly disconnect for hours even when they are 2ft from the coordinator, You present this like a fact. But it is at most an anecdote. I present you a different anecdote: I have ~30 zigbee devices, in two different houses (first a house with concrete floors and cellar and level 1..3) and now one old woodwork structure…

> My temperature sensors got a 1500mAh AAA chargeable batteries

You meant rechargeable? You seem to know more about Zigbee than about rechargeable batteries.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#87

Post by BadChemical »

mlhpdx wrote: post #84

Good, they used UDP for a one off request /response (maybe) exchange. Bad, they included precise location information. I can see how rough location information is helpful for support and business information. Maybe country, maybe even zip code. But precise GPS was a bit overkill. Maybe it was easy, maybe it was nefarious, but not encrypting it over the wow was just plain dumb. I guess there is a razor for that. How w…

The UDP is through the broken, since 2016, TP link smart home protol. Exfiltration would require a precursor network foothold for a pure network vector, or for local 2nd hand markets the data is returned from the device broadcasted AP which is used for account binding.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#88

Post by inigyou »

BLKNSLVR wrote: post #83
inigyou wrote: post #59

Earlier quoted context omitted.

And their network hardware is illegal to import into the USA because it's full of backdoors.

So, TP-Link isn't sold as consumer level devices in stores in the US? It's had the Huawei treatment? It's one of the primary networking electronics brands in Australia.

Yes it had the Huawei treatment

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#89

Post by ssl-3 »

inigyou wrote: post #88
BLKNSLVR wrote: post #83

Earlier quoted context omitted.

So, TP-Link isn't sold as consumer level devices in stores in the US? It's had the Huawei treatment? It's one of the primary networking electronics brands in Australia.

Yes it had the Huawei treatment

What are the details of that treatment?

As I write this, there are all kinds of TP-Link routers, mesh nodes, and cameras (oh my!) in stock at a nearby Wal-Mart, with pickup promised within a few hours from now.

Re: TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years

#90

Post by ssl-3 »

ck2 wrote: post #76
drnick1 wrote: post #4

This underscores the principle that IoT devices should not be allowed to communicate over the public Internet. Pretty much all cheap, Chinese-made hardware of this kind has intentional or unintentional security holes waiting to be exploited.

routers could solve this for consumers with a checkbox for "intranet only" 99% of consumers won't know how to setup a firewall but could handle a checkbox only problem I have is I can't seem to punch a hole for time sync and it won't use my local intranet time server

Time server can be specified with DHCP, if you want. Options 4 [deprecated, but that doesn't matter] and 42.

No idea if that helps with your particular devices; they are, of course, free to ignore those fields.

Post reply on HN