Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

evilsocket.net

Post reply on HN
Print view View original

101–110 of 128 posts

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#101

Post by cvhc »

aaronax wrote: post #3

This is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities? There must be many millions sold. Quite handy for some intel agencies. I assume any Wi-Fi camera under $150 has basically the same problems. I guess the only way to run a security camera where you don't have Ethernet is to use a non-proprietary Wi-Fi 10…

It's been long known many older TP-Link IoT devices doesn't require any authentication to connect, as my Kasa HS300 strips. Later models requires the account credential [1], but I'm not surprised that they still left something wide open (e.g., WiFi config endpoint for provisioning). I tend to believe this is just poor software engineering (Hanlon's razor).

[1] https://www.home-assistant.io/integrations/tplink/

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#102

Post by dpkirchner »

magmostafa wrote: post #49

This is exactly why network segmentation is critical for IoT devices. I always recommend putting all smart cameras and IoT devices on a separate VLAN with no direct internet access - only local network access through a firewall with strict egress rules. For anyone concerned about their TP-Link cameras, consider: 1. Disable UPnP on your router 2. Use VLANs to isolate IoT devices 3. Block all outbound traffic except sp…

I have my cameras connected to a N150 server running hostapd and dnsmasq and no IP forwarding. That server runs Frigate. I figured if I need a server anyway it might as well be the AP.

It's a little bit of a pain to set up the cameras because of the mobile app. I have to connect to the AP on my phone and as it doesn't have internet access my phone nags me, and this specific model doesn't have an external antenna. If it did I think it might be the ideal setup.

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#103

Post by c0l0 »

kqr wrote: post #74
c0l0 wrote: post #27

Earlier quoted context omitted.

I came here to post this, too :) What the thingino community managed to do with their firmware for these cameras is nothing short of amazing - if you happen to have a compatible camera, you really, really should give it a whirl!

I'd love to but... how? One alternative seems to be a programmer chip that must be puchased and then modified to not fry the camera with 5V. Another is maybe stripping a USB cable and soldering it to the wifi pads on the camera chip? Neither of these seem like good ideas for someone like me, who is relatively hardware naïve and has small children running around making it hard to concetrate for more than 30 minutes at…

Yeah, I can see why that is a show-stopper for people. However, the thingino project has people among them who care deeply about ease of installation - so with these security issues discovered in the TP-Link device, chances are an installation method that relies on a vulnerable stock firmware will be provided in time :)

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#104

Post by locknitpicker »

lmz wrote: post #97
locknitpicker wrote: post #88

Earlier quoted context omitted.

> Highlighting (repeatedly) the ease and breadth of access is a basic writing technique to illustrate the weakness of a security system. It's a firmware distribution system. It's read-only access to a public storage account designed to provide open access to software deployment packages that the company wishes to broadcast to all products. Of course there is no auth requirement at all. The system is designed to allow…

Maybe listing shouldn't be enabled even if all the files are public.

> Maybe listing shouldn't be enabled even if all the files are public.

I don't see why. Support for firmware upgrades literally involve querying available packages and downloading the latest ones (i.e., apply upgrades). Either you use something like the S3 interface, or you waste your time implementing a clone of what S3 already supports.

Sometimes simple is good, specially when critics can't even provide any concrete criticism.

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#105

Post by buddhistdude »

defraudbah wrote: post #87
reddalo wrote: post #69

Earlier quoted context omitted.

> they can MITM it Can they? I thought they could only do it if they're in the same LAN.

the exploit is to make camera disconnect and connect to your wifi, that's how they MITM, pretty long process unless you do it often

could be automated though?

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#106

Post by evilsocket »

locknitpicker wrote: post #89
hdgvhicv wrote: post #59

Earlier quoted context omitted.

> I found out that TP-Link have their entire firmware repository in an open S3 bucket. Nobody tell them about Linux!

> Nobody tell them about Linux! The blogger will blow a gasket when they discover that the likes of GitHub provides access to both installers and software. A hacker's candy store!

Do you people realize that there's a big difference between open source and proprietary technologies right?

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#107

Post by evilsocket »

jacquesm wrote: post #77
sally_glance wrote: post #64

Earlier quoted context omitted.

To me the phrasing seems objective. Making your binaries available to the public is good (though source would be better). Replace [firmware] with [random popular GitHub repo] and nobody would blink. Replace [firmware] with [customer email address] and it would be a legal case. Differentiating here is important.

No, it clearly has a gloating tone to it. 'A reverse engineer's candy store' is clearly meant as a slur. When in fact TP-Link is doing the right thing with keeping older versions available. So this risks some higher up there thinking 'fuck it, we can't win, might as well close it all off'.

I just meant that it was very convenient to have the firmware images there on S3, nothing else :D Many vendors make the process of even just obtaining a copy of the firmware much harder than that, so for once I was glad it has been much easier. Also being able to bindiff two adjacent versions of the same firmware is great ... all in all I was just expressing my happiness :D

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#108

Post by defraudbah »

buddhistdude wrote: post #105
defraudbah wrote: post #87

Earlier quoted context omitted.

the exploit is to make camera disconnect and connect to your wifi, that's how they MITM, pretty long process unless you do it often

could be automated though?

yes, everything can be automated, and as you people don't always have time to automate everything, so it depends if your area has many c200 which is a home camera, not outdoor

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#109

Post by jorvi »

NathanielK wrote: post #96
rao-v wrote: post #21

I'm a little frustrated with articles like this that scattershot their critique by conflating genuine failures with problems that even FAANGs struggle with. In particular, I don't love it when an article attacks a best practice as a cheap gotcha: "and this time it was super easy! After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No…

This blog post is pretty readable, but it's still obviously written with the help of an LLM. A common trend is that LLMs lack the nuance and write everything with the same enthusiasm. So in a blogpost it'll infer things are novel or good/bad that are actually neutral. Not a bad blogpost because of this, but you need to be careful reading. I've noticed most of the article on the HN front page are written with AI assis…

I always wonder if the people who let LLMs write (and think) for them realize they're steadily atrophying their brain.

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#110

Post by dns_snek »

notjosh wrote: post #19
SilverElfin wrote: post #14

So which camera brand has adequately designed software? It’s hard to know as a consumer what to trust or not trust, because how do you evaluate the quality of their work when the device SEEMS to work as expected? Is Ring the only choice?

I've installed Thingino on my cameras such as this. Cheap camera + custom (local only!) firmware is a good solution imo. No guarantee that it'll be perfect either, obviously, but it's open source and actively maintained. Highly recommended.

Thingino is great for many other reasons but security is not one of them - definitely segregate those cameras on a locked down VLAN. The web interface is HTTP-only and it uses the same credentials as root SSH access on the camera, and most of the web ui handling code is highly questionable to say the least.
Post reply on HN