Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wanted to spy on my dog, ended up spying on TP-Link

kennedn.com

Post reply on HN
Print view View original

141–150 of 181 posts

Re: Wanted to spy on my dog, ended up spying on TP-Link

#141

Post by t-3 »

ByteDrifter wrote: post #126
selinkocalar wrote: post #89

IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning. Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.

Most people only care about how strong the signal is when buying a router, but almost no one checks if the firmware is outdated, or bothers to change the default password or disable remote access. And manufacturers rarely remind you either, so over time it just becomes a hidden risk.

Most people don't buy routers, they get them from the ISP and never think about them again unless the wifi goes out, in which case they unplug and plug back in.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#142

Post by 2rsf »

bri3d wrote: post #23
some_random wrote: post #21

Earlier quoted context omitted.

If you buy the camera, plug it in, and forget to set it up, you just flat out can't use it right? I agree that proof of presence is way better but how many people are seriously going to be affected?

No, if you buy the camera, plug it in, and forget to set it up, then someone can use the default password and key material stored in the app to pretend to be the app and provision it on your behalf. That's the only real vulnerability here, and it's no big deal, but it is A Thing and there is definitely a better way to do this that doesn't lose the freedom of full-offline.

There could be another scenario. I assume that factory resetting the camera will bring back the default password. Factory reset is a long press on the power button (in some cheap TPlink camera), so in theory someone with physical access can take control over the camera without you noticing until you try and use it.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#144

Post by otikik »

bri3d wrote: post #18
mtlynch wrote: post #14

Earlier quoted context omitted.

It's a hardcoded default password, not a permanent backdoor. If I'm understanding the post correctly, the user changes it as part of the onboarding flow. This is the way most apps work if they have a default password the user is supposed to change.

The device should ideally have some kind of secret material derived per device, like a passphrase generated from an MCU serial number or provisioned into EEPROM and printed on a label on the device. Some form of "enter the code on the device" or "scan the QR code on the device" could then mutually authenticate the app using proof-of-presence rather than hardcoded passwords. This can still be done completely offline w…

Well it was "the cheapest cam in Amazon" according to the article so my expectations were that this would not be "ideal".

Re: Wanted to spy on my dog, ended up spying on TP-Link

#145

Post by h4ch1 »

otikik wrote: post #143

Very nice project and writeup. I wish there was a repository of "appliances that don't try to shove an app and a subscription down your throat"

I mirror this sentiment so much as well.

Not aware of a list or something, but before buying any appliance I try searching if it's "jailbreak-able".

For example I'll search if the router I want to purchase has guides to install openWRT on it, how hard it is to break out of the vendor software loop.

Recently even my Aircon had a mandatory app that it required to even finish installation. I got so pissed I dumped the firmware and reverse engineered the protocol enough to figure out how to set fan speed, temperature and mode. Sitting in the sweltering New Delhi heat really expedited the process.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#146

Post by concats »

jraph wrote: post #62
bstsb wrote: post #37

really like how this blog is written. a lot of writeups like this recently have been generated by an LLM, and it's quite distracting to read - this was a pleasant surprise. it strikes a good balance between technical and laid-back (yes i know the cover image is AI-generated, that's incidental to the content)

I've been blocking by default bigger media files with uBlock Origin to avoid needless resource usage. Cover images are typically blocked, and they are usually useless anyway. It's too bad people spend energy for generating them now.

>> It's too bad people spend energy for generating them now.

How do you mean?

Some quick back of the napkin math.

Creating a 'throwaway' banner image by hand, maybe 15 minutes on a 100W CPU in Photoshop:

  15 minutes human work time + 0.025 kWh (100W*0.25h)
Creating a 'throwaway' banner image by stable diffusion on a 600W GPU. In reality it's probably less than 20 seconds to generate, but let's round it up to one full minute of compute time:

  5 minutes human work time + 0.01 kWh (600W*(1/60)h)
The way I see it it seems to spend less energy, regardless of whether you're talking about human energy or electrical energy. What's the issue here exactly?

Re: Wanted to spy on my dog, ended up spying on TP-Link

#147

Post by dracotomes »

johncolanduoni wrote: post #125
Gigachad wrote: post #113

Earlier quoted context omitted.

There are countless routers in between you and your destination which you can't audit anyway. End devices long since consider the routers to be compromised and have everything verified and encrypted in transit. So unless your router is participating in a DDoS or mining bitcoins it doesn't really matter how secure it is.

Many IoT devices (or Windows when the LAN network location is set to “Private”) expose a wider surface area to local network addresses. Having a competent firewall on your residential router is still useful, especially for those that have no idea how to configure their endpoints securely. Comparing a residential router to a network operator’s router is spurious: those routers don’t perform any sort of filtering for t…

Is there any residential router that exposes internal endpoints be default? I've yet to come across one that does not have a deny-any policy on it's WAN interface and has incoming destination NATs setup up.

What use is reducing the attack surface of a device which only ever initiates connections?

Edit: also there are network operators that block customer traffic on certain ports liike NetBIOS, SMB or SMTP to name a few.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#148

Post by cleartext412 »

roygbiv2 wrote: post #139
cleartext412 wrote: post #131

Hacking together something usable out of cloud-first piece of hardware you ended up with is respectable, but I would like to bring up another option to go with if you're choosing a new device: buy camera that doesn't require a phone app to initial setup and serves RTSP out of the box.

What cheap camera doesn't require a phone app and serves RTSP out of the box?

Note that I didn't say "cheap". If price difference comes from manufacturer's hope of selling its cloud service, then the time and effort required to set it up is not worth the money.

If I were to solve one-time task of keeping an eye on someone indoors I would go with USB camera (if lighting conditions allows even the laptop's build in), which is going to be cheaper than ones with IP and WiFi support.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#149

Post by johnisgood »

t-3 wrote: post #141
ByteDrifter wrote: post #126

Earlier quoted context omitted.

Most people only care about how strong the signal is when buying a router, but almost no one checks if the firmware is outdated, or bothers to change the default password or disable remote access. And manufacturers rarely remind you either, so over time it just becomes a hidden risk.

Most people don't buy routers, they get them from the ISP and never think about them again unless the wifi goes out, in which case they unplug and plug back in.

Exactly. This really is the reality of it.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#150

Post by omcnoe »

drnick1 wrote: post #107
briHass wrote: post #103

Earlier quoted context omitted.

The stuff on the shelf, sure, but you can always go 'prosumer-grade' like Ubiquiti or Mikrotik for hardware that actually receives timely updates and has competently written firmware.

Ubiquiti is awful, it's a cloud-centric ecosystem. The best "prosumer-grade" stuff is probably OpenWrt. If you need more power, opnSense or a plain Linux distro on an x86 machine.

OpenWRT is trading money for time. It's fine to recommend to someone interested in setting up their own custom router, but for most "prosumers" Ubiquiti will provide a better experience.

It's worth noting that Ubiquiti provides local admin support, and that the Ubiquiti Cloud data breach was actually a false story spread by a disgruntled internal engineer in an attempt to extort his employer.

Post reply on HN