Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Newer TP-Link Routers send large volumes of requests to Avira servers

old.reddit.com

Post reply on HN
Print view View original

61–70 of 121 posts

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#61

Post by rfoo »

zinekeller wrote: post #42
frogger8 wrote: post #15

From the comments Nothing in your analysis shows this. Moreover unless you explicitly deployed a root certificate on your clients (or if an app on the client did it), the router can't decode TLS traffic (deep inspection) without you getting certificate warnings on the client. In that case, the only thing the router can see is the dns request, the IP and the TLS SNI. In short your title is misleading. permalinkembedsa…

... and I don't get your point in this useless pedantry? Sure that the data in of itself is not sent, but you seemed to imply that DNS queries don't reveal anything. In practice, you can build a good enough picture to decode what's their interests, what type of places they visit etc., which is worrying of itself. It's like saying to not worry because they didn't know you ordered a Big Mac while the fact that you went…

I think the point is the original author did not prove anything was sent to Avira in this case. All they have is speculation that "the router is making DNS queries about a Avira safe things domain and the DNS query QPS is correlated to the amount of traffic in the network".

I agree this is tremendously bad code, but what they observed could also be perfectly explained with "some stupid code doing a Avira subscription check whenever something arrives at the router and they do that without a cache for negative answer, and even if the feature is turned off".

So we need more evidence.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#62

Post by alufers »

ajot wrote: post #8

That's before installing OpenWRT! This kind of shenanigans make (once again) the case for 3rd party post market FLOSS firmware to be installed on every device I own. Sure, I spend some extra time researching which router/AP/phone/ereader/smart appliance will be compatible with OpenWRT/LineageOS/KOReader/Tasmota/ESPHome/etc., but I feel more confortable this way. I have more trust in a bunch of people doing this for o…

Newer TP-Links use broadcom chips which have no drivers on Linux, so it makes using openwrt basically impossible.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#63

Post by ttybird2 »

maxloh wrote: post #6

TP Link is a Chinese company. I won't trust them personally. In China's current political status, it is impossible for Chinese companies to reject the autocratic government's requests for surveillance. You may endup in jail or even get killed.

https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#64

Post by geokon »

danpalmer wrote: post #45
geokon wrote: post #33

Earlier quoted context omitted.

A perfect situation for Hanlon's razor... Is this stuff not par for the course? Everything hardware/embedded in my experience is like a decade or two behind the current norms for c/c++ programming. What I never understood from that audit, was this code quality unusual? I didn't get the sense they audit European and American companies - so sure they looked at the source and said "lol your code sucks" but there was no…

> A perfect situation for Hanlon's razor... I'm not at all suggesting that Huawei (or TP-Link, or anyone else) are actively attempting to subvert security systems or intentionally adding backdoors. In that sense it's probably right to conclude this is ignorance. The problem is that an attacker, especially those with the backing of a nation state, can trivially attack those insecure supply chains and install backdoors…

"But would it be significantly harder to do, easier to detect, and easier to resolve? Yes, and that makes them better suited to critical infrastructure. "

But like what is that conclusion based on?

I'm not saying you're wrong - just curious why you hold HP and Cisco in high esteem.

At least in terms of engineering talent I'd expect them to be much worse. Huawei is prolly the Google of China paying huge salaries and getting the county's top engineers (along with Alibaba). When I lived in Santa Barbara Cisco didn't have a good rep and they didn't pay well. A typical bureaucratic officespaceesque soul sucker. I don't know about HP but I don't get the sense it's a presitgious place to work either.

Again, these are very shaky ill informed judgments on my part I admit :) hence why I'm curious if you're talking from a position of knowledge on the subject

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#65

Post by lotsofpulp »

naoqj wrote: post #49
maxloh wrote: post #6

TP Link is a Chinese company. I won't trust them personally. In China's current political status, it is impossible for Chinese companies to reject the autocratic government's requests for surveillance. You may endup in jail or even get killed.

I mean, I get it, but Avira is a German company.

Avira’s bosses get their marching orders from NortonLifelock bosses, which seems to have pretty American leadership:

https://www.nortonlifelock.com/us/en/corporate-profile/manag...

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#66

Post by zrail »

mananaysiempre wrote: post #35
mise_en_place wrote: post #14

Earlier quoted context omitted.

You could also buy an SBC with a few network ports and use that as your router.

IME small ARM SBCs generally have a miserably slow bus arrangement for this sort of thing (and no hardware switch chip, of course). People have had some success with routers built on x86 mini-PCs[1], but these lean towards the “flexible and performant” side, not the cheap side. [1] https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...

I just built a relatively decked out router from eBay and Amazon parts for less than $300.

- used HP Elitedesk 800 G3 SFF (4 core i5-6500, 8GB ram, 240gb SSD, 4x PCIe slots) $170 shipped

- 2x new dual 2.5Gbe PCIe cards $40 each

- 1x used quad port Internet gigabit $30 shipped

So for $280 I have a machine that will route at 2.5Gbe for a few machines and gigabit for the rest of my network while using about 25 watts. If you don't need that many ports you can cut the cost down considerably with a smaller machine like a Prodesk 400 or 600.

I'm using VyOS but OpenWRT, Untangle, OPNsense or Sophos Home would also be perfectly fine choices.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#68

Post by zinekeller »

rfoo wrote: post #61
zinekeller wrote: post #42

Earlier quoted context omitted.

... and I don't get your point in this useless pedantry? Sure that the data in of itself is not sent, but you seemed to imply that DNS queries don't reveal anything. In practice, you can build a good enough picture to decode what's their interests, what type of places they visit etc., which is worrying of itself. It's like saying to not worry because they didn't know you ordered a Big Mac while the fact that you went…

I think the point is the original author did not prove anything was sent to Avira in this case. All they have is speculation that "the router is making DNS queries about a Avira safe things domain and the DNS query QPS is correlated to the amount of traffic in the network". I agree this is tremendously bad code, but what they observed could also be perfectly explained with "some stupid code doing a Avira subscription…

> I agree this is tremendously bad code, but what they observed could also be perfectly explained with "some stupid code doing a Avira subscription check whenever something arrives at the router and they do that without a cache for negative answer, and even if the feature is turned off".

I do wish that it is at least it's Google-like (https://developers.google.com/safe-browsing/v4/update-api) and I hope that it's simply just a bad code, but the simplest method to check if a domain is blacklisted is to simply send the domain - there's no hashing and canonisation to deal with. And before counterarguing, this already happened with Avast (https://www.howtogeek.com/199829/avast-antivirus-was-spying-...), so while I agree that a stronger evidence is needed at the same time I can definitely consider it a smoking gun.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#69

Post by m-p-3 »

alufers wrote: post #62
ajot wrote: post #8

That's before installing OpenWRT! This kind of shenanigans make (once again) the case for 3rd party post market FLOSS firmware to be installed on every device I own. Sure, I spend some extra time researching which router/AP/phone/ereader/smart appliance will be compatible with OpenWRT/LineageOS/KOReader/Tasmota/ESPHome/etc., but I feel more confortable this way. I have more trust in a bunch of people doing this for o…

Newer TP-Links use broadcom chips which have no drivers on Linux, so it makes using openwrt basically impossible.

The only reasonable choice here is to vote with our wallet and go with another company.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#70

Post by jmillikin »

This was alarming since I use a TP-Link router, so I tried figuring out to what extent it's able to inspect and record regular (encrypted) traffic.

My TP-Link Archer AX50, running software version "1.0.11 Build 20210730 rel.54485(4A50)" is doing at least some sort of DPI on outgoing connections. I found a page in its settings (Advanced -> Security -> Antivirus -> History) that contains a log of connections I've made to "suspicious" domains, which include quite a few that I would consider innocuous.

After clearing that log, I loaded a few domains I'd seen in it, and verified that new entries were created. Wireshark shows that no DNS requests were made, and the DNS-over-HTTP used by Chrome didn't leak that traffic. I believe the router must be inspecting TLS headers for the ServerName field.

Didn't try to verify whether that data is being sent to a third party, but given that this thing is collecting data that it has no business looking at, it wouldn't surprise me if it's shipping it somewhere.

edit: the URL I tested with is https://api.mangadex.org/docs.html>.

Post reply on HN