61–70 of 128 posts
>25000 devices exposed directly How does this happen? Doesn’t pretty much every ISP give a router with their modem? How do people manage this?
In IPv6 they likely will auto configure onto a public ip address which may not have a stateful firewall.
As soon as i read the author used grok as an ai assistant, i was somehow less interested to keep on reading. Not because of the usage of ai, but the chosen provider. (I don’t know whether grok is just the best choice for this kind of work.) Is it wrong to judge people for their choice of ai providers?
I think it's hard to say. Grok is pretty good and also fairly free with good usage limits. Every single AI company in my opinion is committing fairly grave misdeeds with the ruthless scraping of the internet and lack of oversight. Not to mention the shady backdoor deals going on with big tech and the current administration. Grok is also pretty bad with its whole gas turbines in one state and datacenter in another and…
But doesn't it need to have such free usage in order to overcome image problems? Referring to itself as a Nazi [1][2] for example.
[1] https://www.npr.org/2025/07/09/nx-s1-5462609/grok-elon-musk-...
[2] https://www.politico.com/news/magazine/2025/07/10/musk-grok-...
I'm a little frustrated with articles like this that scattershot their critique by conflating genuine failures with problems that even FAANGs struggle with. In particular, I don't love it when an article attacks a best practice as a cheap gotcha: "and this time it was super easy! After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No…
Edit: just want to add, the “how I got the firmware” part of this is also the least interesting part of this particular story.
Earlier quoted context omitted.
I didn't notice a negative tone at all when he talked about the firmwares being publicly hosted. You did?
Yes, heavily, because of the use of adjectives and repeating the points. Here, I'll emphasize the words that elicit the tone: > After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No authentication required. So, you can list and download every version of every firmware they’ve ever released for any device they ever produced: [command…
Replace [firmware] with [random popular GitHub repo] and nobody would blink. Replace [firmware] with [customer email address] and it would be a legal case. Differentiating here is important.
I'm a little frustrated with articles like this that scattershot their critique by conflating genuine failures with problems that even FAANGs struggle with. In particular, I don't love it when an article attacks a best practice as a cheap gotcha: "and this time it was super easy! After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No…
I think this kind of critique often leans too hard on “security through obscurity” as a cheap punchline, without acknowledging that real systems are layered, pragmatic, and operated by humans with varying skill levels. An open firmware repository, by itself, is not a failure. In many cases it is the opposite: transparency that allows scrutiny, reproducibility, and faster remediation. The real risk is not that attacke…
This is exactly why network segmentation is critical for IoT devices. I always recommend putting all smart cameras and IoT devices on a separate VLAN with no direct internet access - only local network access through a firewall with strict egress rules. For anyone concerned about their TP-Link cameras, consider: 1. Disable UPnP on your router 2. Use VLANs to isolate IoT devices 3. Block all outbound traffic except sp…
A friend once asked me to do some pen-testing on a machine he was running on his home network. He said I'd need to come round to his house to do this as he didn't want to provide access to the machine via the Internet. Fair enough. When he opened his front door the conversation went something like this: Him: "Ah hello, thanks for coming round to do this. It should be fun, come in and we can get started." Me: "OK, but…
This is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities? There must be many millions sold. Quite handy for some intel agencies. I assume any Wi-Fi camera under $150 has basically the same problems. I guess the only way to run a security camera where you don't have Ethernet is to use a non-proprietary Wi-Fi 10…
> This is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities? The camera sells for $17.99 on their website right now. Subtract out the cost of the hardware, the box, warehousing, transit to the warehouse, assembly, testing, returns, lost shipments, warranty replacements, support staff, and everything else, then…
If a friend have this camera, shuld he be worried?
Per the article, the attacker can restart the camera and potentially find the accurate position of it. However, if the attacker can be physically in proximity within the camera range, they can MITM it and intercept the video feed. So it depends on your friend's threat model. If the camera is recording something in a public location and they don't mind the location being exposed and potentially the video feed (like pl…
Can they? I thought they could only do it if they're in the same LAN.
This is exactly why network segmentation is critical for IoT devices. I always recommend putting all smart cameras and IoT devices on a separate VLAN with no direct internet access - only local network access through a firewall with strict egress rules. For anyone concerned about their TP-Link cameras, consider: 1. Disable UPnP on your router 2. Use VLANs to isolate IoT devices 3. Block all outbound traffic except sp…
A friend once asked me to do some pen-testing on a machine he was running on his home network. He said I'd need to come round to his house to do this as he didn't want to provide access to the machine via the Internet. Fair enough. When he opened his front door the conversation went something like this: Him: "Ah hello, thanks for coming round to do this. It should be fun, come in and we can get started." Me: "OK, but…