Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Newer TP-Link Routers send large volumes of requests to Avira servers

old.reddit.com

Post reply on HN
Print view View original

71–80 of 121 posts

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#71

Post by bostik »

danpalmer wrote: post #21
legalcorrection wrote: post #18

Earlier quoted context omitted.

Also a perfect environment to slip in back doors that look like mistakes.

Exactly, that was their point. I suspect there are a lot of software supply chains that are actually compromised, because it's just too easy when this is the standard of software engineering. It's easy to forget that git for example is not just a big "undo" button, it's a cryptographically secure audit log of all changes made, that allows you to know exactly what software you're actually shipping.

> cryptographically secure audit log of all changes made, that allows you to know exactly what software you're actually shipping.

To be pedantic: not quite.

Git is certainly a cryptographically secure audit log[ß] but it only tells you what the source code was that went _into_ the build at the time of checkout. You can subvert the process through malice (eg. Solar Winds), through incompetence (eg. off-tree "magic" patching as a build step), or through sheer negligence.

Reproducible and auditable builds are a much harder problem than source code provenance.

ß: from my previous job: once auditors understood what git is, they loved it. They, by their profession, love immutability. Failing that, they consider tamper-evidence a really good second-best.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#72

Post by YaBomm »

sebow wrote: post #40

TP-Link became a big no-go for me as soon as ax came out and I saw that they required account registration[0] for managing a personal, local router. Probably has to do with the fact that they're not western-owned and are 'legally required' to have such a system in order to be covered from 'borrowing' your data. I expect other vendors(Huawei,etc) to do the same, and it's insane that people don't revolt against such pr…

No post body was provided.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#73

Post by danpalmer »

servytor wrote: post #58
danpalmer wrote: post #2

I remember reading in the UK government's security assessment of Huawei that one of the issues is not necessarily data being sent to bad places or backdoors in the software, it's that the engineering processes behind these devices/software are completely unable to protect against any sort of supply chain attacks. The sorts of things they highlighted were: no version control, no code review, production builds happenin…

The UK has been indecisive about trusting Huawei [0 (sorry for the Daily Mail link),1,2,3]; I don't know why and find it very interesting. I am used to reading about nation states having an unwavering opinion, not flipping back and forth (unless because of political lines). They claim that their hand has been forced by the USA [4]. [0] https://www.dailymail.co.uk/news/article-7935905/MI5-MI6-GCH... [1] https://www.cn…

Yeah the actual position of the government is all over the place and it's all tied up in the politics of US/China relations.

I think the findings in the report are still a concrete assessment of Huawei's abilities that we can draw conclusions from about their product security.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#74

Post by sloshnmosh »

zinekeller wrote: post #24

Before you say anything about this feature (which is apparently called HomeCare, https://www.tp-link.com/homecare/ ), you should probably know that Asus also has a AiProtection feature powered by Trend Micro ( https://www.asus.com/content/aiprotection/ ) and D-Link having McAfee Secure Home Platform built-in ( https://www.dlink.com/en/latest-news/d-link-introduces-new-e... ). Definitely not vindicating TP-Link here (…

I came here to say the same. I even purchased a LAN throwing star to look to see if my Asus router was sending anything to TrendMicro but never did get around to it.

But I will now for sure.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#75

Post by webmobdev »

zinekeller wrote: post #24

Before you say anything about this feature (which is apparently called HomeCare, https://www.tp-link.com/homecare/ ), you should probably know that Asus also has a AiProtection feature powered by Trend Micro ( https://www.asus.com/content/aiprotection/ ) and D-Link having McAfee Secure Home Platform built-in ( https://www.dlink.com/en/latest-news/d-link-introduces-new-e... ). Definitely not vindicating TP-Link here (…

Damn. Seems like they have all "discovered" a new revenue model - harvest and sell user data to third-parties / data brokers.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#78

Post by danpalmer »

geokon wrote: post #64
danpalmer wrote: post #45

Earlier quoted context omitted.

> A perfect situation for Hanlon's razor... I'm not at all suggesting that Huawei (or TP-Link, or anyone else) are actively attempting to subvert security systems or intentionally adding backdoors. In that sense it's probably right to conclude this is ignorance. The problem is that an attacker, especially those with the backing of a nation state, can trivially attack those insecure supply chains and install backdoors…

"But would it be significantly harder to do, easier to detect, and easier to resolve? Yes, and that makes them better suited to critical infrastructure. " But like what is that conclusion based on? I'm not saying you're wrong - just curious why you hold HP and Cisco in high esteem. At least in terms of engineering talent I'd expect them to be much worse. Huawei is prolly the Google of China paying huge salaries and g…

> But like what is that conclusion based on?

It's based on a few assumptions, but ones I feel are reasonable to make. The fact these companies will have been audited in the same way, but that the concerns have not been raised (by government, industry, security consultants) suggests that these processes are very different.

Version control, code auditing, code review, reproducible builds, etc, those will all contribute to being able to protect against attackers.

You're right that there's a huge talent pool in China, and there is good engineering happening in China, but there are also cultural barriers to it in some places. The 9/9/6 working culture in Chinese tech companies optimises for throughput not quality, and the general impression I have from reading about internal engineering cultures at other Chinese tech companies aligns with the Huawei report.

I'm not speaking from a position of expertise, I am judging this and drawing my own conclusions, but I don't feel they are ill informed (nor do I think yours are). I'm confident in the facts I know, have evidence for my opinions, and have reason to believe my suspicions.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#79

Post by [deleted] »

zrail wrote: post #66
mananaysiempre wrote: post #35

Earlier quoted context omitted.

IME small ARM SBCs generally have a miserably slow bus arrangement for this sort of thing (and no hardware switch chip, of course). People have had some success with routers built on x86 mini-PCs[1], but these lean towards the “flexible and performant” side, not the cheap side. [1] https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...

I just built a relatively decked out router from eBay and Amazon parts for less than $300. - used HP Elitedesk 800 G3 SFF (4 core i5-6500, 8GB ram, 240gb SSD, 4x PCIe slots) $170 shipped - 2x new dual 2.5Gbe PCIe cards $40 each - 1x used quad port Internet gigabit $30 shipped So for $280 I have a machine that will route at 2.5Gbe for a few machines and gigabit for the rest of my network while using about 25 watts. If…

[deleted]

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#80

Post by danpalmer »

bostik wrote: post #71
danpalmer wrote: post #21

Earlier quoted context omitted.

Exactly, that was their point. I suspect there are a lot of software supply chains that are actually compromised, because it's just too easy when this is the standard of software engineering. It's easy to forget that git for example is not just a big "undo" button, it's a cryptographically secure audit log of all changes made, that allows you to know exactly what software you're actually shipping.

> cryptographically secure audit log of all changes made, that allows you to know exactly what software you're actually shipping. To be pedantic: not quite. Git is certainly a cryptographically secure audit log[ß] but it only tells you what the source code was that went _into_ the build at the time of checkout. You can subvert the process through malice (eg. Solar Winds), through incompetence (eg. off-tree "magic" pa…

Of course, I was simplifying this somewhat to make a point. I think git can be a significant part of the solution, but there's a lot more that goes into it.
Post reply on HN