Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

evilsocket.net

Post reply on HN
Print view View original

81–90 of 128 posts

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#81

Post by tapland »

realcul wrote: post #53
magmostafa wrote: post #49

This is exactly why network segmentation is critical for IoT devices. I always recommend putting all smart cameras and IoT devices on a separate VLAN with no direct internet access - only local network access through a firewall with strict egress rules. For anyone concerned about their TP-Link cameras, consider: 1. Disable UPnP on your router 2. Use VLANs to isolate IoT devices 3. Block all outbound traffic except sp…

do you happen to have a guide on how to achieve this - I am fairly technical but still configuring Vlans and moving devices there would be good with some step by step instructions.

P. Sure the camera in question breaks in fun ways. From my observations because it can’t update it’s time, so messing with it a bit leaving to a need to update, downgrade, block from the web again.

But it’s worth trying

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#83

Post by defraudbah »

sidewndr46 wrote: post #10
JaggedJax wrote: post #2

It's probably fair to assume that most of their other camera models are affected by the same or similar issues. It looks like they pump out quite a few models that I image have similar firmware. This page[1] lists the C200 as last having a firmware update in October, but also lists the latest version as 1.4.4 while the article lists 1.4.2. It seems like they have pushed other updated in this time, but not these secur…

I looked at some older Zyxel products and came to the same conclusion a while back. There's a whole industry of labeling generic hardware as being part of someone's else ecosystem https://www.hydrogen18.com/blog/hacking-zyxel-ip-cameras-pt-... https://www.hydrogen18.com/blog/hacking-zyxel-ip-cameras-pt-...

it's a stretch to call it generic hardware, all of cheap cameras use similar hardware, but every few months there is a new version of chip which you need to adjust to. It's challenging to find an exact chip if you want to, because they get out of date faster than JS frameworks

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#84

Post by defraudbah »

realcul wrote: post #53
magmostafa wrote: post #49

This is exactly why network segmentation is critical for IoT devices. I always recommend putting all smart cameras and IoT devices on a separate VLAN with no direct internet access - only local network access through a firewall with strict egress rules. For anyone concerned about their TP-Link cameras, consider: 1. Disable UPnP on your router 2. Use VLANs to isolate IoT devices 3. Block all outbound traffic except sp…

do you happen to have a guide on how to achieve this - I am fairly technical but still configuring Vlans and moving devices there would be good with some step by step instructions.

depends on your router, but you would want to stick to onvif or rtsp and connect to the camera using some sort of tailscale. Don't fail for installing open source firmware, there is only thingino and openipc, both are hard to install if you are a beginner, even if people say it's easy for technical specialist, it's not

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#85

Post by defraudbah »

tehlike wrote: post #24

Thingino supports C200 https://thingino.com/#:~:text=SC3336%2C%20WQ9001%2C%208MB-,T...

it does not, there are 5 versions of C200 as of now and thingino only supports one or two, it is very important to get the right chip, you can check https://openipc.org/

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#86

Post by defraudbah »

kqr wrote: post #80
inferiorhuman wrote: post #78

Earlier quoted context omitted.

I got a couple of Wyze cameras and loaded Thignino via SD card. No fuss no muss.

In this case I'm asking specifically about the C200 this article is about. Sorry for not being more clear. From what I understand the C200 does not boot from SD card.

correct, it's in beta testing right now, you can check for alternatives https://github.com/wltechblog/thingino-installers

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#87

Post by defraudbah »

reddalo wrote: post #69
tamimio wrote: post #42

Earlier quoted context omitted.

Per the article, the attacker can restart the camera and potentially find the accurate position of it. However, if the attacker can be physically in proximity within the camera range, they can MITM it and intercept the video feed. So it depends on your friend's threat model. If the camera is recording something in a public location and they don't mind the location being exposed and potentially the video feed (like pl…

> they can MITM it Can they? I thought they could only do it if they're in the same LAN.

the exploit is to make camera disconnect and connect to your wifi, that's how they MITM, pretty long process unless you do it often

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#88

Post by locknitpicker »

AceJohnny2 wrote: post #55
jabedude wrote: post #33

Earlier quoted context omitted.

I didn't notice a negative tone at all when he talked about the firmwares being publicly hosted. You did?

Yes, heavily, because of the use of adjectives and repeating the points. Here, I'll emphasize the words that elicit the tone: > After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No authentication required. So, you can list and download every version of every firmware they’ve ever released for any device they ever produced: [command…

> Highlighting (repeatedly) the ease and breadth of access is a basic writing technique to illustrate the weakness of a security system.

It's a firmware distribution system. It's read-only access to a public storage account designed to provide open access to software deployment packages that the company wishes to broadcast to all products. Of course there is no auth requirement at all. The system is designed to allow everyone in the world to install updates. What compells anyone to believe the system would be designed to prevent public access?

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#89

Post by locknitpicker »

hdgvhicv wrote: post #59
rao-v wrote: post #21

I'm a little frustrated with articles like this that scattershot their critique by conflating genuine failures with problems that even FAANGs struggle with. In particular, I don't love it when an article attacks a best practice as a cheap gotcha: "and this time it was super easy! After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No…

> I found out that TP-Link have their entire firmware repository in an open S3 bucket. Nobody tell them about Linux!

> Nobody tell them about Linux!

The blogger will blow a gasket when they discover that the likes of GitHub provides access to both installers and software. A hacker's candy store!

Re: TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy

#90

Post by locknitpicker »

wkat4242 wrote: post #75
opello wrote: post #72

Earlier quoted context omitted.

I think it fails to be objective because of the repetition. It's an open S3 bucket. No need to state that no authentication was required, it's already open. It's not about economy of writing but the repetition emphasizes the point, elevating the perceived significance to the author or that the author wants the reader to take away. Furthermore, the repeated use of every when discussing the breadth of access seems like…

An 'open S3 bucket' sounds really bad. If it were posted on an HTTPS site without authentication, like the firmware for most devices, it wouldn't sound so bad. Sure an open bucket is bad, if it's stuff you weren't planning on sharing with the whole world anyway.

> An 'open S3 bucket' sounds really bad.

Only to gullible, clueless types.

Full blown production SPAs are served straight from public access S3 buckets. The only hard requirement is that the S3 bucket enforces read-only access through HTTPS. That's it.

Let's flip it the other way around and make it a thought experiment: what requirement do you think you're fulfilling by enforcing any sort of access restriction?

When you feel compelled to shit on a design trait, the very least you should do is spend a couple of minutes thinking about what problem it solves and what are the constraints.

Post reply on HN