Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Newer TP-Link Routers send large volumes of requests to Avira servers

old.reddit.com

Post reply on HN
Print view View original

91–100 of 121 posts

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#91

Post by jmillikin »

t0mas88 wrote: post #83
jmillikin wrote: post #70

This was alarming since I use a TP-Link router, so I tried figuring out to what extent it's able to inspect and record regular (encrypted) traffic. My TP-Link Archer AX50, running software version "1.0.11 Build 20210730 rel.54485(4A50)" is doing at least some sort of DPI on outgoing connections. I found a page in its settings (Advanced -> Security -> Antivirus -> History) that contains a log of connections I've made…

It could be doing reverse lookup on the IP you connected to? That's what a lot of network monitoring tools do.

That's not as common any more, due to the broad adoption of TLS-capable CDNs (Cloudflare, Fastly, etc) over the past ~10 years.

In this case the site I tested with had a few different subdomains backed by the same IP, which I verified from a remote VPS. Using `curl` locally, with the `--resolve` flag to bypass DNS resolution, caused the router's log to contain entries for the specific subdomains requested.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#93

Post by user3939382 »

danpalmer wrote: post #2

I remember reading in the UK government's security assessment of Huawei that one of the issues is not necessarily data being sent to bad places or backdoors in the software, it's that the engineering processes behind these devices/software are completely unable to protect against any sort of supply chain attacks. The sorts of things they highlighted were: no version control, no code review, production builds happenin…

I had/have a Gemini (Android) from Planet Computers. I disabled wifi and forced its network connections through an ethernet adapter that I connected to a mirror port->wireshark and through a proxy after putting in my own root certificates.

My goal was to silence its network activity when I wasn't using it. One by one I removed APKs and blackholed IPs and domains, starting with everything from Google. I was disturbed to discover that, even having nothing installed and everything ripped out that I could, once every week or two while sitting untouched it would phone home to an IP address in China that I failed to connect to any software on the phone and whose IP WHOIS made no sense. I asked Planet Computers about it and they had no idea.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#94

Post by leguminous »

mananaysiempre wrote: post #35
mise_en_place wrote: post #14

Earlier quoted context omitted.

You could also buy an SBC with a few network ports and use that as your router.

IME small ARM SBCs generally have a miserably slow bus arrangement for this sort of thing (and no hardware switch chip, of course). People have had some success with routers built on x86 mini-PCs[1], but these lean towards the “flexible and performant” side, not the cheap side. [1] https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...

A Raspberry Pi 4 can route at gigabit speeds, even with a USB3 nic.[1]

There is also a router board for a CM4 module that adds a second nic through PCIe.[2] The nics still aren't super nice but they are more than good enough for a home router.

The problem is that you can't actually buy a Raspberry Pi right now due to supply chain issues, and that may not change for a while.

[1] https://forum.openwrt.org/t/rpi4-routing-performance-numbers...

[2] https://www.dfrobot.com/product-2242.html

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#95

Post by adrian_b »

blibble wrote: post #88
zrail wrote: post #66

Earlier quoted context omitted.

I just built a relatively decked out router from eBay and Amazon parts for less than $300. - used HP Elitedesk 800 G3 SFF (4 core i5-6500, 8GB ram, 240gb SSD, 4x PCIe slots) $170 shipped - 2x new dual 2.5Gbe PCIe cards $40 each - 1x used quad port Internet gigabit $30 shipped So for $280 I have a machine that will route at 2.5Gbe for a few machines and gigabit for the rest of my network while using about 25 watts. If…

I am very much interested in building my own router in a similar way, but 25W is still about 5x as much power as something like a mikrotik

I am using an older Intel NUC with a Coffee Lake U CPU, together with 4 USB Ethernet adapters, to increase the number of Ethernet ports to 5.

The measured average power over 24 hours is around 12 to 13 W. The idle power is under 10 W and the maximum power consumption can be up to 60 W, but even a large number of active network services, e.g. firewall, e-mail server, Web server and Web proxy, DNS server and DNS proxy, NTP server and so on, require just a power consumption not much above the idle level.

I assume that a NUC-like computer with a Jasper Lake CPU should have an average power consumption under 10 W. At least with Intel or AMD CPUs and associated peripherals you do not have to worry about software compatibility.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#96

Post by _wldu »

danpalmer wrote: post #2

I remember reading in the UK government's security assessment of Huawei that one of the issues is not necessarily data being sent to bad places or backdoors in the software, it's that the engineering processes behind these devices/software are completely unable to protect against any sort of supply chain attacks. The sorts of things they highlighted were: no version control, no code review, production builds happenin…

I find it hard to believe that Huawei does not use version control. No company is perfect, but surely software developers (at a multinational company) with advanced degrees in CS and ECE are using version control.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#97

Post by Kiro »

29083011397778 wrote: post #77
Kiro wrote: post #38

Readable link on mobile: https://www.reddit.com/r/hardware/comments/tbthjj/psa_newer_...

Should be [0] for mobile [0] https://i.reddit.com/r/hardware/comments/tbthjj/psa_newer_tp...

I personally prefer the regular mobile view.

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#98

Post by sloshnmosh »

Gigachad wrote: post #39
quotha wrote: post #29

Earlier quoted context omitted.

How do you plan on blocking ad servers with DoH?

With ublock origin. DNS level ad blocking is rubbish and mostly circumvented by providers now.

I heard that ads were able to circumvent DNS by using canonical names.

But uBlock origin and PiHole both do CNAME inspection to block this.

Is there other ways that ads are circumventing DNS ad-blockers such as PiHole?

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#99

Post by geokon »

danpalmer wrote: post #78
geokon wrote: post #64

Earlier quoted context omitted.

"But would it be significantly harder to do, easier to detect, and easier to resolve? Yes, and that makes them better suited to critical infrastructure. " But like what is that conclusion based on? I'm not saying you're wrong - just curious why you hold HP and Cisco in high esteem. At least in terms of engineering talent I'd expect them to be much worse. Huawei is prolly the Google of China paying huge salaries and g…

> But like what is that conclusion based on? It's based on a few assumptions, but ones I feel are reasonable to make. The fact these companies will have been audited in the same way, but that the concerns have not been raised (by government, industry, security consultants) suggests that these processes are very different. Version control, code auditing, code review, reproducible builds, etc, those will all contribute…

"The fact these companies will have been audited in the same way .."

Have they? Are you sure? The Huawei audit were not a routine audit. According to Wired it was done by the special British "Huawei Cyber Security Evaluation Centre". I can't find any evidence the UK National Cyber Security Centre has done the same with Cisco or HP.

> am judging this and drawing my own conclusions, but I don't feel they are ill informed (nor do I think yours are)

The difference between us is that I definitely think MY conclusions are ill informed. Hope someone who knows what they're talking about can chime in

Re: Newer TP-Link Routers send large volumes of requests to Avira servers

#100

Post by bannedbybros »

irutirw222 wrote: post #32
rlpb wrote: post #26

Earlier quoted context omitted.

This is true of the US too: https://en.m.wikipedia.org/wiki/United_States_Foreign_Intell...

Only partially: Rejecting the request won't get you killed. You also have the option to close your company to avoid jail, see https://en.m.wikipedia.org/wiki/Lavabit as a good case study. Thus, I would prefer the US to China in this regard.

No post body was provided.
Post reply on HN