91–100 of 128 posts
Earlier quoted context omitted.
I got a couple of Wyze cameras and loaded Thignino via SD card. No fuss no muss.
In this case I'm asking specifically about the C200 this article is about. Sorry for not being more clear. From what I understand the C200 does not boot from SD card.
This is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities? There must be many millions sold. Quite handy for some intel agencies. I assume any Wi-Fi camera under $150 has basically the same problems. I guess the only way to run a security camera where you don't have Ethernet is to use a non-proprietary Wi-Fi 10…
> This is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities? The camera sells for $17.99 on their website right now. Subtract out the cost of the hardware, the box, warehousing, transit to the warehouse, assembly, testing, returns, lost shipments, warranty replacements, support staff, and everything else, then…
The parent rightly suggested that there is the obvious intention to exploit these devices:
> This is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities?
You explained that there could be an economic reason for the appalling absence of security:
> The only way these ultra-cheap products are getting shipped at these prices is by doing the absolute bare minimum of software development.
But the parent's point is more convincing, based on the observable evidence and the very clear patterns of state-sponsored exploitation.
The vendors could set default passwords to be robust. The vendors could configure defaults to block upstream access. But maybe the vendors in this particular supply chain are more like the purveyors of shovels in a Gold Rush.
A less-charitable metaphor is possible where state-sponsored motives are unambiguously known.
Earlier quoted context omitted.
To me the phrasing seems objective. Making your binaries available to the public is good (though source would be better). Replace [firmware] with [random popular GitHub repo] and nobody would blink. Replace [firmware] with [customer email address] and it would be a legal case. Differentiating here is important.
I think it fails to be objective because of the repetition. It's an open S3 bucket. No need to state that no authentication was required, it's already open. It's not about economy of writing but the repetition emphasizes the point, elevating the perceived significance to the author or that the author wants the reader to take away. Furthermore, the repeated use of every when discussing the breadth of access seems like…
Earlier quoted context omitted.
A friend once asked me to do some pen-testing on a machine he was running on his home network. He said I'd need to come round to his house to do this as he didn't want to provide access to the machine via the Internet. Fair enough. When he opened his front door the conversation went something like this: Him: "Ah hello, thanks for coming round to do this. It should be fun, come in and we can get started." Me: "OK, but…
enforcing 802.1x on switch is also good solution, especially for "external" ports.
[1]. https://www.defcon.org/images/defcon-19/dc-19-presentations/...
Earlier quoted context omitted.
I didn't notice a negative tone at all when he talked about the firmwares being publicly hosted. You did?
Yes, heavily, because of the use of adjectives and repeating the points. Here, I'll emphasize the words that elicit the tone: > After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No authentication required. So, you can list and download every version of every firmware they’ve ever released for any device they ever produced: [command…
I'm a little frustrated with articles like this that scattershot their critique by conflating genuine failures with problems that even FAANGs struggle with. In particular, I don't love it when an article attacks a best practice as a cheap gotcha: "and this time it was super easy! After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No…
Not a bad blogpost because of this, but you need to be careful reading. I've noticed most of the article on the HN front page are written with AI assistance.
Earlier quoted context omitted.
Yes, heavily, because of the use of adjectives and repeating the points. Here, I'll emphasize the words that elicit the tone: > After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No authentication required. So, you can list and download every version of every firmware they’ve ever released for any device they ever produced: [command…
> Highlighting (repeatedly) the ease and breadth of access is a basic writing technique to illustrate the weakness of a security system. It's a firmware distribution system. It's read-only access to a public storage account designed to provide open access to software deployment packages that the company wishes to broadcast to all products. Of course there is no auth requirement at all. The system is designed to allow…
Earlier quoted context omitted.
> Highlighting (repeatedly) the ease and breadth of access is a basic writing technique to illustrate the weakness of a security system. It's a firmware distribution system. It's read-only access to a public storage account designed to provide open access to software deployment packages that the company wishes to broadcast to all products. Of course there is no auth requirement at all. The system is designed to allow…
Maybe listing shouldn't be enabled even if all the files are public.
Earlier quoted context omitted.
I didn't notice a negative tone at all when he talked about the firmwares being publicly hosted. You did?
Yes, heavily, because of the use of adjectives and repeating the points. Here, I'll emphasize the words that elicit the tone: > After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No authentication required. So, you can list and download every version of every firmware they’ve ever released for any device they ever produced: [command…
Earlier quoted context omitted.
enforcing 802.1x on switch is also good solution, especially for "external" ports.
802.1x is quite trivial to bypass if you have an authenticated device (in this case the intercom) that you can transparently bridge[1]. [1]. https://www.defcon.org/images/defcon-19/dc-19-presentations/...
802.1x is commonly deployed with macsec. will it be also trivial to bypass ?