Nothing in your analysis shows this. Moreover unless you explicitly deployed a root certificate on your clients (or if an app on the client did it), the router can't decode TLS traffic (deep inspection) without you getting certificate warnings on the client. In that case, the only thing the router can see is the dns request, the IP and the TLS SNI. In short your title is misleading.
permalinkembedsavereportreply [–]ArmoredCavalry[S] 11 points 14 hours ago*
I agree they couldn't be inspecting the contents of your traffic over TLS, but they could easily view destinations. I also agree, there's nothing in my analysis that proves that all the requests are related to network traffic. However, if you look at the wording of the reply (directly from TP-Link) to XDA in their review, I don't see how it could be interpreted any other way? Regardless, I probably should have made my title "appears that it may send traffic related data". I'll be happy if that isn't the case, but the lack of clear explanation from TP-Link when I've contacted support leads me to assume the worst
permalinkembedsaveparentreportreply [–]2fast2fourier 4 points 12 hours ago I think it's best not to write something that damaging without proof, especially when most people only read titles. Saying they're sending metadata and violating your privacy is all you'd need to hear.
I agree this is tremendously bad code, but what they observed could also be perfectly explained with "some stupid code doing a Avira subscription check whenever something arrives at the router and they do that without a cache for negative answer, and even if the feature is turned off".
So we need more evidence.
If I’m reading this correctly, it’s not sending every password and username it discovers.
It’s invasive but not to the point of being a complete set of malware.
Let's be careful to not normalize this type of data exfiltration from equipment that's supposed to be yours.
The sorts of things they highlighted were: no version control, no code review, production builds happening on arbitrary machines, no automated testing, poor access control on code, no audit trail on code changes, the list goes on, and that's just for the software side. The conclusion was that Huawei were about a decade away from being able to even claim they had no backdoors. And that's a major telecoms hardware provider, trying to sell into governments and major infrastructure projects.
I'm not in the least bit surprised that TP-Link are doing this, and also not at all surprised that when questioned on it they are (so far) unable to actually describe why it's happening or really seem to know anything about it.
I think this sort of product is built in a very different environment to what most HN users would expect.
This kind of shenanigans make (once again) the case for 3rd party post market FLOSS firmware to be installed on every device I own. Sure, I spend some extra time researching which router/AP/phone/ereader/smart appliance will be compatible with OpenWRT/LineageOS/KOReader/Tasmota/ESPHome/etc., but I feel more confortable this way. I have more trust in a bunch of people doing this for owning their devices than some corporation whose goals clearly don't align with mine.
[1] https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-bui...
And realistically, most of the extended features on consumer routers are ineffective at best and network-destroying in typical cases.
For example, I've never used a router ever turning on QOS did anything but trash network performance.
I use and recommend Asus routers because in spite of them being shitpiles when you turn on anything but the basic functionality, the industry standard is that low that consistently good basic functionality is a stand out success.
The router industry makes printer companies look like Apple.
But I will now for sure.
[0] Edit: An online account for the mobile application, not the web interface of the router itself.
My TP-Link Archer AX50, running software version "1.0.11 Build 20210730 rel.54485(4A50)" is doing at least some sort of DPI on outgoing connections. I found a page in its settings (Advanced -> Security -> Antivirus -> History) that contains a log of connections I've made to "suspicious" domains, which include quite a few that I would consider innocuous.
After clearing that log, I loaded a few domains I'd seen in it, and verified that new entries were created. Wireshark shows that no DNS requests were made, and the DNS-over-HTTP used by Chrome didn't leak that traffic. I believe the router must be inspecting TLS headers for the ServerName field.
Didn't try to verify whether that data is being sent to a third party, but given that this thing is collecting data that it has no business looking at, it wouldn't surprise me if it's shipping it somewhere.
edit: the URL I tested with is <https://api.mangadex.org/docs.html>.
In this case the site I tested with had a few different subdomains backed by the same IP, which I verified from a remote VPS. Using `curl` locally, with the `--resolve` flag to bypass DNS resolution, caused the router's log to contain entries for the specific subdomains requested.
Joking ofc, this is pretty bad. Terrible coding in the best case, outright spying in the worst. Neither instills a lot of confidence in TP-link.
https://www.draytek.co.uk/products/business/vigor-130
“The DrayTek Vigor 130 is a VDSL2 and ADSL modem with an Ethernet connection; it is not a router but a true ADSL/VDSL Ethernet Modem (bridge).”
For example, what wireless access points are compatible with an openbsd router/firewall? I’ll admit that my initial searches were short but only finding results about wireless chipsets to use in the router were frustrating (I guess if I wanted to build my own access points that information would be valuable).
I do this and use apu2d4 as hardware
My solution is running those devices as a Wi-Fi to LAN bridge, also setup my own NAT gateway (by bare-metal Linux, Openwrt... etc). Then blocking there devices from accessing Internet at gateway.
If I have more IoT devices at home, I will apply such policy to all of them.
[0] https://i.reddit.com/r/hardware/comments/tbthjj/psa_newer_tp...
When it comes to budget routers I still turn to TP-Links when I can easily find a decent model on the market that is supported by openwrt.
In China's current political status, it is impossible for Chinese companies to reject the autocratic government's requests for surveillance. You may endup in jail or even get killed.
Thus, I would prefer the US to China in this regard.
Statistically, you very likely own a Chinese manufactured router while using it to tell others here not to do the same.
It would be highly interesting if there would be a website where you could type in the name of a product (e.g. sime Cisco) router and it would give you a detailed decomposition of where and by whom is parts where made. Something like (highly simplified) : - CPU design: Company X - CPU manufacturing: Company - RAM design and manufacturing: Company Z - Overall remaining logic: Cisco
https://www.nortonlifelock.com/us/en/corporate-profile/manag...
It would be nice if the US took import controls as seriously as export controls.
My goal was to silence its network activity when I wasn't using it. One by one I removed APKs and blackholed IPs and domains, starting with everything from Google. I was disturbed to discover that, even having nothing installed and everything ripped out that I could, once every week or two while sitting untouched it would phone home to an IP address in China that I failed to connect to any software on the phone and whose IP WHOIS made no sense. I asked Planet Computers about it and they had no idea.
[0] https://www.dailymail.co.uk/news/article-7935905/MI5-MI6-GCH...
[1] https://www.cnbc.com/2019/10/09/former-uk-spymaster-john-saw...
[2] https://www.reuters.com/article/us-britain-huawei-tech-five-...
[3] https://www.ft.com/content/90c07bbe-38ce-11e9-b856-5404d3811...
[4] https://www.euractiv.com/section/politics/short_news/uk-bann...
the government was resistant to the US' position until the CCP's crackdown on hong kong, at which point they reversed their position
I think the findings in the report are still a concrete assessment of Huawei's abilities that we can draw conclusions from about their product security.
Is this stuff not par for the course? Everything hardware/embedded in my experience is like a decade or two behind the current norms for c/c++ programming. What I never understood from that audit, was this code quality unusual? I didn't get the sense they audit European and American companies - so sure they looked at the source and said "lol your code sucks" but there was no baseline for comparison
But it sounds like you know the situation better - maybe you have better context. I've been curious to know from someone more familiar with the subject
I'm not at all suggesting that Huawei (or TP-Link, or anyone else) are actively attempting to subvert security systems or intentionally adding backdoors. In that sense it's probably right to conclude this is ignorance.
The problem is that an attacker, especially those with the backing of a nation state, can trivially attack those insecure supply chains and install backdoors or data exfiltration.
As for whether others are as bad, I think the sort of audit that was done on Huawei is done for other companies attempting to sell into that level. These audits are not really about looking at the code – sometimes they do, but you're never going to get a useful security audit of 10s-100s of millions of lines of code. They're more about the security posture of these companies, and in that way, Huawei failed.
I do expect that Cisco, HP, other network hardware vendors are better at this. Do they still have crap code? Sure. Do they still have security vulnerabilities? Of course. Could a nation state still get a backdoor in? Probably. But would it be significantly harder to do, easier to detect, and easier to resolve? Yes, and that makes them better suited to critical infrastructure.
It's easy to forget that git for example is not just a big "undo" button, it's a cryptographically secure audit log of all changes made, that allows you to know exactly what software you're actually shipping.
In the forums [0](Discourse alert) you have many threads with suggestions, too!
[0] https://forum.openwrt.org/c/hardware-questions-and-recommend...
https://www.linksys.com/nz/wireless-routers/wrt-wireless-rou...
The WRT1200AC family for example does not support WPA3, because the closed source Wifi firmware does not support it. The 15 years old WRT54G supports WPA3, it is just very slow. ;-)
Currently I would suggest the Linksys E8450 / Belkin RT3200 (same hardware) or some other device using the current Mediatek platform with MT7622 + MT7915 + MT7531. (2 X Cortex-A53, Wifi 6) All chips are supported in recent upstream Linux kernel, including Wifi. The Mediatek router team is currently doing pretty good upstream open source work for their chips.
I own an Omnia and despite it having been a bit rough a few years ago, it's now nearly flawless. The MOX is modular and could be more interesting for your use-case but it can also get pretty expensive.
Full disclosure, I have never built the firmware but I take great comfort that it is developed in an open source manner, and that I could build it if I wanted to.
I do wish that it is at least it's Google-like (https://developers.google.com/safe-browsing/v4/update-api) and I hope that it's simply just a bad code, but the simplest method to check if a domain is blacklisted is to simply send the domain - there's no hashing and canonisation to deal with. And before counterarguing, this already happened with Avast (https://www.howtogeek.com/199829/avast-antivirus-was-spying-...), so while I agree that a stronger evidence is needed at the same time I can definitely consider it a smoking gun.
You shouldn't imply that OpenWRT is in any way bloated.
The kind of hardware that doesn't have enough RAM or storage for OpenWRT is truly pathetic. Those devices don't have enough CPU power to route traffic at reasonable speeds, their WiFi radios are so outdated that operating them in a crowded 2.4GHz band is an obscene waste of airtime, and even with the manufacturer's firmware those devices usually can't support features like IPv6. A router that old is usually only worth using as a managed Ethernet switch, if it even supports gigE.
https://www.apple.com/supplier-responsibility/pdf/Apple-Supp...
https://www.cisco.com/c/dam/en_us/about/supply-chain/cisco-s...
I'm still happy with OpenWRT on my WNDR3800 for now either way.
DSL standalone termination is still widely available, as are standalone DOCSIS cable modems.
If you want a dedicated OpenWRT device Mikrotik would be my suggestion.
To be pedantic: not quite.
Git is certainly a cryptographically secure audit log[ß] but it only tells you what the source code was that went _into_ the build at the time of checkout. You can subvert the process through malice (eg. Solar Winds), through incompetence (eg. off-tree "magic" patching as a build step), or through sheer negligence.
Reproducible and auditable builds are a much harder problem than source code provenance.
ß: from my previous job: once auditors understood what git is, they loved it. They, by their profession, love immutability. Failing that, they consider tamper-evidence a really good second-best.
But uBlock origin and PiHole both do CNAME inspection to block this.
Is there other ways that ads are circumventing DNS ad-blockers such as PiHole?
But like what is that conclusion based on?
I'm not saying you're wrong - just curious why you hold HP and Cisco in high esteem.
At least in terms of engineering talent I'd expect them to be much worse. Huawei is prolly the Google of China paying huge salaries and getting the county's top engineers (along with Alibaba). When I lived in Santa Barbara Cisco didn't have a good rep and they didn't pay well. A typical bureaucratic officespaceesque soul sucker. I don't know about HP but I don't get the sense it's a presitgious place to work either.
Again, these are very shaky ill informed judgments on my part I admit :) hence why I'm curious if you're talking from a position of knowledge on the subject
It's based on a few assumptions, but ones I feel are reasonable to make. The fact these companies will have been audited in the same way, but that the concerns have not been raised (by government, industry, security consultants) suggests that these processes are very different.
Version control, code auditing, code review, reproducible builds, etc, those will all contribute to being able to protect against attackers.
You're right that there's a huge talent pool in China, and there is good engineering happening in China, but there are also cultural barriers to it in some places. The 9/9/6 working culture in Chinese tech companies optimises for throughput not quality, and the general impression I have from reading about internal engineering cultures at other Chinese tech companies aligns with the Huawei report.
I'm not speaking from a position of expertise, I am judging this and drawing my own conclusions, but I don't feel they are ill informed (nor do I think yours are). I'm confident in the facts I know, have evidence for my opinions, and have reason to believe my suspicions.
Have they? Are you sure? The Huawei audit were not a routine audit. According to Wired it was done by the special British "Huawei Cyber Security Evaluation Centre". I can't find any evidence the UK National Cyber Security Centre has done the same with Cisco or HP.
> am judging this and drawing my own conclusions, but I don't feel they are ill informed (nor do I think yours are)
The difference between us is that I definitely think MY conclusions are ill informed. Hope someone who knows what they're talking about can chime in
- used HP Elitedesk 800 G3 SFF (4 core i5-6500, 8GB ram, 240gb SSD, 4x PCIe slots) $170 shipped
- 2x new dual 2.5Gbe PCIe cards $40 each
- 1x used quad port Internet gigabit $30 shipped
So for $280 I have a machine that will route at 2.5Gbe for a few machines and gigabit for the rest of my network while using about 25 watts. If you don't need that many ports you can cut the cost down considerably with a smaller machine like a Prodesk 400 or 600.
I'm using VyOS but OpenWRT, Untangle, OPNsense or Sophos Home would also be perfectly fine choices.
The measured average power over 24 hours is around 12 to 13 W. The idle power is under 10 W and the maximum power consumption can be up to 60 W, but even a large number of active network services, e.g. firewall, e-mail server, Web server and Web proxy, DNS server and DNS proxy, NTP server and so on, require just a power consumption not much above the idle level.
I assume that a NUC-like computer with a Jasper Lake CPU should have an average power consumption under 10 W. At least with Intel or AMD CPUs and associated peripherals you do not have to worry about software compatibility.
There is also a router board for a CM4 module that adds a second nic through PCIe.[2] The nics still aren't super nice but they are more than good enough for a home router.
The problem is that you can't actually buy a Raspberry Pi right now due to supply chain issues, and that may not change for a while.
[1] https://forum.openwrt.org/t/rpi4-routing-performance-numbers...