- cross-posted to:
- technology@beehaw.org
- cross-posted to:
- technology@beehaw.org
TP-link is reportedly being investigated over national security concerns linked to vulnerabilities in its very popular routers.
You must log in or register to comment.
When your router’s chips are made in China, flashed in China with closed source firmware and the money you pay goes to Chinese companies, then it’s backdoored.
When your router’s chips are made in China, flashed in China with closed source firmware and the money you pay goes to American companies, it’s bulletproof.
Just open your “secure” “American” router and look where they are made and flashed. I bet it’s not USA.
Joe Biden has turned out to be the most fascist president in recent memory. He even supports fascism abroad. When a president supports a country that blocks a certain denomination of religion, bans a whole language, and bans political parties, using Nazee propaganda as a recruitment marketing, while having no democracy. What can you say? Then he supports ethnic cleansing to make Lebensraum for another ethnic group. What a sick man this chap is and completely incompetent. Now he is banning things made by Chinese people, if that isn’t racist, I don’t know what is. The only thing he is exceptional at is getting others killed. Good riddance. One thing for sure, there will be no justice.
Want to elaborate on those claims?
Are you saying I am lying?
No, we’re saying we need more explanation for the things you’ve listed. I can’t connect them to anything I’ve heard off the top of my head.
I can’t connect them to anything I’ve heard off the top of my head.
Funny you should say that. They want you to hear what they want you to hear. At least not presented as front page news. Why does the US occupy Syria and have control of its oil fields? Because it is a weak country, and the US can do those things because it is a powerful country. Don’t say it is because of terrorism, because of the irony. This is just one example of a pattern.
Bro, stop spouting off about unrelated things and explain the ones you mentioned in first comment already. You’re just making yourself look unhinged at this point.
You mean like Israel has leaders that are wanted by the ICC, and the US supports, and funds their government? FYI, the ICC is the International Criminal Court. How is it that the US can fund and support a leader who is accused of war crimes by international institutions? Where are the sanctions against these leaders? Calling people with facts unhinged shows you have a condescending attitude. It is a mark of your character. You think you can win an argument by exuding superiority, and yelling louder. Facts show the true state of things. I don’t bother with such people.
What the hell are you taking about? Get out of your bubble.
Wait until they hear where all electronics come from. Are they gonna ban Apple?
If that happens and the factory layoffs come, those nets are gonna be full
Apple has been slowly shifting production to India for years now, and the software is made domestically.
More importantly, the hardware is designed and inspected by Apple’s engineers. Security vulnerabilities would be Apple’s failure regardless of the origin of the parts.
I am from India actually, long way to go honestly.
Also Vietnam, there is a lot of Apple hardware made there now.
Running OpenWRT is generally a good idea. I’m not gonna lie and say it’s easy to setup. But it’s worth it.
It’s a good idea, but there’s going to be firmware at lower levels (roughly the BIOS) that could still be compromised. It’s best to just not buy Chinese hardware designed and manufactured by a Chinese company with no western involvement when you can avoid it.
This didn’t even occur to me when I bought my new router recently. I just went with one of the best-reviewed models that had all the features and speed I needed.
Did you get a TP Link?
Last time I was in the market, they were a top pick.
Sure did. The Archer BE1100 Pro.
Out of curiosity, what would happen with older models. Also other devices, like I don’t have a TPlink router but I do have a TPlink Ethernet to power to Ethernet I bought when I lived in an appartment and didn’t want to drill holes in the walls. (Wifi ran from center of house, but outed it to a 110 in the wall and hardwired to a PC into a RAP for work in bedroom at the time.
Eh, something like a dumb switch or PoE injector shouldn’t cause any problems since they don’t really have any exploitable logic, and they’re behind a router anyway.
Really not sure how much tech they have in them. I’m more familiar with PoE and switches. The Ethernet to 110 to Ethernet I guess is just pulses being sent to transmit the data over power lines within the residence, but yeah I agree it is behind the router. That doesn’t say someone couldnt hack say a smart fridge and pick data off the same power and then transmit that data back through a backdoor. But then again that fridge would be behind the router as well. Idk, havent spent much time looking at any of it. It would have to mimic the sync signal used by the receiver though, not sure what security protocols are there.
Unless you’re operating a military base or something, you’ll be fine with anything that’s not “smart.” I don’t trust most “smart” devices unless I can self-host them (e.g. block them from phoning home).
Older devices stop getting software/firmware updates.
But usually simpler things like USB to Ethernet adapters and switches don’t have much going on update wise. If anything at all. Switches often do, adapters rarely do.
The best you can do is keep an eye on updates for the devices, if any. Keep an ear out for reported vulnerabilities, and then retire devices when they are no longer maintained.
But all of that is quite a burden for a device most people set up and forget about. At some scale, and in some senses, there is no good answer. New vulnerabilities are found all the time in hardware/software.
If you just mean “will old devices stop working”? No. This would just impact new sales.
An even better way is to leave vulnerable pieces in all parts of the firmware / software stack. E.g. old version of SSH with a known vulnerability or two, old web server, etc. Then just exploit as needed.
The examples you gave are all at the OS level and installing OpenWRT would fix them. The firmware/BIOS level is much more custom and can be susceptible to attacks the OS is completely unaware of (effectively pre-installed rootkits). Hence why I mentioned it may not be enough to install OpenWRT.
You are talking about the boot loader, but even that is pretty standard. There could be hardware exploits in place, sure, but we are mostly talking about a very low margin product and the volume of data that you’d need to retrieve and process to sift out anything useful would be massive and obvious so in general I think this is mostly conspiracy level thinking. Any shenanigans is going to be done in small targeted batches if it’s done at all to try to infiltrate specific targets and reduce risk of some curious researcher or enthusiast accidentally stumbling across it and ruining it.
but we are mostly talking about a very low margin product and the volume of data that you’d need to retrieve and process to sift out anything useful would be massive and obvious so in general I think this is mostly conspiracy level thinking
Bold of you to assume they actually need to make money on these.
They also don’t need to sort through data to be problematic; they just need to be able to be remotely disabled or remotely given the order to start sniffing if they are one of the higher end systems that would be used in major infrastructure (that could process at volume).
Sure a researcher could stumble upon something… But closed source, embedded deep in the hardware, etc the number of researchers working at that level is not all that high AFAIK. The research is also from my understanding very very difficult at that level. It would be borderline equivalent to reverse engineering the Intel remote management engine or something.
Yes of course, you’re right. The point I’m making is that wherever you’re putting in backdoors, instead of backdoors, you can just leave unlatched vulnerabilities. Gives you solid plausible deniability.
I’m not sure, but with routers, I think OpenWRT installs/flashes at the firmware level. There could be hardware level vulnerabilities I suppose.
In the case of Lenovo laptops used in Iraq (2004), China had additional hardware chips snooping and sending data back via Ethernet cable.
Yeah! I only want my own government spying on me and screwing with me!
My router comes from Latvia. I’ll only be worried if they get invaded by Russia.
Damn, maybe we should have some kind of privacy law that could have prevented this behavior from ever being allowed in the first place.
Someone in the comment section posted a good question. Which specific routers that TP-Link makes are the issue?
Is it all routers that they make or is this just because they are selling inexpensive routers that have become a large part of the US market?
Does someone have an article that isn’t biased one way or the other that gives a list of effected routers ?
Does someone have an article that isn’t biased one way or the other
We’re literally inside an imperial core.
that gives a list of effected routers ?
If there was a list of effected routers, TP-Link would most likely have patched them.
Most likely old routers still sold on Amazon instead of the latest WiFi 7 models on the website~
Why would you assume that? They probably all use the same base.
TP-Link is popular because of their cheap options while easy-to-setup for average joe families.
Right, but I’m not seeing a reason that only the older routers would have these vulnerabilities. I’m guessing the base OS for all of them is quite similar.
Which specific routers that TP-Link makes are the issue?
They are presumably talking about CovertNetwork-1658 and the reason there’s no list of routers is because no one has publicly described the vulnerability that is being leveraged.
My guess is that the vulnerability is present on most of their routers. I’m basing that opinion on the fact that previous CVEs issues against TP-LINK have impacted their most popular product lines like Archer and Deco.
It’s possible that this is related to CVE-2024-21833 which was open in January of 2024, update in July of 2024, then updated again in late November of 2024.
They don’t care. They want to ban TP-Link as a company, routers are just an excuse.
This is the same people that keep blocking US gdpr legislation, so we know for a fact they don’t care about us, they just care about not being able to spy themselves.
So they’re going to flush the TP?
I feel sorry for D-Link, they’re probably going to get caught in the crossfire via people thinking they’re the same company.
Want to elaborate on those claims?
Just that their names are so similar… It’s literally “-Link” with a character or two in front.
So you’re saying that D-Link’s reputation will increase as a result?
Oof, fair 😅
D-Link already sucks
That’s also true, they’re like the Dell of home routers~
Dell actually has a decent professional line.
So many MSPs are gonna panic if tplink is banned
We have this really great approach to security where we allow the adversary to infiltrate a huge portion of our infrastructure for years and at many different levels, and then we say “hm, maybe wouldn’t be allowing this?”
Almost like it has less to do with security and more to do with securitization of economic competition.
If you really think this is just about economic competition, you’re very wrong.
The FBI didn’t recommend using encrypted messaging apps because our infrastructure being compromised is no biggie.
These are computers manufactured by and in a foreign country that’s expressed mutual hostility to the US. Computers follow instructions and manufacturers are in the best positioning to add custom instructions like “if you receive this instruction, brick yourself.”
After the cyber attacks in the last decade people should realize crypto scammers aren’t the only one’s that have an interest in shutting down important infrastructure.
This comment of yours immediately evokes the idea of the right hand that doesn’t know what the left hand is doing.
The right hand is the security theatre that the west is showing its citizens against foreign adversaries who hack their devices and introduce vulnerabilities.
Meanwhile the left hand has been doing mass layoffs and moving manufacturing off-shore ever since the 60s and 70s and trying to fuck over it’s own labour forces to make exponential profits.
Whats funny here is that you guys are bitching about “foreign adversaries” while also handing over the blueprints of your entire infrastructure to said adversaries without giving them anything valuable in return for their cheap labour cost and weak laws.
What did you expect to happen?
The right hand doesn’t know what the left hand is doing; that’s just it you’re right.
There’s no conspiracy where the left and right hand have carefully coordinated this system or conspiracy to protect companies from their legitimate competition. We’re not saying this about Taiwan or European devices (even though many of them are better than the Chinese and American devices) and that’s kind of “case and point” that it’s about more than the economy.
Basically the politicians just screwed up and didn’t think through their decisions and effects of trusting a foreign power to do all this manufacturing for important pieces of infrastructure that “think” … and now there’s a problem.
Yes, this is what a capitalist, non-centrally-planned economy does. There are multiple hands and the hand of the capitalist class is often the strongest and it will do all the things you mentioned, while the gov’t hand is trying to do damage control, but only able to the point where it hurts capitalists.
Well its just natural for coubtries to do this at this point when they dont like each other
In an off topic, I often prefer a open hardware router like raspberry pi router as it gives me control! For me it’s safer to use as documentation is open like pfsense and openwrt.
I don’t understand why doesn’t Raspberry Pi make a router when they’ve ideas like the 500 🤦🏻♂️
There’s already OpenWrt for Pi. All you need is to add a switch or a USB ethernet adapter.
I mean as a direct product that average people can directly buy instead of TP-Link.
OpenWRT did
If anyone at the user level is concerned about backdoors, the OpenWrt One comes straight from AliExpress. 😂 With that said there’s probably magnitudes less risk of something nefarious going on with a low volume machine built by Banana Pi than TP-Link.
Does it matter now? The alternatives are either Chinese companies, made in China, or filled with Chinese parts.
I’ll give China credit, they’ve stitched everyone else right up, and we slurped it down because we’re a sucker for cheap shit.
You can buy plenty of American made routers and other hardware that isn’t quite as shady. But like you said, we love our cheap shit here, and don’t give its malicious intent a second thought.
And no, it does not matter now, that’s sort of my point. Pandora’s box has been opened.
maybe the us should try actually investing in their own infrastructure instead of just relying on rabid xenophobia and sinophobia
Makes sense.
Insert meme: Throws out of the window~
I’d personally hope they just force open sourcing their firmwares if they want to stay in the market. I really like my Omada stuff, ubiquiti is just a tough pill to swallow on price.
They (FCC) forced firmwares being signed so nobody can install their own on the off chance it unlocks TX power or frequencies not allowed by FCC.
Can’t say I’ve ever seen an example of signed firmware that didn’t exist to further exploit the working class.
You’ve never used Linux?
Signed firmware just means you can prove a given key was used to sign something. Most Linux distributions sign their packages so you know one of the trusted keys from the maintainers was used to sign the packages (and yes, this includes firmware), which prevents a man-in-the-middle from modifying packages.
The only problem I have with signed firmware is if there’s no way to change the acceptable keys. Signing itself is an important security feature, its only problematic if the user can’t upload their own signed packages.
I don’t think you know what firmware is.
Maybe you don’t. Here’s a list of firmware packages in Debian. Signing for router packages follows the same logic as those Debian packages.
I rest my case.
Requiring signed firmware is just a lock to keep poors out.
It’s Never used for consumers benefit, not once, not ever.
Signed firmware doesn’t cost anything, so I’m not sure what you mean by “keep the poors out.” Signed firmware has a very valid use case for preventing supply chain attacks. The only time I have an issue with it if there’s no way to make your own signed package or bypass the requirement.
It costs the ability to flash your own firmware.
The only time I have an issue with it if there’s no way to make your own signed package or bypass the requirement.
That’s 100% of all signed firmware implementations.
They should undo this and just prosecute people who abuse the firmware
I honestly like the GL.iNet approach in terms of software which is kinda like Android.
I recently bought their Flint 2 (GL-MT6000) based on multiple recommendations online when looking for a router that supports OpenWRT. That’s preinstalled, with AdGuard Home and WireGuard VPN on top of it. I’m looking forward to set it up and play around with it.
What do you exactly mean when you describe their approach in software as Android-like? That it’s easy to install services in OpenWRT?
It’s OpenWRT as you said but with their own skin and added features instead of completely spinning it off from the ground just because one has a feature to add as an idea like the native AdGuard Home home you mentioned, this makes sure it’s either continually supported because of OpenWRT or anyone can install the vanilla OpenWRT if support is no longer carried by the manufacturer.
Why so late ? Of course this should have been zone before. It’s a question of sécurité.
The US government is just upset because it’s harder to place back doors in non-US hardware. It’s a US national security concern to NOT have US back doors in devices.
That’s not all. The US government exists to look out for the interests of wealthy americans.
Every dollar spent on a different nation is a dollar that could’ve been spent on them, in their eyes.
American business owners know that China is competitive because they can provide better products at cheaper prices. Americans would need to invest in making their products better or lower prices to compete with China. Both result in lower profits for owners.
This is why we will never stop seeing FUD against products that offer us a better deal than those looking to exploit us further. It’s more profitable to convince useful idiots to “buy american” than it is to actually sell them products worth buying at competitive prices.
This comment is suspicious to me. It’s been companies like Apple that have pioneered using Chinese labor to increase their profits. Moving jobs to the USA won’t help make them any richer. It makes economic sense but not strategic sense
I don’t think it makes economic sense. Bringing production back here creates jobs, but we have low unemployment so we don’t really need more manufacturing jobs here.
It makes sense for national security though.
Countries like China, Germany, Taiwan, etc. have competitive exports because they have direct and indirect subsidies to their manufacturing sectors at the expense of their household sector.
Some of these subsidies include a weak currency relative to their economy, weakened labour laws, preferential interest rates, capital controls, labour movement restrictions, etc.
China uses all of these. Germany primarily used the Hartz “reforms” which basically decoupled wage growth from productivity and GDP growth.
The reduces the household share of national income and they cannot afford to consume the production of their manufacturing sector and therefore the excess production must be exported.
And China probably also installs backdoors
law that prohibits attempts at monopolies
Why hasn’t this law been used before for so many other things, like all cash burn tech startups such as Uber, etc? Genuine question not being sarcastic…
Well in my country uber isn’t a monopoly because it eexists indrive and others also actually I think there’s a healthy competition
