Eish TP-Link attacks

[r00igev@@r]

Hackers infect TP-Link router firmware to attack EU entities

A Chinese state-sponsored hacking group named "Camaro Dragon" infects residential TP-Link routers with a custom "Horse Shell" malware used to attack European foreign affairs organizations.

www-bleepingcomputer-com.cdn.ampproject.org

Be careful out there.

 

[r00igev@@r]

As someone said, what did you expect exposing your toilet paper router's interface to the Internet.

 

[RonSwanson]

As someone said, what did you expect exposing your toilet paper router's interface to the Internet.

I agree in principle, as one of the threat vectors, but the researchers are still in the dark on how the routers became infected with the malware.

When was the last time that you did a firmware update of a TP-Link / any home router device? Was the image signed? Was there even a cryptographic hash provided? And even if there was, there are insiders who can plant them undetected, unless there are checkpoints at every step of the CI/CD chain, which I strongly doubt. State-sponsored threat actors typically have unlimited resources at their disposal and prevention of this kind of attack is a whole new ballgame, even for enterprise-grade router manufacturers.

Good to know about it though, researchers can keep a TP-Link device around so that it can be used as evidence of plausible deniability whenever necessary.

 

[r00igev@@r]

The 3 ply toilet paper router is also a problem:

Cisco warns of critical switch bugs with public exploit code

Cisco warned customers today of four critical remote code execution vulnerabilities with public exploit code affecting multiple Small Business Series Switches.

www-bleepingcomputer-com.cdn.ampproject.org

 

[Rickster]

Still have an old TP link router from when I first got fibre, it's currently lying in a box. I see there has been no FW updates since 2016.

 

[dj_jyno]

The 3 ply toilet paper router is also a problem:

Cisco warns of critical switch bugs with public exploit code

Cisco warned customers today of four critical remote code execution vulnerabilities with public exploit code affecting multiple Small Business Series Switches.

www-bleepingcomputer-com.cdn.ampproject.org

Bloody Hell. Good thing I update firmware as soon as it is available - the office uses a 350 Series.

 

[r00igev@@r]

Still have an old TP link router from when I first got fibre, it's currently lying in a box. I see there has been no FW updates since 2016.

Only good thing for a TP-Link is when you can flash it to OpenWRT.

 

[r00igev@@r]

Bloody Hell. Good thing I update firmware as soon as it is available - the office uses a 350 Series.

You must have deep pockets to still afford being able the buy a Cisco.

 

[dj_jyno]

You must have deep pockets to still afford being able the buy a Cisco.

Deep pockets or good eBay skills

 

[elf_lord_ZC5]

Well typical home routers, seldom if ever get updates. As long as ISP's hand out cheap, outdated, vunerable routers for free, the problem will not go away. The end user wants plug and play. ISP's have never in my experience warned their clients that there is sn update for their router and to please install it.

Seen the odd report on MyBB, reddit etc. about such, but never yhe ISP. But then I would not want to admit to my clients that I supplied them with a cheap as chips, end of life router, for the overpriced service that they are buying from the ISP. Your clients are not going to be very enamoured.

 

[r00igev@@r]

Well typical home routers, seldom if ever get updates. As long as ISP's hand out cheap, outdated, vunerable routers for free, the problem will not go away. The end user wants plug and play. ISP's have never in my experience warned their clients that there is sn update for their router and to please install it.

Seen the odd report on MyBB, reddit etc. about such, but never yhe ISP. But then I would not want to admit to my clients that I supplied them with a cheap as chips, end of life router, for the overpriced service that they are buying from the ISP. Your clients are not going to be very enamoured.

True, but the average receiver of these routers won't buy anything decent.

I have a free public service to fix any ISP supplied router. Please DM me.

 

[elf_lord_ZC5]

True, but the average receiver of these routers won't buy anything decent.

I have a free public service to fix any ISP supplied router. Please DM me.

View attachment 1531153

A lot won't - but a large segment would, buy a better quality device.

As there is mo way to make ISP's responsible for the security of the devices they supply to clients, nothing will change either.

Like with RAIN 5G, I am stuck with their "free to use" router, can do nothing useful with it so I put a MicroTik behind it, to look after my network. Cannot do anything about the RAIN router tho.

 

[r00igev@@r]

Like with RAIN 5G,

Agree, Huawei routers are a steaming pile of poo.

 

[elf_lord_ZC5]

Agree, Huawei routers are a steaming pile of poo.

Got ZTE MC888, which is worse ...

 

[r00igev@@r]

Got ZTE MC888, which is worse ...

I'd rather walk around in only my jockeys displaying my GT stripes.

 

[elf_lord_ZC5]

I'd rather walk around in only my jockeys displaying my GT stripes.

Not much to be done for it, no fiber, no Supersonic 5G, not that they are any better, at least it is mostly decent, if not good.

 

[Zurg]

Only good thing for a TP-Link is when you can flash it to OpenWRT.

I have a Ruijie RG-EW3200GX PRO that I'd like to flash with openwrt as the stock OS gives me flashbacks to my Netgear router but the last thread I followed on OpenWRT's forum shows that it bricked his device then again could be user error.

If I can't get OpenWRT on it then I'll probably sell it and replace it with something decent.

 

[elf_lord_ZC5]

I have a Ruijie RG-EW3200GX PRO that I'd like to flash with openwrt as the stock OS gives me flashbacks to my Netgear router but the last thread I followed on OpenWRT's forum shows that it bricked his device then again could be user error.

If I can't get OpenWRT on it then I'll probably sell it and replace it with something decent.

Buy 'TIK, and be done

 

[r00igev@@r]

I have a Ruijie RG-EW3200GX PRO that I'd like to flash with openwrt as the stock OS gives me flashbacks to my Netgear router but the last thread I followed on OpenWRT's forum shows that it bricked his device then again could be user error.

If I can't get OpenWRT on it then I'll probably sell it and replace it with something decent.

I've only used the ceiling mounted ones as Access Points and they behave. I always separate Internet router from WiFI.

 

[Zurg]

I've only used the ceiling mounted ones as Access Points and they behave. I always separate Internet router from WiFI.

What do you make of the Ubiquiti Dream Machine? Obviously I'll need access points.