US Government to BanTP-Link Devices - Live Hacking of a Chinese WiFi Router

Comments · 4K

• MA

  @mattbrwn · 1 year ago · pinned

  What do you guys think? Is this ban targeting one company when others have the same issue? Let me know!

  684

• JO

  @JonitoFischer · 1 year ago

  The solution is simple, instead of banning tp-link, you should enforce an open source driver policy, so their SoCs can be mainlined in Linux kernel or BSDs kernels,  so anybody can build an alternative open source firmware like OpenWRT. If you don't trust the device maker, then you install the OS of your choice and manage your device the way you want.

  4.5K

• DA

  @davenone8516 · 1 year ago

  The real question is do the politicians demanding a ban have a financial stake in a competitor.

  1.4K

• BI

  @birdetta · 1 year ago

  I've found significant 0day vulnerabilities in SOHO routers from every vendor. Almost always it's classic 101 stuff, like unprotected password reset pages or firmware flashing MITM attacks. I don't see how TP Link is special. Don't trust any vendor's home router.

  1.2K

• 3_

  @3_Dogs_In_A_Trench_Coat · 1 year ago

  Pro-tip: before taking  the thing apart look at the manual. Admin name and password are usually printed there. TBF the manual also recommends you to change them both ASAP.

  43

• KA

  @KaiNoMood · 1 year ago (edited)

  This video doesn&apos;t actually expose a vulnerability in the TP-Link device. Instead, it highlights how improper router configurations—likely due to user error—can lead to security issues.<br><br>Exposing the router&apos;s telnet or HTTP services to the WAN interface isn&apos;t even enabled by default on these devices. The fact that it can be done isn&apos;t a vulnerability; it&apos;s a configurable feature that can be useful in specific cases, as long as it&apos;s not exposed to a public network.

  993

• DM

  @dmtsza · 1 year ago (edited)

  This video did NOT show any exploit. What it shows is that some users are not changing the default password and exposing the router web admin interface to the WAN interface (which can then be accessed remotely with the default user/password). For this you do not need UART nor flash dump.

  735

• EV

  @everytoolashammer9427 · 1 year ago

  Bro made a YouTube video that taught what took me years of interweb learning. I wish stuff like this was around when I was learning. Great stuff.

  186

• AZ

  @azrios · 1 year ago

  Thanks for the video. &nbsp;Matt, what routers would you suggest using?

  4

• FR

  @FrançoisVictor-w3n · 1 year ago

  To find the default password of any device my prefered method is reading the manual and not desoldering the flash ROM, extracting the embedded filesystem and then cracking the password hash.

  227

• BA

  @barry3602 · 1 year ago

  It&apos;s not about just the &apos;security vulnerabilities&apos;, it&apos;s because of security vulnerabilities that doesn&apos;t benefit the US National Security Agency to be exploited.

  241

• RE

  @redroc24x7 · 1 year ago

  Great vid, have you looked into the TP link smart plugs for a similar issue?