If experience is any guide, they are not.
Consumer routers have horrible track of embarrassing, easily exploitable vulnerabilities. That are not patched for a long time or ever.
And exposing your router to public like that suggests the owner knows very little about security. This typically goes in hand with other neglect. Tell me, how many home users that are not security conscious keep their routers regularly patched and will replace the router when the manufacturer stops supporting them?
I personally run Ubiquiti Unifi gear, but they're not exactly consumer friendly (more geared to power users).
All of the competition either requires intimate knowledge of networking internals, is twice as expensive or both.
Once you log in it appears to be running a version of OpenWRT, although they don't specify that on their website.
I don't.
Is it too much to ask to have competently built hardware with competent software for a reasonable price enabled by mass production?
I mean, just don't make stupid things like open access to it from a single point of failure where a single engineer can loose their AWS key and enable attackers to access million networks?
Or build devices that overheat placed on an open shelf in home office in truly unreasonably hot Polish climate?
I can sympathize with people that don't have technical background -- these are practically defenseless.
I'm willing to invest time once to get something better working. I'm not willing to invest time on an on-going basis to keep my router secure. My normal router is a !@#$%, but the company does push out security updates.
Most of the DIY projects I've seen require me to do it manually.
When the EdgeRouter-4 I have dies, I suspect I'm going to need to find a new hardware brand, this time preferably running OpenWRT. Potentially it could get to the point where I'll have to look for an ARM based server with low enough power usage and a few independent network interfaces and just run pfSense or VyOS or something...
However, it's likely that your ER-4 will far outlast the majority of devices you can find running OpenWRT. They're very well built units.
I expect I will eventually move to embedded server hardware (even maybe Xeon-D) on a machine running vSphere or something with a router VM and other VMs for stuff I want to run. Just have a few separate NICs and pair it with a separate managed switch (which I already have anyway).
UPnP is on by default, yeah
Make that 47,000 of them on Shodan: https://www.shodan.io/search?query=hash%3A-904286784
> 1) These routers all have secured passwords that are non-default.
You have a very interesting definition of "secured" if you think they are all actually secured.
> 2) These routers were deliberately placed on the internet by people that knew enough about them to do so.
Just because they knew enough to click a checkbox doesn't mean they knew enough to do so. If they knew enough, they wouldn't have done so.
You seem to be under the mistaken impression that embedded devices (like consumer routers) don't usually have glaring security holes. But they do.
Owner of a C7 v4 here. There has not been a firmware update from TP-Link since December 2019 (note that v4 is the second-most recent HW revision). No way these are not affected by at least some CVE somewhere in their stack. Calling them secure is a leap of faith that TP-Link does not deserve.
I recently flashed openwrt exactly to be able to be on a more recent stack.
I would never dream exposing that UI to the Internet as-is. They don't even have any form of brute forcing protection. If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side.
Either who set those up really has nothing to lose if they get owned, or they do not know what they are doing. In both cases, it does not qualify as being a secure setup. (Sure, they may also be honeypots - in which case your argument was incorrect anyway, as they are secure, but they are not routers)
any chance you can explain that to my mum?
It would be safer to leave open to the public only a secure protocol based on strong cryptographic keys instead of a password. Or you have to be signed in to a VPN to see the page.
> brute forcing protection
Try too many passwords? Try again in 1 minute. Again? 30 minutes
> allow tunnelling to the router UI only from the LAN side
I think this one means don't expose it to the internet at all. Just from your local network. >
Exposing your router's admin page to the internet is not good security practice. These routers are protected by nothing but a password, and I couldn't see anything in the manual that enforces password length/complexity. So while the password might be non-default, it could still be incredibly insecure.
Also, to expose these routers to the internet, all it takes is a single checkbox to enable "Remote management". So your assumption that these have all been deliberately placed on the internet also doesn't hold up because I can definitely see a curious home user playing with these settings without realising the impact of this. There have been tons of similar reports in the past where home users have exposed things to the internet without realising the impact.
> The estimated 7,000+ results becomes 21. Many of which are HN aggregators reporting on this thread here.
Nope, Google is just collapsing them because they are all identical copies of the same "page", being the same login screen. Most of them look like routers, you can ask Google to "include" them all and see for yourself. https://www.google.com/search?q=%22Please+log+in+with+router...
> 2) These routers were deliberately placed on the internet by people that knew enough about them to do so.
That's making some very generous assumptions.
Disagree. In my current country of living, I'm not even sure how I'd properly expose the router I use to the public internet since I sit behind the ISP's NAT-ing, and even when I lived in the US, I am not confident I could tell you how to publicly expose the modem provided by Comcast for non-local access, much less how someone without any tech experience might do this.
If this was a prevalent problem because of default settings, I'd expect far more than 7800 results; I am not willing to concede every instance is intentional, but 7800 out of the billions of routing devices in the world showing up on this search enforces my understanding that these 7800 entries are special in some way.
>I doubt there's MFA or even rate limiting.
MFA is not common at all on consumer routers, which at least quite a few on the first page result are, same with rate limiting.
Even for Enterprise grade gear, the threat isn't the user-defined password, it's the manufacturer backdoors, which we've seen many of in the last few years. Rate limiting doesn't do much if you have a fair chance that you've got a back door.
What likely __does__ help is that as far as I know, "Enable Web Access from WAN" is by default *disabled* on most consumer routers (and enterprise? that I'm not sure of), so I think that this leads credence to the devices on the Google results being exposed intentionally to some degree. (The owners' knowledge level not withstanding, this is a fairly out of the way setting, at least on my Asus router)
You likely couldn't. That setting is usually gated behind some sort of "technician" or "mso" account (or not present, or only accessible from the devices telnet/ssh interface). Of course, it's probably not difficult to guess Comcast's password; past experience with other companies suggests you try things like "comcast" or "C0mc4s7". (Not even joking, Suddenlink and Spectrum/TWC.)
> much less how someone without any tech experience might do this.
Easy. It's a button that their kid clicked while playing around.
> MFA is not common at all on consumer routers, which at least quite a few on the first page result are, same with rate limiting.
Are you trying to say that's a positive for exposing it on the internet...?
Click "Next Page" - estimated results turns into 21 results in total... of which a bunch are dead links, a bunch are HN aggregators... leaving just a small handful of actual devices on the internet.
Again, just because you wouldn't configure it this way doesn't make it wrong. It's as secure as it can be, short of throwing a bunch of other kit in front of it, and then why would you be using a $100 consumer router anyway?
The only vulnerability here is the possibility of a 0-Day. Everything else is either misguided or screaming for the sake of it.
That's not exactly uncommon in cheap consumer routers.
No rate limiting is as good as no authentication.
That's, in my opinion, the only fair criticism available here.
> No rate limiting is as good as no authentication.
Trying to even load some of the links found in Google takes 10's of seconds. That's effectively a rate limit, even if it doesn't temp-ban per IP address.
Someone would have to dump the firmware to find out, but it would be trivial for each device to generate their own salt - making a potential lack of rate limit a non-issue.
Salting does nothing to protect against bruteforce attacks, which are what rate limiting defends against. Salting is done to protect passwords in the event the password data is stolen.
Latency is not rate-limiting.
I kind of agree with the comment that started this thread -- people that have explicitly decided to expose their consumer-grade routers directly to the Internet probably know about password managers. Even if you do guess the password and compromise the router, all you'll have is some remote office that is getting TLS errors because of your MITM, and best case control of some unpatched Windows 3.1 machine and maybe some developer's local MySQL install happily listening on port 3306 somewhere. That's not great, but it's a risk that some people are willing to take.
And usually with default password because not on the internet. People often forget or underestimate lateral movement and metasploit reverse shell kits.
You do realize that the last security update for these routers was in 2019, right? So by zero day, you mean something more like 700 day? Yeah, no way anyone could've discovered a system takeover in the last 2 years, when up against the security prowess of... TPLink?
I think it might be a good idea to edit your original comment, you'll save some face.
Who said secure password? Yes, they are not the default, but people are terrible at choosing password, most will choose weak password that are easy to exploit with a dictionary attack.
> 2) These routers were deliberately placed on the internet by people that knew enough about them to do so.
A people that know what it's doing would never expose a router web interface on the internet. Most people doesn't know how to configure his router, and let the ISP technician configure it, and they probably expose the router interface so they can access it remotely for maintenance, but it's not a great idea...
> There are legit reasons to place a router on the internet, so long as it's secured properly...
There aren't. Also you can choose a secure password, but these router interfaces are full of bugs, and highly exploitable. Add to this the fact that the manufacturer rarely updates the firmware of these devices...
> how else would you remotely manage a router at a different physical location, for instance.
With a VPN? By creating an SSH tunnel to one machine inside the local network? By connecting remotely (via RDP, VNC, TeamViewr, whatever) to one PC inside the local network? There are a ton of better solutions.
Also if you don't have a static public IP address, as it's in most situations nowadays, how do you access it remotely anyway? With dynamic DNS but it's not reliable. The best solution to me is using a VPN (I can connect to my home network from anywhere in the world and access all the hosts, including router and other networking equipment of course).
Secure passwords is just a tiny subset of non-default passwords. Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low.
> These routers were deliberately placed on the internet by people that knew enough about them to do so.
This means these people knows how to expose the management interface to the internet. It does not mean these people have enough knowledge on securing their devices -- based on their actions, it is more likely that the opposite is true.
So you think the chance of human beings to come up with 4 random words is pretty low?
You can't brute force millions of guesses per second through a web interface. 40 bits of entropy is already plenty for internet usage especially when the password is properly hashed with something like bcrypt.
> Secure passwords is just a tiny subset of non-default passwords
Actually the exact opposite is true. Since only low entropy and publicly known (which are mostly low entropy) passwords are insecure there are much more secure than non secure passwords.
For the sake of argument, let's say all passwords with less than 40 bits of entropy are insecure. Even if we restrict the set of possible passwords to only 10 characters of lowercase a-z we have about 47 bits of entropy. So the set of insecure passwords would only be about 1/128 or less than 1% of all allowed passwords.
> Actually the exact opposite is true. Since only low entropy and publicly known (which are mostly low entropy) passwords are insecure there are much more secure than non secure passwords.
You're confusing "passwords that are in use" with the set "passwords that are possible". We have data via password dumps that suggests of the "passwords that are in use" the set that qualifies as "secure" is indeed a tiny subset of passwords.
Anyway, the point is, people are terrible at generating (and remembering) secure passwords. By ruling out the default password just means it is not going to be the most insecure one, but the chances of the custom password being secure is still pretty low.
I would love for more websites to implement something like the zxcvbn password strength meter [1], but unfortunately I keep seeing new services or recently refreshed ones using outdated and hurtful policies like requiring numbers and special characters.
I've always wondered how effective the random words thing is. sure, there are like 100k english words in current use according to google, but it seems like a list of the most common few hundred of those words would crack a lot of passwords.
30 bits of entropy isn't particularly secure against locally cracking a password hashed with sha256 or a similar non password hash. However at 1000 guesses per second it would already take 28 days to brute-force and 1000 guesses per second is pretty fast against any password stored with a properly configured password hash like bcrypt.
I personally auto-generate readable passwords for most websites at ~70 entropy pure brute-force and ~50 entropy if my algorithm and set of inputs would be exposed.
Aside from the anecdata, a counter argument is that the router manufacturer has taken no steps to obscure the routers from search engines. Sure someone could simply IP scan, but you have to admit this is a little absurd.
If "placing it on the internet" was proof of excellent security knowledge & practices, then nothing on the internet would be insecure.
Just because they knew enough to know how to place it on the internet doesn't mean they understood the implications of that decision.
many tp-link routers also have configurable vpn servers built in, which can open up the whole network to malicious actors.
Although not specified to TP-Link, There are many exploits on other brands that can bypass the Authentication. For example this one:
https://medium.com/tenable-techblog/bypassing-authentication...
Even allowing access the web server from internet could be dangerous.
It’s fine to expose router configuration (although it’s not ideal), but if you know that you are doing, you’ll at least place it behind a VPN.
Most routers are perfectly fine with a limited set of knobs accessible to the public Internet behind reasonably secure access ports. Bastion it behind SSH and/or SOCKS if you're paranoid, but seriously, as long as we're not talking a $50 Target 'router', it's probably fine. My Ubiquiti gear is indexed. It also reliably e-mails me when it successfully authenticates a user and can distinguish between inside and outside access to ACL what it can do.
Just saying, easy with the "if you know what you're doing" thing, because opinions differ (particularly with beyondcorp in an IT setting). Gluing a VPN back together through an SSH tunnel so you can get at the "fail over to my DSL connection" button inside your network is a really crappy deal at 3 a.m. with a few beers in you and 200ms in between.
Maybe it’s just a matter of difference of criteria, but I would certainly not be fine with this. You have a lot of ways to prevent this from happening, and it only opens an attack surface to APTs.
Being indexed means being searchable, being searchable means exposing yourself to automated targeted attacks.
Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results:
https://static.tp-link.com/2019/201912/20191231/7106508598_A...
Step 2 of first time setup forces a default password change. There is no way around this step.
The defaults for the router also do not allow router access from the WAN port.
This means:
1) These routers all have secured passwords that are non-default.
2) These routers were deliberately placed on the internet by people that knew enough about them to do so.
Just because it's not how you would configure your router doesn't make it wrong. There are legit reasons to place a router on the internet, so long as it's secured properly... how else would you remotely manage a router at a different physical location, for instance.
__Lastly__ click "Next Page" on the OP search results. The estimated 7,000+ results becomes 21. Many of which are HN aggregators reporting on this thread here.
So... out of the possible millions of routers TP-Link has sold in this model line, less than 21 are on the public internet - many of which no longer load via IP address (indicating they are no longer publicly accessible), and the rest have professional CNAME's attached, indicating professional management.
Nothing here...