News for hackers. Stuff that matters.

A comment on Ubiquiti is suing Brian Krebs for his reporting on their breach. Parent comment

Re:Ubiquiti is suing Brian Krebs for his reporting on their ... by mike_d on Tuesday March 29, 2022 @10:27PM (#30850890)
TP-Link devices have been shown to ship with backdoors baked directly into the firmware.

The TL-WDR4300 and TL-WR743ND have a special unauthenticated URL that causes the device to connect back to your IP, download a file, and execute it as root.

The TL-WA701ND and similar models create a hidden SSID that acts as an unauthenticated bridge into your network.

If you can even manage to report security issues to them, they will only patch models you specifically tell them are vulnerable. So as a researcher you have to buy one of every model to actually get things fixed.

[ Parent | on HN ]
Re:Ubiquiti is suing Brian Krebs for his reporting on their ... by Rebelgecko on Tuesday March 29, 2022 @10:30PM (#30850910)
Do those get overwritten if you use OpenWRT, or are they at a lower level?
[ Parent | on HN ]
Re:Ubiquiti is suing Brian Krebs for his reporting on their ... by ynezz on Wednesday March 30, 2022 @12:23AM (#30851463)
Indeed, running latest OpenWrt release is the fix, yes.
[ Parent | on HN ]
Re:Ubiquiti is suing Brian Krebs for his reporting on their ... by postpawl on Tuesday March 29, 2022 @10:35PM (#30850943)
Can you send a link to reports of that issue on their standalone access points? Might just be their routers?
[ Parent | on HN ]
Re:Ubiquiti is suing Brian Krebs for his reporting on their ... by mike_d on Tuesday March 29, 2022 @10:41PM (#30850980)
There are thousands of issues. I updated my comment with a few examples.

They suffer from extremely poor code quality, a complete lack of understanding of security, and severe code reuse without recording what devices the code ends up in. You can take existing TP-Link exploits, poke around in a new model of device, and often find the same vulnerable endpoint under a new "hidden" URL.

Edit: to address your specific question, CVE-2021-35004 is RCE against both routers and standalone APs.

[ Parent | on HN ]
Re:Ubiquiti is suing Brian Krebs for his reporting on their ... by X-Istence on Wednesday March 30, 2022 @01:07PM (#30857949)
You are comparing their consumer routers to their business line-up. The management interface for the business line-up can be properly segregated onto separate VLANs to protect it.

Sadly the consumer department doesn't seem to follow the same model as their business department.

[ Parent | on HN ]