Bambu Lab - Setting the Record Straight About Our Security Update

Re:Bambu Lab - Setting the Record Straight About Our Securit... by parasubvert on Monday January 20, 2025 @06:00PM (#42774167)

I don't think their MQTT was over TLS traditionally (maybe they added this), it used to be that you just sent a message over unauthenticated MQTT and FTP'd your 3MF; the FTP had a password but that also was sent in the clear. https://github.com/darkorb/bambu-ftp-and-print

Most corps these don't want to deal with the hassle of VLANs and black holes for insecure devices.

[ Parent | on HN ]

Re:Bambu Lab - Setting the Record Straight About Our Securit... by BeefWellington on Monday January 20, 2025 @07:24PM (#42774820)

People have been using MQTT with TLS for years[1][2][3]. Long before the company and line of printers existed. It's not really an excuse to say "well they didn't use it" -- they should have simply offered people the necessary configuration options to enable it.

[1]: https://mosquitto.org/blog/2018/05/version-1-5-released/ [2]: https://forums.raspberrypi.com/viewtopic.php?t=287326 [3]: https://esp32.com/viewtopic.php?t=9747

[ Parent | on HN ]

Re:Bambu Lab - Setting the Record Straight About Our Securit... by hWuxH on Friday January 24, 2025 @04:21PM (#42817036)

Everything was sent in plaintext early on. But since 2022/2023 it's TLS: https://wiki.bambulab.com/en/security-incidents-cloud-traffi...

[ Parent | on HN ]