Linksys Velop routers send Wi-Fi passwords in plaintext to US servers

https://stackdiary.com/linksys-velop-routers-send-wi-fi-passwords-in-plaintext-to-us-servers/

by skilled • 2 years ago

498 217 2 years ago

No need to worry about Huawei backdoors when domestic infrastructure does such a bang up job on their own.

I am sick of reading about these embarrassing security holes in Cisco/Juniper/etc. The internet is an adversarial place. Stop cowboy coding

ClumsyPilot• 2 years ago

Stop cowboy coding

Why are you giving this company benefit of the doubt - just because it’s western? They haven’t even bothered to comment on the issue, they made no promise to fix it, for all you know they are selling your data to the highest bidder. And to anyone from China too.

If a Chinese company does it we are quick to label it stealing, but here we have the authority to regulate, and we go soft, oh no, it’s disorganisation, poor them, they’ve only been in this business for like 40 years or whatever.

Maybe we should assume malevolence, just like we do with China.

fooqux3• 2 years ago

Maybe we should assume malevolence, just like we do with China.

I'm fine with assuming ignorance for a brief window. But when the vendor doesn't reply after multiple repeated attempts, and no fix is in sight, it should quickly evolve from ignorance to willful malpractice at the very least.

0cf8612b2e1e2• 2 years ago

Where did I give them the benefit of the doubt? I am furious at the network providers ongoing negligence/incompetence. Either they are in bed with the NSA or they just suck at their job. Regardless of the root cause, we all suffer.

The mention of Huawei was to point out the humor that the government has banned a company on the potential for subtle back doors. Something like the xz exploit. Yet the domestic vendors put out trivially broken crap on the regular. How many Cisco devices have shipped with hardcoded passwords in the past decade.

lotsofpulp3• 2 years ago

Why are you giving this company benefit of the doubt - just because it’s western?

What does “western” mean? Linksys has been owned by Foxconn since 2018, which is based in Taiwan.

toast0• 2 years ago

Stop cowboy coding.

Look, I'm a cowboy coder, through and through; but I still know better than to close the barn door after the horse bolted.

Information security and software processes aren't that closely related. You can be secure and yolo in production. You can run an extensive change management system and a) push mostly unnecessary cloud services, b) not use reasonable precautions to protect information in transit (and at rest) when sending to cloud services.

I picked up some of the Linksys Velop wifi 6 routers recently, because OpenWRT works on them, but I figured I'd try the factory firmware first... Woof, it's bad (but I only used the web interface... I wasn't willing to install the app), I lasted a day.

Forming a mesh involves the central node using the default password when accessing the other nodes. I guess that's effective, but felt pretty gross to me.

thomastjeffery2• 2 years ago

Making this about foreign vs domestic is bullshit. There is no such thing as a friendly vulnerability.

Just quit allowing corporations to bake up pointlessly unique proprietary firmware blobs for every single device, and we won't have this problem! It's redundant work anyway.

anonym29• 2 years ago

"There is no such thing as a friendly vulnerability." is going right up there with "You can't trust code that you did not totally create yourself." in my list of favorite infosec quotes. Thank you!

ImJamal• 2 years ago

Linksys is owned by a foreign company (Foxconn).

staplers• 2 years ago

When you start digging into outbound dns traffic from consumer routers you can find a baffling amount of data sent. On the order of 50,000-100,000 dns requests a month to their company servers (sometimes hosted in china).

rasengan2• 2 years ago

Taking a step back and thinking about this, this vulnerability/bad decision was a result of systemic disorganization.

It's not just the developer who wrote said code, as well as the backend developers who receive these outputs, but further, the organization did not have any kind of test/check and balance/security mechanism in place.

It's terrible given the router, especially in a world of IoT, may be the device on your network that should be the most secure.

Finally, now that it's public how bad the organization at Linksys is, it is trivial for a criminal to pay an employee to purposefully include backdoors.

The consumer router scene needs a security focused disruption.

bastien22• 2 years ago

There is vendor-side infrastructure to receive the information. This wasn't a lapse in planning/testing. This was intentional.

Stop giving corporations the benefit of the doubt.

caconym_2• 2 years ago

Consumers deserve far better than what they're getting from network gear manufacturers—crap, and grossly overpriced crap. I wish Apple would get back into the game and at least offer some grossly overpriced non-crap.

1over137• 2 years ago

You don’t need Apple as your saviour, there are expensive non crap brands out there. I’ve liked Ruckus for example.

caconym_2• 2 years ago

I certainly don't need Apple. My primary home router is a virtual machine running on a Proxmox cluster, and my house is serviced by three sub-$30 Netgear wifi 5 access points running OpenWRT with 802.11r fast transition on a wired backhaul.

I can't recommend any of that to my non-techy friends or family. I can't recommend Ruckus, either, as it's about an order of magnitude too expensive. Ditto for the other "prosumer" vendors.

lovethevoid• 2 years ago

Embarrassing. Not responding for months is actively malicious and should be punished as such, towards the entire company too, not just one throwaway developer to shift blame on to.

hyperman1• 2 years ago

I'm impressed a consumer test organisation has the technical expertise to detect this. You don't find this by using it as a consumer would. They had to do the effort to hunt for security bugs to notice this.

c420• 2 years ago

This isn't limited to their Velop line. While converting my EA7500 to openWRT, I noticed this exact same information being sent as it tried to force me to login via the mylinksys web portal and tried to establish a link with the home server.

jasonjayr3• 2 years ago

Via the TR-69 mechanism, Verizon FiOS routers send your local wifi password to their central management system. The excuse I've heard for this is to "allow support agents to assist users who forgot their passwords"

:-/

ehutch79• 2 years ago

To be honest, this makes a lot of sense. The time saved in support is probably worth way more that costs of dealing with any security fallout

PhilipRoman3• 2 years ago

For that I think having a remote "reset password" option is more sensible. It would avoid issues coming from password reuse.

Hizonner3• 2 years ago

Verizon does not get to decide what's an appropriate tradeoff for other people's security.

account425• 2 years ago

A good argument why the fines for this kind of behavior need to be orders of magnitude higher.

cheeze• 2 years ago

Couldn't a security conscious user just use their own APs/Router?

nehal3m• 2 years ago

Sure, but then a forgotten password is your problem.

mikestew• 2 years ago

Sure, it’s what I do as a Verizon->Frontier->Ziply FiOS user. But most users are not going to go out and procur a bunch of Ubiquiti equipment or whatever, they’re going to take the defaults.

rogerthis• 2 years ago

Not only. Probably all ISPs around the world who provides their customers a modem with an embedded (or not) WiFi router do the same.

EDIT: also, if your ISP has a mobile app from which you can change any password on ISP provided devices, then most likely it goes around in plain text (inside TCP/TLS packets, at least).

JohnFen5• 2 years ago

That's utterly insane.

It makes me feel happy about my longstanding habit of not using routers supplied by ISPs, though.

poikroequ• 2 years ago

Every WiFi router I've ever owned, you hold the reset button for so many seconds to perform a hard reset, and the WiFi goes back to some default password. From there, you can login to the router and set a new password.

nullify88• 2 years ago

I thought WPS would have been the solution to the inconvenience of wifi passwords. If I were an ISP receiving too many support cases relating to the wifi password, perhaps WPS should be used more?

idunnoman12222• 2 years ago

This is pretty light on details, but my guess would be there’s some app that you can use to reconfigure all your Wi-Fi repeaters at once and if you use the app, it erroneously transmit the password which it needs in plain text

It’s not clear to me that the router sends the password rather than the app on your phone

fooqux3• 2 years ago

which it needs in plain text

Perhaps this is a typo on your part, in which case, please excuse my strong words here. But passwords should never be transmitted in clear text. Encryption is cheap these days.

idunnoman12222• 2 years ago

Sorry I missed a,

nottorp• 2 years ago

Erroneously? It's an US company. They do it because it's cheaper :)

If they were Chinese they would do it because they're spying of course.

fooqux3• 2 years ago

Despite warning Linksys in November, no effective measures have been taken.

November? November?! OK, sure, there are a lot of holidays around then. But I would have expected public disclosure on something like this by end of January at the latest, unless the vendor is actively working / communicating about it.

jonplackett• 2 years ago

Just reading these comments - is everyone OK with them sending your password to a server, but not with the lack of encryption?

I would not expect my password to be sent to the server in the first place.

e3a8• 2 years ago

Somewhat relevant (from 2013, Google knows every WiFi password in the world): https://www.computerworld.com/article/1496628/android-google...

miles• 2 years ago

HN discussion at the time (503 points, 302 comments):

https://news.ycombinator.com/item?id=6379439

squarefoot3• 2 years ago

Just like they, and Microsoft, and many hardware manufacturers, also know every banking password/legal document/medical data in the world. Closed operating systems, applications, drivers, can all be used to exfiltrate data unbeknownst to users, including administrators. We're forced to give them some trust, otherwise the only choice would be to use only systems, software, hardware that is completely open down to the last bit, which sadly don't exist as a whole.

paulmd• 2 years ago

Gosh, if only there was a device vendor who didn’t do that, and offered the option for encrypted cloud backups and e2e encryption for all your inter-device traffic, and designed their privacy-sensitive services to work on anonymized tokens instead of device identifiers or user accounts…

… but apple sells ads too therefore every option is equally bad!

It’s funny to see people admit with the AI stuff that apple is getting it right, introducing privacy-protecting approaches and services, etc, yet refuse to admit that the same perspective and approaches have informed all their services for a long time. In the day to day, there is no legitimate debate that Apple Maps is vastly more privacy preserving than google maps, etc. People use some weird purity test where because App Store ads exist suddenly apple is the same as a literal adtech company.

cabirum• 2 years ago

Asking this question since the first password manager

figmert• 2 years ago

Password managers are very different. The details get encrypted using a passphrase, and only the encrypted data gets sent to the password manager. You don't have to trust the backend unless the frontend is changed to send non-encrypted data and/or your passphrase.

JoshuaRogers• 2 years ago

You might consider 1Password. They don’t have the key so they effectively only see an all of the data in encrypted form, not even revealing the site, if I recall.

They have some fascinating papers about it, if I recall.

ta8903• 2 years ago

First cloud-based* password manager.

thomastjeffery2• 2 years ago

This article goes on about the Man In The Middle vulnerability, but doesn't bother to explain why there is a Middle to begin with, or why Amazon gets to put a Man at the End!

treprinum• 2 years ago

I suspect this is an internal sabotage from devs not agreeing with it - plaintext is easily observable and people can figure it out, causing a PR damage; encrypted passwords are basically untraceable.

orf• 2 years ago

Meanwhile, in reality, the offshore development firm being paid per line of code from Linksys farmed the work out to juniors who haven’t graduated and couldn’t care less if something is encrypted or not.

autoexec2• 2 years ago

causing a PR damage

The most you can expect from PR damage like this is that maybe an update goes out faster that fixes the problem (or at least hides it better). Nobody is afraid of bad PR. The most hated companies in the US are also massively wealthy and successful. If people refused to by routers from companies that pulled shit like this, nobody could buy a router. You can enter pretty much any major brand of wireless router into google next to words like "hardcoded" "backdoor" and "plaintext" and get results going back decades.

outworlder• 2 years ago

I suspect this is an internal sabotage from devs not agreeing with it

No, it's probably devs not even caring about it (or not caring enough to push back on deadlines). It's surprising what people will do if they aren't forced to do the right thing (passwords checked to version control, proprietary code pasted in Stackoverflow) and so on.

patmorgan23• 2 years ago

Bold of you to assume that the development wasn't farmed out to the cheapest subcontractor in a developing country that doesn't even know how to spell IoT.

rolph• 2 years ago

an hypothetically interesting wifi situation

SSID = [google] agrees to the following ToS.

psword = use of this password confers in perpetuity, unlimited use of any and all google products and services with no cost or liability, as the owner of the password sees fit

autoexec2• 2 years ago

Not me. I'm not even okay with being expected to use a cell phone app to configure the router.

xp847• 2 years ago

that's definitely the worst thing. There's nothing like being on my computer doing something, thinking "oh let me go update a setting or check some status on my router" then remembering "oh that's right, I bought Eero, let me go try to use the crappy iPhone app where I can't even multitask, instead of the full computer right in front of me."

JohnFen5• 2 years ago

I'm certainly not OK with that. I'm not OK with a router sending anything whatsoever off to a mystery server somewhere (sending data somewhere when the user overtly sets it up to do so is OK), and any router that does that is not fit for purpose in my view.

That said, I haven't considered Linksys routers to be fit for purpose at all for years now anyway.

godelski4• 2 years ago

Wait till you find out what TVs do... Which is far from ok

Reubachi2• 2 years ago

I understand your concerns and feel exactly the same. But I think at a certain point you can only care so much and dedicate so much time to it. With a home network you can obfuscate so much with little know how, and further you ultimately are "aware" of all packets being sent via examining your own traffic.

The real problem is cars, IoT Devices. Do you drive a vehicle newer than model year ~2015? That thing is sending all kinds of telemetry to OEM manufacturer and their entire supply line of OEM suppliers. That data is firstly used to audit and evaluate functions in the vehicle for future iterations....but then that data is sold as many times as they can to research firms, advertisers, gov't planning boards etc.

Taking ownership of the vehicle is you signing away any investigation or litigation rights, or even access to those data/data systems.

I think THIS is where data privacy awareness needs to be pivoted to, Geolocating "iot" devices like vehicle CPU that no one, not even service techs can ever access.

mikepurvis• 2 years ago

I think the most a router should be doing is occasionally hitting an NTP endpoint, and that behaviour should be possible to disable/customize.

nerdjon• 2 years ago

This is a big reason I despise the fact that so many ISP's just bundle routers into their modems.

At least with Comcast it seems like they have the ability to modify and (I assume) see this stuff in plain text. Who thought that was acceptable from a security standpoint I will never understand.

sneak2• 2 years ago

There’s no useful attack that can be waged against your devices with knowledge of your wifi password.

The idea that your LAN is a security boundary is out of date by decades.

rightbyte• 2 years ago

You should be able to figure out how many users are connected, i.e. if you are at home.

namaria• 2 years ago

Third party activity on your LAN is a legal liability.

account425• 2 years ago

There’s no useful attack that can be waged against your devices with knowledge of your wifi password.

Famous last words.

The idea that your LAN is a security boundary is out of date by decades.

I'm sure there are plenty of device and software vendors that haven't gotten the news. And exploits exist - no reason to carelessly discard a defensive layer just because it isn't 100% perfect.

rkagerer2• 2 years ago

Android needs a "Backup My Data to My Own Cloud/Device" option. Unfortunately that's gotten much harder to do over the years (as they've neutered the relevant API's).

xp847• 2 years ago

Yeah. tbh we are lucky on the Apple side that itunes existed and had a backup facility (Presumably because WAN speeds were so slow for many people in 2007). You can bet if the iOS platform were created today, local backup would have never been a thing there either. "Just trust the cloud!"

e44858• 2 years ago

https://github.com/seedvault-app/seedvault

It's included in GrapheneOS, so you can backup things like WiFi passwords to a local NextCloud server.

spr-alex• 2 years ago

This exactly. Eeros, Nest/Google Wifi, and other cloud based mesh devices all likely have access to the password as they send it down to the app.

I work on SPR @ https://www.supernetworks.org/,w e keep data self hosted, instead of a database in someone else's cloud.

datahack• 2 years ago

No, and all it does is prove, once again, that big tech companies cannot be trusted to sustain even common sense privacy concerns.

We need a privacy bill of rights. It’s time! The GDPR shows the way, and we can even improve on it with hindsight.

We’ll never get ahead of the data harvesting and exploitation of that data without it and all of this becomes quite an acute problem when we add low cost cognitive digital intelligences to the equation.

rustcleaner• 2 years ago

Just reading these comments - is everyone OK with them sending your password to a server, but not with the lack of encryption?

Take a poll and see how many iPhone users are here. Now realize the remainder are on some OEM Android! 50/50 I am the only one to reply to you running GrapheneOS. People WANT it to be this way, because any other way is too much work. It's how oligarchy arises!

I am not being hyperbolic, y'alls bitlocker codes are going to Microsoft soon if not already with 24H2.

Being into technology on a tech hacking [orange] subreddit does not put one into the same group as the tradecraft-savvy.

hulitu• 2 years ago

Of course. As long as they are not _Chinese_ servers. You see, US is our friend. /s

dan-allen• 2 years ago

Of fucking course

bastien22• 2 years ago

We've been here before. OE firmware needs to be assumed hostile and either replaced with open source aftermarket firmware, or the device sequestered in a subnet with no internet access.

fifteen15062• 2 years ago

Nobody got time for that.

Unified online DB for devices and brands regarding nuisances.

Add ads, micropayments and Flattr-like mechanisms for sustainability.

0xedd2• 2 years ago

Maybe you'd also like a cloud service that ties your shoes? God forbid you should move a muscle.

pkaye• 2 years ago

Testaankoop suspects the security issue might stem from third-party software used in the Linksys firmware.

What third part software does Linksys use on that router?

hsnewman• 2 years ago

Security key <> passwords

jedisct1• 2 years ago

First thing to check before buying a router: if the firmware can be replaced with OpenWRT.

hindsightbias• 2 years ago

And who built the OpenWRT firmware? I bought a gl.inet that comes with OpenWRT but since it's made in China (like every other router) I looked at the OpenWRT blobs and for all I know they're built in China too.

robertlagrant• 2 years ago

Replaced with.

gitaarik• 2 years ago

You can install it yourself, not buy something with it pre-installed

blackeyeblitzar• 2 years ago

I’ve really disliked the change in the router industry where the routers have become ‘smart devices’ instead of reliable local networking hardware. This has turned into the same abuse of customers we see from others. For example TP Link uses the same dark patterns in their routers as companies like Roku, where they make updates to the terms of service and force you to accept it in a pop up if you want to use the app. And the app is the ONLY way to access most of the router configuration features, as compared to the old method where routers would let you navigate to a password protected website to configure them. So if you don’t accept the new terms, you can’t control your router that you were able to control all this time. Additionally their app constantly pushes trials of their useless and unwanted services through nudges within the app like red circular badges next to menu items and user interface elements. It wouldn’t surprise me if their terms also let them abuse my privacy and security in the same way as Linksys.

But who else do we go to? Every company is doing this. Maybe they just cannot survive without it. It’s probably why we need regulation here (consequences for security breaches, limitations on terms of service abuse, etc).

rasengan2• 2 years ago

I also want to mention that Linksys is owned by Cisco whose hardware probably touches the majority of the internet directly.

lotsofpulp3• 2 years ago

Linksys has not been Cisco since 2013. Right now, Foxconn owns it. Belkin owned it before that.

Cisco sells Meraki, which they bought in Dec 2012.

megous• 2 years ago

Very happy with my own router with my own software (just regular Arch Linux ARM). :) The thing that guards access to and from my internal networks really deserves to not be so turdish. I'd hate to pay $350 for such a betrayal.

Some things can apparently only be bought with your own time, when it comes to "but you had to spend cumulative 3 days setting up your custom thing, so it didn't really cost $100" equation that people will throw at you if you tell them that you have built something yourself from relatively cheap components.

abadpoli4• 2 years ago

Is this actually plaintext, or is this plaintext-inside-HTTPS? The article and source material don’t say.

It’s pretty normal for passwords to be “plaintext” inside an HTTPS request. That’s how practically every login to a web app works. If it’s not HTTPS, there’s a whole slew of other issues along with putting a plaintext password in the request.

If it is HTTPS, then the issue really is just that the password gets sent anywhere rather than staying local. This is a lot more debatable as a practice, but unfortunately is also common for a lot of routers to support their cloud/app management functionalities.

SahAssar9• 2 years ago

is also common for a lot of routers to support their cloud/app management functionalities

Why does the cloud need to know the wifi password to support mgmt functionalities? The only reasons I can think of right now are for more "automatic" setup of a second unit for meshing or if you want a factory reset to have the same password. Both of those cases have better solutions.

If it's for setting a new password I don't see why they need the old one, if it's for remote management access using the wifi password as the access credential then that seems both bad (access to my network should not mean access to manage it) and like it can be done a lot better if actually needed (send just a well salted and hashed password).

iudqnolq2• 2 years ago

This appears to be a cloud password first stetup feature. As in you type your new password into the app, the app sends your password to a cloud API, and then the cloud API instructs the router to change to the new password over a management API.

So the password is sent for a specific feature that legitimately wants it.

You could have the app connect to a special WiFi network and then communicate directly with an API exposed by the router. That's what my router does. But the experience of using a special-purpose WiFi network is janky on many common devices so I understand not taking that choice.

nerdbert3• 2 years ago

If they intercepted it, then one must assume it was truly plaintext. Because if they were able to get access to the private key for Linksys's server certificate, that would be even bigger news.

TheRealDunkirk• 2 years ago

Does anyone think that Netgear isn't doing the exact same thing with Orbi? (It's a given that Google is doing it with Eero.) Anyone taking odds on Ubiquiti?

lotsofpulp3• 2 years ago

Eero is Amazon.

tombert4• 2 years ago

My access point is still Ubiquiti, since I haven't found a solution to get WiFi access across my house that works directly with my homebuilt router that I'm sufficiently happy with. I'm sure Ubiquiti is doing the same stuff, behind the scenes.

I'm open to suggestions if anyone has them on the best way to avoid this.

xp847• 2 years ago

In case you know -- is there a way to get into Ubiquiti without having a drop where I need the secondary AP? Today I use an Eero at the cable modem and a second Eero just mounted on the ceiling upstairs with . I'd like to move to something that isn't locked down the way Eero is (and which has a web UI), but I like the whole 'mesh with a dedicated backhaul on a separate channel' thing. My house is constructed in a way that would make running ethernet upstairs not convenient.

banish-m42• 2 years ago

I have Ubiquiti APs that run off a local UniFi VM. The APs don't have internet access and the UniFi box has only limited access to grab firmware updates. No need to trust when you can enforce limits on a separate router running a FOSS OS like opnsense.

ftrobro• 2 years ago

Don't most websites send passwords in plaintext for login and rely on the connection being HTTPS for having any security at all? I don't like that, but seems to be very common, so I'm not surprised about the plaintext part of this article. But that the passwords are at all sent to a server, that did surprise me, good to know.

sofixa• 2 years ago

Plaintext can mean a few things - encrypted in transit using an HTTPS connection means it's no longer plaintext.

abadpoli4• 2 years ago

The article and source material are light on details here. My guess is that it is using HTTPS, but the researchers saw the plaintext password in the request and assumed “password in plaintext always bad”.

If the app isn’t using HTTPS, then the story would be much bigger than just the password being plaintext.

jhdifdhsak• 2 years ago

so just like unify circa 2017?

it was over ssl, but still.

hpen• 2 years ago

Only the hacker news crowd is arrogant enough to call them out for check if that password was hTTPS but not for actually giving a fuck about the lack of privacy. SMH hacker news

HumblyTossed2• 2 years ago

I really wish wifi router OEMs would use OpenWRT. They could skin it (ala gli.net) if they wish, but at least use it. It's open. It works. You can still differentiate your product by making it have MOAR ANTENNAS! and continue to add up all the speed numbers to make it look REALLY FAST!!!!

mouse_• 2 years ago

I'm really glad OpenWRT does not share a similar fate to Android.

HumblyTossed2• 2 years ago

The point being that if one has the technical ability, they could just flash stock.

tombert4• 2 years ago

Or if they're worried about GPL stuff from Linux, there's also OpnSense, which works fine and I think is well respected.

I'm nerdy enough to have built my own router with OpnSense a few years ago, and it worked like a champ. The only reason I stopped was there was an issue with BSD and a specific Broadcom 10Gbe card that I couldn't work around, so I ended up hacking something together with ClearOS and eventually NixOS.

VTimofeenko3• 2 years ago

Are any parts of your nixos router config available publicly? I also rolled my own and am always on the lookout for inspiration

microtonal• 2 years ago

That and Apple should bring back AirPorts. They were easy to set up, performed well, had some advanced features, and got security updates for many years.

Two years ago or so, my office mate and I pulled out an old AirPort Extreme when our Fritz!Box broke. Not only did it still work very well, it was still pretty competitive as an 802.11ac router.

mjevans• 2 years ago

I've never bothered to install a theme for it, but https://openwrt.org/docs/guide-user/luci/luci.themes they do exist. There's really no good reason they couldn't.

jofla_net• 2 years ago

My old Araknis AP was just a reskinned OpenWRT, trudat.

twic• 2 years ago

I learned a few hours ago, for unrelated reasons, that there is at least one which does. GL.iNet ship routers running their in-house build of OpenWRT:

https://www.gl-inet.com/support/firmware-versions/

https://github.com/gl-inet/openwrt

And it's straightforward to install stock OpenWRT using OpenWRT's sysupgrade method:

https://openwrt.org/toh/gl.inet/gl-mt6000#installation

stragies2• 2 years ago

A whole bunch of GLI.NET devices use SOCs, where Linux mainline kernel support was never upstreamed. So buying GLI.NET is not a surefire way to obtain Hardware, that's runs 'Proper OpenWrt', you still have to check the HCL, or better/up2date, the list of DTS files in the current git master of openwrt.

rfoo• 2 years ago

A lot of them already are running OpenWRT.

It's just not the upstream OpenWRT. Instead, it would be an ancient version of OpenWRT with an ancient Linux kernel (hint hint).

Guessed why? Yeah, the same story as Android. Hardware vendors (those actually designing wireless chips, like Qualcomm and Mediatek) based their official SDK on an ancient version of OpenWRT and piled on tons of non-upstream-able patches to implement drivers.

gwbas1c• 2 years ago

Years ago, I caught some overseas contractors writing passwords to a log file. It wasn't malicious on their part, it was ignorance. (But, that kind of mistake is highly unprofessional and shows a lack of insight from someone who should know better.)

I suspect that someone has some debugging flags that do this, and accidentally shipped with the flags set the wrong way.

kps• 2 years ago

Heck, Apple did that once (CVE-2012-0652).

meling• 2 years ago

I wish Apple would get back into the WiFi router business again. I trust their privacy/security posture more than most other brands. Sadly they sell Linksys routers as the go to replacement for their previous products.

0xedd2• 2 years ago

Sorry, no one is interested in a device subscription business model. People like to own their hardware.

stragies2• 2 years ago

As long as

* source is available for the boot-loaders, all onboard devices.

* Firmware source available for all NPUs, 'offload engines', and other devices in Ethernet data path.

* mainline linux kernel supports a fully blob-free bootup (except Wifi/RF)

* a jumper enables trustzone access, with complete key management available to the enduser

* populated serial UART port header on the inside. (optional)

... Then I don't care who builds it. But I can't image Apple would build such a user-friendly device, that I could just easily install OpenWrt on 5 minutes out the box. Plus they'd probably fleece you.

bundie• 2 years ago

This is very bad.

fifteen15062• 2 years ago

Don't worry, as long as its not a Chinese company we are fine.

ddggdd• 2 years ago

I never use phone app for router, and always block router calling back home through adguardhome, linksys do 2 every minute, some other brand do every 2 seconds.

micahdeath• 2 years ago

So, we should use common (hacked) passwords for our wifi routers. So, my password of 'mickeymouse' is probably compromised. (Password chosen because my young children can spell it from the disney show.)

bootbloopers• 2 years ago

This seems like something that would be fairly easy to show proof for using ghidra/binary ninja/ida pro.

I wonder why they didn’t provide any disassembly/decompiler output, or other information on the offending binary

Linksys Velop routers send Wi-Fi passwords in plaintext to US servers

Related Stories