Slashdot Mirror
TP-LINK Loses Control of Two Device Configuration Domains (helpnetsecurity.com)
Reader Orome1 writes: Security researcher Amitay Dan warns that tplinklogin.net, a domain through which TP-LINK router owners can configure their devices, is no longer owned by the company, and that this fact could be misused by malware peddlers. TP-LINK has confirmed that they no longer own the domain in question, and will not be trying to buy it from the unknown seller for now. Instead, they intend to change the domain in the manuals to a newer one that's already in use.ComputerWorld has more details.
How does TP-LINK affect me or anyone I know? Nobody uses this. It doesn't matter to anyone and certainly isn't news. I'll get insulted and modded down, but nobody will be able to justify why this matters to anyone.
NIGGERS
HILLARY 2016!
The CW article says the router intercepts that domain name and redirects to an internally hosted web page.
When you use products like this, you get eat you deserve. When you use Facebook, you put yourself at risk. This is no different...
All your bases are belong to us!
Fucking chinease just don't know jack about nothing security.
Think about such issues the next time a device manufacturer wants restrict what you can do with the hardware you purchased. Such as examining and changing behavior, including security issues like this.
Shipping devices using patched-up software stacks put together god knows where... leaving customers exposed and vulnerable.
If it needs to call home to function, this shit will happen.
Cisco does this shit too.
Sure they still own the DNS address but it sets YOU up for a DNS-based attack, a oops-we-bricked-your-shit, or Spooks need access to your network.
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Can you give less of a fuck about security than that? Granted, TP-Link isn't particularly known for great or backdoor-less firmware, but still, such a public failure to secure your products should put a real dent in your sales.
Why not use local IP address to access configuration page? I think typing 192.168.0.1 is simpler, faster and error-proof than typing tplinklogin.net
the $5 a year was too much to maintain the security of its customers.
very sad
... that domain management is a little more involved than just registering it.
Had they used something like myrouter.tplink.com, they'd've still been in full control.
Bottom line: You do have to sit down and think, and come up with a strategy for this sort of thing. Something you can stick with for a couple decades. And to do it properly, you need to actually have some DNS clue. Why this is entirely too hard for manufacturers of networking equipment is a mystery to me.
You didn't actually read the article, it wasn't that they didn't pay for their domain, it was that there was a bug in their own registrar software that allowed someone else to register their domain even though the domain was already registered.
Why are the experts from Help Net Security just copy-pasting text from other sources and then spamming slashdot? Two-thirds of that article is copy-paste.
I couldn't agree more. Just replaced my old WRT54GL router with a dirt-cheap D-Link DIR-645 that was on clearance sale. Just checked that it could run OpenWRT before I bought it. Works like a dream with my USB 3G dongle, have had it for 3 months now. The original firmware would not even support modems, forcing you up to more expensive models despite the hardware being more than capable.
You can easily flash back the original firmware if you need to return it for warranty purposes. Most routers run U-Boot these days, it has never been easier to get a top-notch router for pennies. This is why we need the freedom to tinker!
They screwed up in a breathtaking way by losing their domain, and they arn't even going to fix it, putting countless people at risk of unknown bad actors?
I've never used these autoconfig domains myself, and I recently stopped using a TP-Link router I had because I just happened to buy an Asus instead. But with this news, I will *never* buy another TP-Link router again.
Decent network security is hard enough to maintain as it is, without having this sort of gross incompetence happen on top of it. Between this and the fact that TP-Link announcing that they will no longer permit 3rd party firmware on their devices, TP-Link is now a non-starter for me.
...the security of thousands of customers. Way to go, TP-Link.
Why the fuck can't people get this through their heads? It's bad enough that nearly every "IT person" is too fucking stupid/lazy to use a domain that will never resolve to a public server for the internal network. It's EVEN FUCKING WORSE that the networking equipment manufacturers are using PUBLIC DOMAINS BY DEFAULT. Seriously, WHAT THE FUCK?
Networking 101: DO NOT USE PUBLIC DOMAINS FOR INTERNAL NETWORK RESOURCES
Lots of companies do this stupid ritual of registering lots of domains for different projects and then when renewal comes along the company forgets about it and it lapses and then it causes them to run around screaming and shouting at people saying "Why did you not renew" What don't these firms just have one main domain like tp-link.com and then use sub-domains for each project and that why they don't have to worry about hundreds of silly registered domain names.
If the new owner of the domain puts anything up at tplinklogin.net, especially a fake login/phishing page, couldn't they be sued by TP-Link for trademark infringement?
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
I just want a router that I buy and goes in my home, but protects me from going to all the bad sites, disturbing content that offends me and can be turned off if a terrorists break into my home and try to use it to access hate material. Do they sell that?