6 ms·
TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
- jammo 9mo ago[dead]
- JaggedJax 9mo agoIt's probably fair to assume that most of their other camera models are affected by the same or similar issues. It looks like they pump out quite a few models that I image have similar firmware. This page[1] lists the C200 as last having a firmware update in October, but also lists the latest version as 1.4.4 while the article lists 1.4.2. It seems like they have pushed other updated in this time, but not these security fixes. [1]https://community.tp-link.com/us/smart-home/kb/detail/412852 https://community.tp-link.com/us/smart-home/kb/detail/412852
- sidewndr46 9mo agoI looked at some older Zyxel products and came to the same conclusion a while back. There's a whole industry of labeling generic hardware as being part of someone's else ecosystem https://www.hydrogen18.com/blog/hacking-zyxel-ip-cameras-pt-1.html https://www.hydrogen18.com/blog/hacking-zyxel-ip-cameras-pt-... https://www.hydrogen18.com/blog/hacking-zyxel-ip-cameras-pt-2.html https://www.hydrogen18.com/blog/hacking-zyxel-ip-cameras-pt-...
- defraudbah 9mo agoit's a stretch to call it generic hardware, all of cheap cameras use similar hardware, but every few months there is a new version of chip which you need to adjust to. It's challenging to find an exact chip if you want to, because they get out of date faster than JS frameworks
- tehlike 9mo agoThey lend themselves to local connections, however, so they are workable for the tech savvy. Definitely a problem for regular users.
- aaronax 9mo agoThis is so bad that it must be intentional, right? Even though these are dirt cheap, they couldn't come up with $100,000 to check for run-of-the-mill vulnerabilities? There must be many millions sold. Quite handy for some intel agencies. I assume any Wi-Fi camera under $150 has basically the same problems. I guess the only way to run a security camera where you don't have Ethernet is to use a non-proprietary Wi-Fi <-> 1000BASE-T adapter. Probably only something homebuilt based on a single board computer and running basically stock Linux/BSD meets that requirement.
- formerly_proven 9mo ago> I assume any Wi-Fi camera has basically the same problems. ftfy
- tehlike 9mo agoSome cameras that "charge" with USB also can use a USB network adapter (provided they can supply power). For the tech savvy, there is thingino as a firmware alternative - works local only, no cloud, and supports mqtt etc.
- stragies 9mo agoIs there a table of supported hardware, that contains info about the USB-connection (or ethernet) on these devices. Like, which have data-lines connected, can the device electrically do host and device mode? Can I use a POE2USBC adapter, that presents itself as a USB-network device to the camera? Ability to filter on those columns would be great. Is thingino using the Ingenic linux kernel 3.ancient SDK version, or do they have/use something newer?
- fylo 9mo agoDon't put them on untrusted networks. This always seemed obvious to me.
- tehlike 9mo agoUntrusted network is not sufficient, you need to cut them off internet, in general.
- mlaretallack 9mo agoVery interesting, I had a go with Ghidra and AWS Amazon Q, used it to reverse the video feed on a toy drone. I did not think to look for GhidraMCP, would of made it a lot quicker.
- shreddit 9mo agoAs soon as i read the author used grok as an ai assistant, i was somehow less interested to keep on reading. Not because of the usage of ai, but the chosen provider. (I don’t know whether grok is just the best choice for this kind of work.) Is it wrong to judge people for their choice of ai providers?
- walterbell 9mo agoWhich AI providers have access to real-time Twitter data?
- blibble 9mo agowhen has anything of value been posted on twitter?
- 2gremlin181 9mo agoGenuinely curious, what are some use cases that you require live Twitter data in your LLM for?
- walterbell 9mo agoThe topic of this HN thread: security, which is ever-evolving.
- sroussey 9mo agoOnes with better answers. Twitter dumbs down grok.
- sva_ 9mo agoI think when your political views cloud your ability to take in information on an objective level, it might be bad.
- wh0thenn0w 9mo agoYou can just not like Elon, doesn't have to be political at all.
- robertpohl 9mo agoIf a friend have this camera, shuld he be worried?
- sciencejerk 9mo agoYep
- buddhistdude 9mo agonot necessarily worried, but like put on some pants before entering the room
- tamimio 9mo agoPer the article, the attacker can restart the camera and potentially find the accurate position of it. However, if the attacker can be physically in proximity within the camera range, they can MITM it and intercept the video feed. So it depends on your friend's threat model. If the camera is recording something in a public location and they don't mind the location being exposed and potentially the video feed (like plenty of live public cameras), then it shouldn't be an issue. Otherwise, they need to disable it until it gets fixed.
- reddalo 9mo ago> they can MITM it Can they? I thought they could only do it if they're in the same LAN.
- defraudbah 9mo agothe exploit is to make camera disconnect and connect to your wifi, that's how they MITM, pretty long process unless you do it often
- buddhistdude 9mo agocould be automated though?
- SilverElfin 9mo agoSo which camera brand has adequately designed software? It’s hard to know as a consumer what to trust or not trust, because how do you evaluate the quality of their work when the device SEEMS to work as expected? Is Ring the only choice?
- notjosh 9mo agoI've installed Thingino on my cameras such as this. Cheap camera + custom (local only!) firmware is a good solution imo. No guarantee that it'll be perfect either, obviously, but it's open source and actively maintained. Highly recommended.
- dns_snek 9mo agoThingino is great for many other reasons but security is not one of them - definitely segregate those cameras on a locked down VLAN. The web interface is HTTP-only and it uses the same credentials as root SSH access on the camera, and most of the web ui handling code is highly questionable to say the least.
- ssl-3 9mo agoIf the firmware is not open and buildable, then it can only be an untrustable black box. If you don't want untrustable black boxes hanging around, then your options become pretty limited. You can DIY something with an SBC like a Raspberry Pi or whatever. You can hang USB cameras off of your computers like it's 2002 again. You can try to find something that OpenIPC or thingino or whatever supports. (You'll never finish with this project as the years wear on, the hardware fails, product availability ebbs and flows, and the scope changes. Maybe that sounds like a fun way to burn time for someone, but it doesn't sound like fun to me.) Or, you can accept that the world is corrupted -- and by extension, the cameras are also all corrupted. The safe solution is then actually pretty simple: Use wired-only cameras that work with Frigate (or whatever your local NVR of choice may be), keep them on their own private VLAN that lacks Internet access, and don't worry about it. The less-safe solution is also pretty simple: Do what everyone else is doing, and just forget the problem exists at all. Switch your brain off, buy whatever, and use it. (And if there's an area that you don't want other people to see, then: Don't put a camera there.) (We probably are not as interesting as we may think we are, anyway.)
- rao-v 9mo agoI'm a little frustrated with articles like this that scattershot their critique by conflating genuine failures with problems that even FAANGs struggle with. In particular, I don't love it when an article attacks a best practice as a cheap gotcha: "and this time it was super easy! After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No authentication required. So, you can list and download every version of every firmware they’ve ever released for any device they ever produced" That is a good thing - don't encourage security through obscurity! The impact of an article like this is as likely to get management to prescribe a ham-handed mandate to lock down firmware as it is to get them to properly upgrade their security practices.
- tecleandor 9mo agoYep, I think it should always be that way, firmwares should be always available.
- jabedude 9mo agoI didn't notice a negative tone at all when he talked about the firmwares being publicly hosted. You did?
- AceJohnny2 9mo agoYes, heavily, because of the use of adjectives and repeating the points. Here, I'll emphasize the words that elicit the tone: > After some basic reversing of the Tapo Android app, I found out that TP-Link have their entire firmware repository in an open S3 bucket. No authentication required. So, you can list and download every version of every firmware they’ve ever released for any device they ever produced: [command elided] The entire output is here, for the curious. This provides access to the firmware image of every TP-Link device - routers, cameras, smart plugs, you name it. A reverse engineer’s candy store. Highlighting (repeatedly) the ease and breadth of access is a basic writing technique to illustrate the weakness of a security system.
- sally_glance 9mo ago
- nine_k 9mo agoI more and more tend to not buy any network-connected product if there's no open-source firmware to run on it. (Phones is one notable exception. I need contactless payments to work.)
- mindslight 9mo agoIf you call up your contactless payment provider, most will send you a physical device that will do contactless payments on its own, for free even. You can tape it to the back of your phone, or anywhere else for that matter.
- chatmasta 9mo agoAlso, your phone doesn’t need to be connected to the internet for contactless payments, anyway.
- tehlike 9mo agoGood thing some tapos do have alternative firmware like thingino.
- dns_snek 9mo agoYou should still treat it as radioactive waste. Protect it and protect yourself from it - segregated VLAN, no internet access, just like you would do with official firmware.
- tehlike 9mo agoThingino supports C200 https://thingino.com/#:~:text=SC3336%2C%20WQ9001%2C%208MB-,TP%2DLink%20Tapo%20C200,-T23N%2C%20SC2336P%2C%20RTL8188FTV https://thingino.com/#:~:text=SC3336%2C%20WQ9001%2C%208MB-,T...
- c0l0 9mo agoI came here to post this, too :) What the thingino community managed to do with their firmware for these cameras is nothing short of amazing - if you happen to have a compatible camera, you really, really should give it a whirl!
- rescbr 9mo agoOh, this is great! I do have this exact camera and another one that’s on the list! I’m more than happy to ditch the scrappy RTSP setup that I have to support these cheap cameras!
- kqr 9mo agoI'd love to but... how? One alternative seems to be a programmer chip that must be puchased and then modified to not fry the camera with 5V. Another is maybe stripping a USB cable and soldering it to the wifi pads on the camera chip? Neither of these seem like good ideas for someone like me, who is relatively hardware naïve and has small children running around making it hard to concetrate for more than 30 minutes at a time. The question is genuine. I want to do this but don't actually know by which method.
- inferiorhuman 9mo agoI got a couple of Wyze cameras and loaded Thignino via SD card. No fuss no muss.
- kqr 9mo agoIn this case I'm asking specifically about the C200 this article is about. Sorry for not being more clear. From what I understand the C200 does not boot from SD card.
- syntaxing 9mo agoThis is why all my cameras internal or external live on an isolated VLAN with no internet access. It’s nice because HomeKit can still talk to them and I can see it online or locally without an additional app even though the camera themselves has no internet access .
- kapad 9mo agoHow do you set this up? (TL;DR version?)
- tamimio 9mo agoGreat article. I have the same model and few months ago I did notice it was restarting in a non-scheduled time, and you can tell it restarts because it does a full rotation. First time it happened I ignored it but the second time I knew something was up so I disconnected it and since then been offline, it was recording an insignificant thing anyway.
- deleted 9mo ago[deleted]
- VladVladikoff 9mo ago>25000 devices exposed directly How does this happen? Doesn’t pretty much every ISP give a router with their modem? How do people manage this?
- hdgvhicv 9mo agoIn ipv4 these will be src-natted and thus have a statefuo firewall by necessity. In IPv6 they likely will auto configure onto a public ip address which may not have a stateful firewall.
- VladVladikoff 9mo agoDoesn’t seem to be the case here all of these are ipv4 addresses https://www.zoomeye.ai/searchResult?q=IlRQUkktREVWSUNFIg== https://www.zoomeye.ai/searchResult?q=IlRQUkktREVWSUNFIg==
- magmostafa 9mo agoThis is exactly why network segmentation is critical for IoT devices. I always recommend putting all smart cameras and IoT devices on a separate VLAN with no direct internet access - only local network access through a firewall with strict egress rules. For anyone concerned about their TP-Link cameras, consider: 1. Disable UPnP on your router 2. Use VLANs to isolate IoT devices 3. Block all outbound traffic except specific required endpoints 4. Consider replacing stock firmware with open alternatives when available 5. Regularly check for firmware updates (though as this article shows, updates can be slow) The hardcoded keys issue is particularly troubling because it means these vulnerabilities persist across the entire product line. Thanks for the detailed writeup - this kind of research is invaluable for the security community.
- realcul 9mo agodo you happen to have a guide on how to achieve this - I am fairly technical but still configuring Vlans and moving devices there would be good with some step by step instructions.
- syntaxing 9mo agoAre you running Ubiquiti hardware? If so, should be very straight forward (one of the main reasons I went back to Ubiquiti stuff after running my own OPNsense router) https://lazyadmin.nl/home-network/unifi-zone-based-firewall/ https://lazyadmin.nl/home-network/unifi-zone-based-firewall/
- tapland 9mo agoP. Sure the camera in question breaks in fun ways. From my observations because it can’t update it’s time, so messing with it a bit leaving to a need to update, downgrade, block from the web again. But it’s worth trying
- defraudbah 9mo agodepends on your router, but you would want to stick to onvif or rtsp and connect to the camera using some sort of tailscale. Don't fail for installing open source firmware, there is only thingino and openipc, both are hard to install if you are a beginner, even if people say it's easy for technical specialist, it's not
- bgbntty2 9mo agoDo you think the S3 bucket with the firmware will be available for the foreseeable future? If not could someone archive it somewhere? Maybe make a torrent out if it? My network is very slow and I estimated it's about 990 GiB of data (by summing the column with the bytes in the ls output the author linked). It might be useful to have it as a resource in the future for a variety of reasons.
- tills13 9mo agoI have a few of these that I use with unifi for non-critical things over ONVIF and there's a reason they are on a separate vlan and not allowed to access the internet... Thankfully they don't die when you block them from phoning home.
- defraudbah 9mo agoI used this website to research the camera https://drmnsamoliu.github.io/ https://drmnsamoliu.github.io/
- burnt-resistor 9mo agoFor the home/lab, an second-hand enterprise network main switch and an OSS router like OPNsense to enforce security policies on the wired side of things. For WiFi gear, I've been a fan of Ubiquiti APs managed by a self-installed UniFi instance without cloud features. This, and some custom glue jobs/scripts on the unifi VM, make it easier to track down troublemakers and lock them down so they can't just dial-home or self-update and brick themselves. PSA: Don't connect any TV used a dumb monitor to the internet. This is like connecting your toaster to the internet and begging for trouble.