During installation, the router sent several data packets to an Amazon server in the US. These packets contained the configured SSID name and password in clear text, as well as some identification tokens for this network within a broader database and an access token for a user session that could potentially enable a MITM attack.
Linksys has refused to acknowledge/respond to the issue.
What does this mean, that the use plain HTTP or some other protocol? I can’t see details.
From what I can find, by “These routers send your credentials in plaintext”, they actually meant to say, “The mobile app sends credentials in plaintext.”
If you use the web interface then your credentials are not sent in plaintext. The routers themselves also don’t send credentials in plaintext.
The people who found this out got that wrong, and a lot of people are confused because they didn’t expand on “in plaintext.” They could be a little more professional / thoughtful.
Edit: I’m also thinking about the “may expose you to a MITM” bit. I think if it was https then a MITM (assuming all they can do is examine your packets) wouldn’t work because the data can only be unlocked by the private key. It sounds like it was an http connection?
This is what I’m thinking too. The only likely scenario under which the plaintext and MITM words make sense together is HTTP. I wouldn’t put it past Linksys to have used an HTTP API endpoint but these days a lot of things scream if you use HTTP. Thanks for the work!
Two important points raised:
- Why is Linksys sending your Wifi details, as well as your private password, outside of your home
- If they’re doing it, why are they sending your critically important private information unencrypted onto the public internet
The answer to the first one may be semi-legit as these are mesh products. As in, the other nodes in the mesh will need this information, and it appears that Linksys has decided to store your security data in AWS for the other mesh nodes to retrieve it when you’re setting it up. I’d sure as hell like to know this before the product does this. Further, I’d much prefer to simply attached to each mesh node myself to input the secured credentials instead of sending them outside to the internet.
There’s not excuse for Linksys sending the creds unencrypted onto the internet.
I’m just finding no confirmation that they send them unencrypted over the Internet and I’ve seen “researchers” calling sending passwords over HTTPS “unencrypted.”
Mesh coordination is interesting. It’s not great. That said I doubt that any off-the-shelf consumer mesh system does go through the work to keep things local-only. It’s too easy to setup a cloud API and therefore likely all of them do that since it’s the cheapest.
I’m just finding no confirmation that they send them unencrypted over the Internet
Even if they were sending them with proper E2EE to their server, that would still be a huge fucking problem.
calling sending passwords over HTTPS “unencrypted.”
The channel is encrypted, the content is not. It is a password, why would they need it?
How would they know that the device sends the SSID and password otherwise? If it was encrypted you would not be able to read the content of the packages.
If you get root on the device you can MITM it by extracting session keys
and I’ve seen “researchers” calling sending passwords over HTTPS “unencrypted.”
That’s because the password is unencrypted.
HTTPS will encrypt the channel and the data in flight, but the data is still unencrypted and anyone with a key that validated (assuming it actually checks for certificate validity) now has access to your unencrypted password. So yes, even over HTTPS it should be considered unencrypted.
Whether or not they’re sending it over an encrypted channel, they’re still sending out an unencrypted password that they have no need for. Linksys has no reason to need the unencrypted password, and at best would only need a hashed password to accomplish whatever business case they’re sending that to solve. We have to assume that they’re also saving it in clear text given how they’re sending it in the clear as well.
No password should ever leave your network unencrypted, no matter the data channel encryption. Anything less is negligence , and the vendor should not be trusted.
Even then, the other nodes would only need the hash of the password, not the password itself.
That depends entirely on the auth system, but you can use a separate credential to retrieve the password (using something like a PAKE algorithm)
Why are they sending that data to Cisco at all? That’s a ridiculous privacy violation, especially if they’re stupid enough to do it in cleartext.
You mean Linksys, not Cisco. Cisco sold Linksys to Belkin, now Foxconn, like over a decade ago. I think it’s a pretty important distinction considering Cisco is enterprise focused and linksys is more home/consumer focused.
This is why I don’t run consumer crap. Among other reasons.
Have any good recs for nonconsumer wifi mesh system that is not too far off from consumer prices? I had a velop system for awhile and it was torture. This thing stems from horrid design and will likely always be awful. Use an Asus system now and have been happy with it. Used to run Asus systems with merlin, but admittedly running stock firmware now.
Ubiquiti gear is very solid for the price. Start with their dream machine (check eBay for used, just saw one for $150, otherwise $300 new), and then add nano access points as needed. Enterprise gear for a fraction of the price.
Isn’t Ubiquiti back to being a “have to make a cloud account to control all your local devices” company?
They’re either or. Their configuration device is called a cloud key, but it runs locally on your network. You can choose to enable cloud management, though everything can be administered locally, nor do they punish you for it.
You can also run the Network Controller on any PC or even Home Assistant if you dont need to do any advanced traffic routing features.
The only disadvantage is that updates cannot be automatically applied while the network controller is off, the APs however do work fine without it, as long as they are configured once.
Unifi is probably the best you’ll get for prosumer. Unfortunately it’s not without flaws either. I’d take it over the junk consumer brands any day still. Because I work in the industry and I like to use a lot more advanced things, I can’t get myself to use anything other than opnsense for home use. I have a protectli for hardware. You can install pfsense, opnsense, probably even ddwrt which is probably the most friendly of the bunch from what I hear. I use a ruckus poe fanless switch, but this is the least important for a typical home user network. Just get something that has poe and isn’t cloud managed 😂
I thought Ubiquiti moved back to cloud managed on everything? Or is that just the network cameras?
You do know that enterprise doesn’t make you safer, right? Consumer gets hit by botnets, enterprise gets hit by higher level attacks.
I don’t get your point. This isn’t an attack, this is a cheap consumer company doing what they do best and stealing your personal information because $ and other crap. If this happened in enterprise they’d be in so much shit with laws. Cisco, juniper, Aruba, etc are not going to be shipping off your passwords because that liability is going to be a big problem.
Enterprise level stuff also charge top dollar and don’t need to sell your data to make more money.
If enterprise level stuff we’re doing this intentionally they’d be out of business. This would not fly with SOC and other security designations.
Additionally just because a consumer uses enterprise gear, that does not make them a larger target. I’m not Microsoft. No state attacker is going to want my worthless data.
Additionally just because a consumer uses enterprise gear, that does not make them a larger target.
It’ll make them a target of attacks targeting that class of gear.
Most threat actors are looking at who owns what IP space and checking the IPs of that, or what other public info they can find (website address etc). Not chasing after someone with a consumer internet IP. There is just not the same incentive.
This. This is why I have trust issues and only run devices I can flash OpenWRT (or other appropriate custom firmware) to.
I use enterprise hardware that has enterprise router firmware. In my case, I use Microtik with RouterOS. If it’s good enough for big enterprises, it’s probably good enough for me.
I use enterprise gear, but not the original software for it (and sometimes, not even the original purpose). I get it all second hand, and the subscription / licensing is usually non active. I think the only gear I used with the original OS was my Brocade fibre channel switch.
My current router is former Barracuda Load Balancer 340 now running OpenWRT. Cost me $45 and handles everything I need to throw at it and more.
Not a bad way to do it!
I just went down the ubiquity dream machine and a real switch with APs in mesh mode
Nice!
A drunk eBay excursion scored me 20 Aruba AP-105s for $12. Flashing OpenWRT to them was a brute, but they’re still going strong.
I originally set them up to mesh on the 5 GHz and provide AP coverage on the 2.4, but since they’re PoE and didn’t come with adapters, I got rid of the mesh and just have one in every room.
It’s like all the tech companies are actively working together to give us trust issues at this point. Used to flash things for fun because I can, more and more it feels like it’s a necessity just to get basic human rights respected.
Yep.
Every piece of networking gear in my house (except my ONT grrrrr) is running OpenWRT. Which also makes it nice since I can script any changes and push them out.
Is the ONT in bridge mode?
Yeah. I get my wan IP assigned to my router.
Exacly. You basically need to flash something like grapheneos on your phone, install linux on your computer and run custom firmware on your router to even have any semblance of privacy
Me too, me too… :)
Wow, Linksys in 2024 still thinks like it’s 1998.
1984
