11 ms·

Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google r

by Alupis 5y ago

Folks - these routers are secure. There is nothing to see here, move along. Here's the user manual for the TP-Link AC2300 "Archer C7", as found in the google results: https://static.tp-link.com/2019/201912/20191231/7106508598_Archer%20C2300(US)_QIG_V2.pdf https://static.tp-link.com/2019/201912/20191231/7106508598_A... Step 2 of first time setup forces a default password change. There is no way around this step. The defaults for the router also do not allow router access from the WAN port. This means: 1) These routers all have secured passwords that are non-default. 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. Just because it's not how you would configure your router doesn't make it wrong. There are legit reasons to place a router on the internet, so long as it's secured properly... how else would you remotely manage a router at a different physical location, for instance. __Lastly__ click "Next Page" on the OP search results. The estimated 7,000+ results becomes 21. Many of which are HN aggregators reporting on this thread here. So... out of the possible millions of routers TP-Link has sold in this model line, less than 21 are on the public internet - many of which no longer load via IP address (indicating they are no longer publicly accessible), and the rest have professional CNAME's attached, indicating professional management. Nothing here...

mullingitover 5y ago
I would love to know how these are secured. I doubt there's MFA or even rate limiting. > 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. That's making some very generous assumptions.
- Alupis 5y ago
  These are not high end enterprise grade kit, folks. Expecting things like MFA, secondary VPN endpoints, etc is just absurd for the target audience of this device. Again, just because you wouldn't configure it this way doesn't make it wrong. It's as secure as it can be, short of throwing a bunch of other kit in front of it, and then why would you be using a $100 consumer router anyway? The only vulnerability here is the possibility of a 0-Day. Everything else is either misguided or screaming for the sake of it.
  - SheinhardtWigCo 5y ago
    > The only vulnerability here is the possibility of a 0-Day. That's not exactly uncommon in cheap consumer routers. No rate limiting is as good as no authentication.
    - Alupis 5y ago
      > That's not exactly uncommon in cheap consumer routers. That's, in my opinion, the only fair criticism available here. > No rate limiting is as good as no authentication. Trying to even load some of the links found in Google takes 10's of seconds. That's effectively a rate limit, even if it doesn't temp-ban per IP address. Someone would have to dump the firmware to find out, but it would be trivial for each device to generate their own salt - making a potential lack of rate limit a non-issue.
      - jfrunyon 5y ago
        The load times are most likely primarily caused either by slow JS or high RTT/multiple requests, either of which could be trivially bypassed by an attacker. Or an attacker could just fire off 100 requests at the same time and saturate the bandwidth anyway, despite a high latency. And any high latency would likely be significantly lower if you happen to be in the same geographic area. Latency is not rate-limiting.
      - BeefWellington 5y ago
        > Someone would have to dump the firmware to find out, but it would be trivial for each device to generate their own salt - making a potential lack of rate limit a non-issue. Salting does nothing to protect against bruteforce attacks, which are what rate limiting defends against. Salting is done to protect passwords in the event the password data is stolen.
    - jrockway 5y ago
      I'm a big fan of rate limiting (and even rate limit my static pages) but if your password is secure enough, the lack of a rate limit isn't going to help attackers. I kind of agree with the comment that started this thread -- people that have explicitly decided to expose their consumer-grade routers directly to the Internet probably know about password managers. Even if you do guess the password and compromise the router, all you'll have is some remote office that is getting TLS errors because of your MITM, and best case control of some unpatched Windows 3.1 machine and maybe some developer's local MySQL install happily listening on port 3306 somewhere. That's not great, but it's a risk that some people are willing to take.
- csydas 5y ago
  >That's making some very generous assumptions. Disagree. In my current country of living, I'm not even sure how I'd properly expose the router I use to the public internet since I sit behind the ISP's NAT-ing, and even when I lived in the US, I am not confident I could tell you how to publicly expose the modem provided by Comcast for non-local access, much less how someone without any tech experience might do this. If this was a prevalent problem because of default settings, I'd expect far more than 7800 results; I am not willing to concede every instance is intentional, but 7800 out of the billions of routing devices in the world showing up on this search enforces my understanding that these 7800 entries are special in some way. >I doubt there's MFA or even rate limiting. MFA is not common at all on consumer routers, which at least quite a few on the first page result are, same with rate limiting. Even for Enterprise grade gear, the threat isn't the user-defined password, it's the manufacturer backdoors, which we've seen many of in the last few years. Rate limiting doesn't do much if you have a fair chance that you've got a back door. What likely __does__ help is that as far as I know, "Enable Web Access from WAN" is by default *disabled* on most consumer routers (and enterprise? that I'm not sure of), so I think that this leads credence to the devices on the Google results being exposed intentionally to some degree. (The owners' knowledge level not withstanding, this is a fairly out of the way setting, at least on my Asus router)
  - Alupis 5y ago
    > but 7800 out of the billions of routing devices in the world showing Click "Next Page" - estimated results turns into 21 results in total... of which a bunch are dead links, a bunch are HN aggregators... leaving just a small handful of actual devices on the internet.
  - jfrunyon 5y ago
    > I am not confident I could tell you how to publicly expose the modem provided by Comcast for non-local access You likely couldn't. That setting is usually gated behind some sort of "technician" or "mso" account (or not present, or only accessible from the devices telnet/ssh interface). Of course, it's probably not difficult to guess Comcast's password; past experience with other companies suggests you try things like "comcast" or "C0mc4s7". (Not even joking, Suddenlink and Spectrum/TWC.) > much less how someone without any tech experience might do this. Easy. It's a button that their kid clicked while playing around. > MFA is not common at all on consumer routers, which at least quite a few on the first page result are, same with rate limiting. Are you trying to say that's a positive for exposing it on the internet...?
- gsich 5y ago
  That would also be an assumption.
deleted 5y ago
[deleted]
nickstinemates 5y ago
SD-WAN / VPN / Many many many other solutions.
lmilcin 5y ago
> Folks - these routers are secure. There is nothing to see here, move along. If experience is any guide, they are not. Consumer routers have horrible track of embarrassing, easily exploitable vulnerabilities. That are not patched for a long time or ever. And exposing your router to public like that suggests the owner knows very little about security. This typically goes in hand with other neglect. Tell me, how many home users that are not security conscious keep their routers regularly patched and will replace the router when the manufacturer stops supporting them?
- nuker 5y ago
  > This typically goes in hand with other neglect. UPnP is on by default, yeah
- YPPH 5y ago
  What router does HN recommend for consumers? I personally run Ubiquiti Unifi gear, but they're not exactly consumer friendly (more geared to power users).
  - lmilcin 5y ago
    I personally run Ubiquiti Unifi myself, but after some news here on HN I have serious doubts and am in search of a better alternative myself. https://news.ycombinator.com/item?id=26638145 https://news.ycombinator.com/item?id=26638145
    - theshrike79 5y ago
      So are we all, but there isn't one really. Unifi fills their prosumer niche perfectly, no matter how much of an ass and mismanager the current CEO is. All of the competition either requires intimate knowledge of networking internals, is twice as expensive or both.
  - OneLeggedCat 5y ago
    Whatever I can keep an updated OpenWRT on.
  - 5y ago
szidev 5y ago
not every tp-link model (or revision, or locale, or firmware version) that shares a web interface with the c7 requires you to manually set a password. even if that were the case, there are bound to be users who aren't security savvy and chose a very weak password (e.g. "password", "admin"). many tp-link routers also have configurable vpn servers built in, which can open up the whole network to malicious actors.
amanzi 5y ago
You're making some massive assumptions here. Exposing your router's admin page to the internet is not good security practice. These routers are protected by nothing but a password, and I couldn't see anything in the manual that enforces password length/complexity. So while the password might be non-default, it could still be incredibly insecure. Also, to expose these routers to the internet, all it takes is a single checkbox to enable "Remote management". So your assumption that these have all been deliberately placed on the internet also doesn't hold up because I can definitely see a curious home user playing with these settings without realising the impact of this. There have been tons of similar reports in the past where home users have exposed things to the internet without realising the impact.
system2 5y ago
Why would the search engines index these though? That's the question, not their default security.
ericyan 5y ago
> These routers all have secured passwords that are non-default. Secure passwords is just a tiny subset of non-default passwords. Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. > These routers were deliberately placed on the internet by people that knew enough about them to do so. This means these people knows how to expose the management interface to the internet. It does not mean these people have enough knowledge on securing their devices -- based on their actions, it is more likely that the opposite is true.
- ascar 5y ago
  > Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. https://xkcd.com/936/ https://xkcd.com/936/ So you think the chance of human beings to come up with 4 random words is pretty low? You can't brute force millions of guesses per second through a web interface. 40 bits of entropy is already plenty for internet usage especially when the password is properly hashed with something like bcrypt. > Secure passwords is just a tiny subset of non-default passwords Actually the exact opposite is true. Since only low entropy and publicly known (which are mostly low entropy) passwords are insecure there are much more secure than non secure passwords. For the sake of argument, let's say all passwords with less than 40 bits of entropy are insecure. Even if we restrict the set of possible passwords to only 10 characters of lowercase a-z we have about 47 bits of entropy. So the set of insecure passwords would only be about 1/128 or less than 1% of all allowed passwords.
  - BeefWellington 5y ago
    > > Secure passwords is just a tiny subset of non-default passwords > Actually the exact opposite is true. Since only low entropy and publicly known (which are mostly low entropy) passwords are insecure there are much more secure than non secure passwords. You're confusing "passwords that are in use" with the set "passwords that are possible". We have data via password dumps that suggests of the "passwords that are in use" the set that qualifies as "secure" is indeed a tiny subset of passwords.
  - 5y ago
jrochkind1 5y ago
What you say is sensible, except for: > The estimated 7,000+ results becomes 21. Many of which are HN aggregators reporting on this thread here. Nope, Google is just collapsing them because they are all identical copies of the same "page", being the same login screen. Most of them look like routers, you can ask Google to "include" them all and see for yourself. https://www.google.com/search?q=%22Please+log+in+with+router%27s+password%22&filter=0 https://www.google.com/search?q=%22Please+log+in+with+router...
jfrunyon 5y ago
> So... out of the possible millions of routers TP-Link has sold in this model line, less than 21 are on the public internet Make that 47,000 of them on Shodan: https://www.shodan.io/search?query=hash%3A-904286784 https://www.shodan.io/search?query=hash%3A-904286784 > 1) These routers all have secured passwords that are non-default. You have a very interesting definition of "secured" if you think they are all actually secured. > 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. Just because they knew enough to click a checkbox doesn't mean they knew enough to do so. If they knew enough, they wouldn't have done so. You seem to be under the mistaken impression that embedded devices (like consumer routers) don't usually have glaring security holes. But they do.
fny 5y ago
OP. I'm posting this because I discovered a box at the hostel I'm at on Google after fat fingering the IP by mistake. (It's disconnected already.) The password was easily guessable. Aside from the anecdata, a counter argument is that the router manufacturer has taken no steps to obscure the routers from search engines. Sure someone could simply IP scan, but you have to admit this is a little absurd.
alerighi 5y ago
> 1) These routers all have secured passwords that are non-default. Who said secure password? Yes, they are not the default, but people are terrible at choosing password, most will choose weak password that are easy to exploit with a dictionary attack. > 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. A people that know what it's doing would never expose a router web interface on the internet. Most people doesn't know how to configure his router, and let the ISP technician configure it, and they probably expose the router interface so they can access it remotely for maintenance, but it's not a great idea... > There are legit reasons to place a router on the internet, so long as it's secured properly... There aren't. Also you can choose a secure password, but these router interfaces are full of bugs, and highly exploitable. Add to this the fact that the manufacturer rarely updates the firmware of these devices... > how else would you remotely manage a router at a different physical location, for instance. With a VPN? By creating an SSH tunnel to one machine inside the local network? By connecting remotely (via RDP, VNC, TeamViewr, whatever) to one PC inside the local network? There are a ton of better solutions. Also if you don't have a static public IP address, as it's in most situations nowadays, how do you access it remotely anyway? With dynamic DNS but it's not reliable. The best solution to me is using a VPN (I can connect to my home network from anywhere in the world and access all the hosts, including router and other networking equipment of course).
cafxx 5y ago
> these routers are secure. Owner of a C7 v4 here. There has not been a firmware update from TP-Link since December 2019 (note that v4 is the second-most recent HW revision). No way these are not affected by at least some CVE somewhere in their stack. Calling them secure is a leap of faith that TP-Link does not deserve. I recently flashed openwrt exactly to be able to be on a more recent stack. I would never dream exposing that UI to the Internet as-is. They don't even have any form of brute forcing protection. If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side. Either who set those up really has nothing to lose if they get owned, or they do not know what they are doing. In both cases, it does not qualify as being a secure setup. (Sure, they may also be honeypots - in which case your argument was incorrect anyway, as they are secure, but they are not routers)
- kralos 5y ago
  > If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side. any chance you can explain that to my mum?
  - yipbub 5y ago
    > it would be much saner to expose an SSH server with pubkey-only access or VPN It would be safer to leave open to the public only a secure protocol based on strong cryptographic keys instead of a password. Or you have to be signed in to a VPN to see the page. > brute forcing protection Try too many passwords? Try again in 1 minute. Again? 30 minutes > allow tunnelling to the router UI only from the LAN side I think this one means don't expose it to the internet at all. Just from your local network. >
  - msh 5y ago
    Your mom probably don’t need wan access to her router.
- input_sh 5y ago
nashashmi 5y ago
There is a lot here. Some of these are university routers. Tells me that the sysadmin wanted to open up the router so s/he can manage from home. Nifty. But not secure. And they are no way taking the extra effort to make their system secure.
jasonladuke0311 5y ago
The UI is using jQuery 1.10.0, released in May 2013. I would be surprised if there have been many bugfixes or security updates on these.
ytch 5y ago
Web server itself could be an attack vector too. Although not specified to TP-Link, There are many exploits on other brands that can bypass the Authentication. For example this one: https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2 https://medium.com/tenable-techblog/bypassing-authentication... Even allowing access the web server from internet could be dangerous.
ineedasername 5y ago
2) These routers were deliberately placed on the internet by people that knew enough about them to do so. If "placing it on the internet" was proof of excellent security knowledge & practices, then nothing on the internet would be insecure. Just because they knew enough to know how to place it on the internet doesn't mean they understood the implications of that decision.
throwaway984393 5y ago
Nice try, NSA.
spockz 5y ago
The sensible way to secure it would be to have a device behind the router, in an isolated network which is the only network/device allowed to access the management interface. Then you tunnel/vpn/wire guard into that device.
xondono 5y ago
If their router login page has been indexed, then the user most likely don’t know what they are doing. It’s fine to expose router configuration (although it’s not ideal), but if you know that you are doing, you’ll at least place it behind a VPN.
- dinkdinkdink 5y ago
  I know what I'm doing. I would be fine with this in some circumstances. There are legitimate reasons adding a VPN to a backdoor like this can make it worse. The trick to "knowing what you are doing" in this case is defense in depth and knowing what's actually accessible from a world-open interface, and how much of that would be really annoying to get to while simultaneously fixing your homebrew VPN that fell over six months ago and that you never got around to fixing. Most routers are perfectly fine with a limited set of knobs accessible to the public Internet behind reasonably secure access ports. Bastion it behind SSH and/or SOCKS if you're paranoid, but seriously, as long as we're not talking a $50 Target 'router', it's probably fine. My Ubiquiti gear is indexed. It also reliably e-mails me when it successfully authenticates a user and can distinguish between inside and outside access to ACL what it can do. Just saying, easy with the "if you know what you're doing" thing, because opinions differ (particularly with beyondcorp in an IT setting). Gluing a VPN back together through an SSH tunnel so you can get at the "fail over to my DSL connection" button inside your network is a really crappy deal at 3 a.m. with a few beers in you and 200ms in between.
  - xondono 5y ago
    > I would be fine with this in some circumstances. Maybe it’s just a matter of difference of criteria, but I would certainly not be fine with this. You have a lot of ways to prevent this from happening, and it only opens an attack surface to APTs. Being indexed means being searchable, being searchable means exposing yourself to automated targeted attacks.
ansn 5y ago
There are significantly more than 21 results listed on Google. Google automatically hides what it considers "duplicate results". There's an option to "repeat the search with the omitted results included" on page 2, which reveals all of the 7,000+ results, of which the vast majority are different routers.

by Alupis 5y ago

mullingitover 5y ago

I would love to know how these are secured. I doubt there's MFA or even rate limiting. > 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. That's making some very generous assumptions.

Alupis 5y ago
These are not high end enterprise grade kit, folks. Expecting things like MFA, secondary VPN endpoints, etc is just absurd for the target audience of this device. Again, just because you wouldn't configure it this way doesn't make it wrong. It's as secure as it can be, short of throwing a bunch of other kit in front of it, and then why would you be using a $100 consumer router anyway? The only vulnerability here is the possibility of a 0-Day. Everything else is either misguided or screaming for the sake of it.
- SheinhardtWigCo 5y ago
  > The only vulnerability here is the possibility of a 0-Day. That's not exactly uncommon in cheap consumer routers. No rate limiting is as good as no authentication.
  - Alupis 5y ago
    > That's not exactly uncommon in cheap consumer routers. That's, in my opinion, the only fair criticism available here. > No rate limiting is as good as no authentication. Trying to even load some of the links found in Google takes 10's of seconds. That's effectively a rate limit, even if it doesn't temp-ban per IP address. Someone would have to dump the firmware to find out, but it would be trivial for each device to generate their own salt - making a potential lack of rate limit a non-issue.
    - jfrunyon 5y ago
      The load times are most likely primarily caused either by slow JS or high RTT/multiple requests, either of which could be trivially bypassed by an attacker. Or an attacker could just fire off 100 requests at the same time and saturate the bandwidth anyway, despite a high latency. And any high latency would likely be significantly lower if you happen to be in the same geographic area. Latency is not rate-limiting.
    - BeefWellington 5y ago
      > Someone would have to dump the firmware to find out, but it would be trivial for each device to generate their own salt - making a potential lack of rate limit a non-issue. Salting does nothing to protect against bruteforce attacks, which are what rate limiting defends against. Salting is done to protect passwords in the event the password data is stolen.
  - jrockway 5y ago
    I'm a big fan of rate limiting (and even rate limit my static pages) but if your password is secure enough, the lack of a rate limit isn't going to help attackers. I kind of agree with the comment that started this thread -- people that have explicitly decided to expose their consumer-grade routers directly to the Internet probably know about password managers. Even if you do guess the password and compromise the router, all you'll have is some remote office that is getting TLS errors because of your MITM, and best case control of some unpatched Windows 3.1 machine and maybe some developer's local MySQL install happily listening on port 3306 somewhere. That's not great, but it's a risk that some people are willing to take.
csydas 5y ago
>That's making some very generous assumptions. Disagree. In my current country of living, I'm not even sure how I'd properly expose the router I use to the public internet since I sit behind the ISP's NAT-ing, and even when I lived in the US, I am not confident I could tell you how to publicly expose the modem provided by Comcast for non-local access, much less how someone without any tech experience might do this. If this was a prevalent problem because of default settings, I'd expect far more than 7800 results; I am not willing to concede every instance is intentional, but 7800 out of the billions of routing devices in the world showing up on this search enforces my understanding that these 7800 entries are special in some way. >I doubt there's MFA or even rate limiting. MFA is not common at all on consumer routers, which at least quite a few on the first page result are, same with rate limiting. Even for Enterprise grade gear, the threat isn't the user-defined password, it's the manufacturer backdoors, which we've seen many of in the last few years. Rate limiting doesn't do much if you have a fair chance that you've got a back door. What likely __does__ help is that as far as I know, "Enable Web Access from WAN" is by default *disabled* on most consumer routers (and enterprise? that I'm not sure of), so I think that this leads credence to the devices on the Google results being exposed intentionally to some degree. (The owners' knowledge level not withstanding, this is a fairly out of the way setting, at least on my Asus router)
- Alupis 5y ago
  > but 7800 out of the billions of routing devices in the world showing Click "Next Page" - estimated results turns into 21 results in total... of which a bunch are dead links, a bunch are HN aggregators... leaving just a small handful of actual devices on the internet.
- jfrunyon 5y ago
  > I am not confident I could tell you how to publicly expose the modem provided by Comcast for non-local access You likely couldn't. That setting is usually gated behind some sort of "technician" or "mso" account (or not present, or only accessible from the devices telnet/ssh interface). Of course, it's probably not difficult to guess Comcast's password; past experience with other companies suggests you try things like "comcast" or "C0mc4s7". (Not even joking, Suddenlink and Spectrum/TWC.) > much less how someone without any tech experience might do this. Easy. It's a button that their kid clicked while playing around. > MFA is not common at all on consumer routers, which at least quite a few on the first page result are, same with rate limiting. Are you trying to say that's a positive for exposing it on the internet...?
gsich 5y ago
That would also be an assumption.

deleted 5y ago

[deleted]

nickstinemates 5y ago

SD-WAN / VPN / Many many many other solutions.

lmilcin 5y ago

> Folks - these routers are secure. There is nothing to see here, move along. If experience is any guide, they are not. Consumer routers have horrible track of embarrassing, easily exploitable vulnerabilities. That are not patched for a long time or ever. And exposing your router to public like that suggests the owner knows very little about security. This typically goes in hand with other neglect. Tell me, how many home users that are not security conscious keep their routers regularly patched and will replace the router when the manufacturer stops supporting them?

nuker 5y ago
> This typically goes in hand with other neglect. UPnP is on by default, yeah
YPPH 5y ago
What router does HN recommend for consumers? I personally run Ubiquiti Unifi gear, but they're not exactly consumer friendly (more geared to power users).
- lmilcin 5y ago
  I personally run Ubiquiti Unifi myself, but after some news here on HN I have serious doubts and am in search of a better alternative myself. https://news.ycombinator.com/item?id=26638145 https://news.ycombinator.com/item?id=26638145
  - theshrike79 5y ago
    So are we all, but there isn't one really. Unifi fills their prosumer niche perfectly, no matter how much of an ass and mismanager the current CEO is. All of the competition either requires intimate knowledge of networking internals, is twice as expensive or both.
- OneLeggedCat 5y ago
  Whatever I can keep an updated OpenWRT on.
- 5y ago

szidev 5y ago

not every tp-link model (or revision, or locale, or firmware version) that shares a web interface with the c7 requires you to manually set a password. even if that were the case, there are bound to be users who aren't security savvy and chose a very weak password (e.g. "password", "admin"). many tp-link routers also have configurable vpn servers built in, which can open up the whole network to malicious actors.

amanzi 5y ago

You're making some massive assumptions here. Exposing your router's admin page to the internet is not good security practice. These routers are protected by nothing but a password, and I couldn't see anything in the manual that enforces password length/complexity. So while the password might be non-default, it could still be incredibly insecure. Also, to expose these routers to the internet, all it takes is a single checkbox to enable "Remote management". So your assumption that these have all been deliberately placed on the internet also doesn't hold up because I can definitely see a curious home user playing with these settings without realising the impact of this. There have been tons of similar reports in the past where home users have exposed things to the internet without realising the impact.

system2 5y ago

Why would the search engines index these though? That's the question, not their default security.

ericyan 5y ago

> These routers all have secured passwords that are non-default. Secure passwords is just a tiny subset of non-default passwords. Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. > These routers were deliberately placed on the internet by people that knew enough about them to do so. This means these people knows how to expose the management interface to the internet. It does not mean these people have enough knowledge on securing their devices -- based on their actions, it is more likely that the opposite is true.

ascar 5y ago
> Chances of an average human being being able to come up with a password with enough entropy to be called as secure is pretty low. https://xkcd.com/936/ https://xkcd.com/936/ So you think the chance of human beings to come up with 4 random words is pretty low? You can't brute force millions of guesses per second through a web interface. 40 bits of entropy is already plenty for internet usage especially when the password is properly hashed with something like bcrypt. > Secure passwords is just a tiny subset of non-default passwords Actually the exact opposite is true. Since only low entropy and publicly known (which are mostly low entropy) passwords are insecure there are much more secure than non secure passwords. For the sake of argument, let's say all passwords with less than 40 bits of entropy are insecure. Even if we restrict the set of possible passwords to only 10 characters of lowercase a-z we have about 47 bits of entropy. So the set of insecure passwords would only be about 1/128 or less than 1% of all allowed passwords.
- BeefWellington 5y ago
  > > Secure passwords is just a tiny subset of non-default passwords > Actually the exact opposite is true. Since only low entropy and publicly known (which are mostly low entropy) passwords are insecure there are much more secure than non secure passwords. You're confusing "passwords that are in use" with the set "passwords that are possible". We have data via password dumps that suggests of the "passwords that are in use" the set that qualifies as "secure" is indeed a tiny subset of passwords.
- 5y ago

jrochkind1 5y ago

What you say is sensible, except for: > The estimated 7,000+ results becomes 21. Many of which are HN aggregators reporting on this thread here. Nope, Google is just collapsing them because they are all identical copies of the same "page", being the same login screen. Most of them look like routers, you can ask Google to "include" them all and see for yourself. https://www.google.com/search?q=%22Please+log+in+with+router%27s+password%22&filter=0 https://www.google.com/search?q=%22Please+log+in+with+router...

jfrunyon 5y ago

> So... out of the possible millions of routers TP-Link has sold in this model line, less than 21 are on the public internet Make that 47,000 of them on Shodan: https://www.shodan.io/search?query=hash%3A-904286784 https://www.shodan.io/search?query=hash%3A-904286784 > 1) These routers all have secured passwords that are non-default. You have a very interesting definition of "secured" if you think they are all actually secured. > 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. Just because they knew enough to click a checkbox doesn't mean they knew enough to do so. If they knew enough, they wouldn't have done so. You seem to be under the mistaken impression that embedded devices (like consumer routers) don't usually have glaring security holes. But they do.

fny 5y ago

OP. I'm posting this because I discovered a box at the hostel I'm at on Google after fat fingering the IP by mistake. (It's disconnected already.) The password was easily guessable. Aside from the anecdata, a counter argument is that the router manufacturer has taken no steps to obscure the routers from search engines. Sure someone could simply IP scan, but you have to admit this is a little absurd.

alerighi 5y ago

> 1) These routers all have secured passwords that are non-default. Who said secure password? Yes, they are not the default, but people are terrible at choosing password, most will choose weak password that are easy to exploit with a dictionary attack. > 2) These routers were deliberately placed on the internet by people that knew enough about them to do so. A people that know what it's doing would never expose a router web interface on the internet. Most people doesn't know how to configure his router, and let the ISP technician configure it, and they probably expose the router interface so they can access it remotely for maintenance, but it's not a great idea... > There are legit reasons to place a router on the internet, so long as it's secured properly... There aren't. Also you can choose a secure password, but these router interfaces are full of bugs, and highly exploitable. Add to this the fact that the manufacturer rarely updates the firmware of these devices... > how else would you remotely manage a router at a different physical location, for instance. With a VPN? By creating an SSH tunnel to one machine inside the local network? By connecting remotely (via RDP, VNC, TeamViewr, whatever) to one PC inside the local network? There are a ton of better solutions. Also if you don't have a static public IP address, as it's in most situations nowadays, how do you access it remotely anyway? With dynamic DNS but it's not reliable. The best solution to me is using a VPN (I can connect to my home network from anywhere in the world and access all the hosts, including router and other networking equipment of course).

cafxx 5y ago

> these routers are secure. Owner of a C7 v4 here. There has not been a firmware update from TP-Link since December 2019 (note that v4 is the second-most recent HW revision). No way these are not affected by at least some CVE somewhere in their stack. Calling them secure is a leap of faith that TP-Link does not deserve. I recently flashed openwrt exactly to be able to be on a more recent stack. I would never dream exposing that UI to the Internet as-is. They don't even have any form of brute forcing protection. If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side. Either who set those up really has nothing to lose if they get owned, or they do not know what they are doing. In both cases, it does not qualify as being a secure setup. (Sure, they may also be honeypots - in which case your argument was incorrect anyway, as they are secure, but they are not routers)

kralos 5y ago
> If they really needed access to the router remotely, it would be much saner to expose an SSH server with pubkey-only access or VPN, both with brute forcing protection, and allow tunnelling to the router UI only from the LAN side. any chance you can explain that to my mum?
- yipbub 5y ago
  > it would be much saner to expose an SSH server with pubkey-only access or VPN It would be safer to leave open to the public only a secure protocol based on strong cryptographic keys instead of a password. Or you have to be signed in to a VPN to see the page. > brute forcing protection Try too many passwords? Try again in 1 minute. Again? 30 minutes > allow tunnelling to the router UI only from the LAN side I think this one means don't expose it to the internet at all. Just from your local network. >
- msh 5y ago
  Your mom probably don’t need wan access to her router.
input_sh 5y ago

nashashmi 5y ago

There is a lot here. Some of these are university routers. Tells me that the sysadmin wanted to open up the router so s/he can manage from home. Nifty. But not secure. And they are no way taking the extra effort to make their system secure.

jasonladuke0311 5y ago

The UI is using jQuery 1.10.0, released in May 2013. I would be surprised if there have been many bugfixes or security updates on these.

ytch 5y ago

Web server itself could be an attack vector too. Although not specified to TP-Link, There are many exploits on other brands that can bypass the Authentication. For example this one: https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2 https://medium.com/tenable-techblog/bypassing-authentication... Even allowing access the web server from internet could be dangerous.

ineedasername 5y ago

2) These routers were deliberately placed on the internet by people that knew enough about them to do so. If "placing it on the internet" was proof of excellent security knowledge & practices, then nothing on the internet would be insecure. Just because they knew enough to know how to place it on the internet doesn't mean they understood the implications of that decision.

throwaway984393 5y ago

Nice try, NSA.

spockz 5y ago

The sensible way to secure it would be to have a device behind the router, in an isolated network which is the only network/device allowed to access the management interface. Then you tunnel/vpn/wire guard into that device.

xondono 5y ago

If their router login page has been indexed, then the user most likely don’t know what they are doing. It’s fine to expose router configuration (although it’s not ideal), but if you know that you are doing, you’ll at least place it behind a VPN.

dinkdinkdink 5y ago
I know what I'm doing. I would be fine with this in some circumstances. There are legitimate reasons adding a VPN to a backdoor like this can make it worse. The trick to "knowing what you are doing" in this case is defense in depth and knowing what's actually accessible from a world-open interface, and how much of that would be really annoying to get to while simultaneously fixing your homebrew VPN that fell over six months ago and that you never got around to fixing. Most routers are perfectly fine with a limited set of knobs accessible to the public Internet behind reasonably secure access ports. Bastion it behind SSH and/or SOCKS if you're paranoid, but seriously, as long as we're not talking a $50 Target 'router', it's probably fine. My Ubiquiti gear is indexed. It also reliably e-mails me when it successfully authenticates a user and can distinguish between inside and outside access to ACL what it can do. Just saying, easy with the "if you know what you're doing" thing, because opinions differ (particularly with beyondcorp in an IT setting). Gluing a VPN back together through an SSH tunnel so you can get at the "fail over to my DSL connection" button inside your network is a really crappy deal at 3 a.m. with a few beers in you and 200ms in between.
- xondono 5y ago
  > I would be fine with this in some circumstances. Maybe it’s just a matter of difference of criteria, but I would certainly not be fine with this. You have a lot of ways to prevent this from happening, and it only opens an attack surface to APTs. Being indexed means being searchable, being searchable means exposing yourself to automated targeted attacks.

ansn 5y ago

There are significantly more than 21 results listed on Google. Google automatically hides what it considers "duplicate results". There's an option to "repeat the search with the omitted results included" on page 2, which reveals all of the 7,000+ results, of which the vast majority are different routers.