3 ms·

Tplink for aps and mini PCs for routers

by hughesjj 3y ago

dixie_land 3y ago
TP links are cheap and well made for its price, if you don't care that the CCP has a backdoor to every device
- sgerenser 3y ago
  I use TP link access points with my own cloud controller (running in docker container on my LAN) and a separate wired router. I don’t think there’s any concern with access points “phoning home” in this configuration.
- discardedrefuse 3y ago
  > the CCP has a backdoor to every device This is huge! Please link me to the evidence to back this up.
  - mike_d 3y ago
    China deploys plausibly deniable backdoors into internationally shipped network devices. Bugs that are remotely exploitable if you know they exist, but not obvious enough that they provide justification for the devices to be banned from import. These consumer devices are not exploited for intelligence gathering, but rather deployed as proxies that fall into one of two common buckets: acting as SOCKS proxies to relay attacks, and allowing a remote operator to scan for nearby wireless networks and bridge into them. The NDAA blacklist was a happy compromise by the US government of banning the most egregious vendors that might find their way into sensitive facilities (Huawei, Hikvision, etc) while letting consumer focused brands that do the same (TPLink, Jetstream, Wavlink, etc) slip by so it didn't appear at face value to be a blockade of all Chinese made networking gear. Taiwan on the other hand is less concerned about how China perceives their relations and bans all these vendors. They also ban Zoom.
    - hughesjj 3y ago
      First, [citation needed] w.r.r tplink and other consumer grade routers 'getting off easy' Second, you seem knowledgeable about concerns w.r.t some supply chain attacks, at least from foreign actors, so do you have an alternative suggestion that isn't impacted by such concerns? Ubiquiti is a non starter imo given their recent posture
  - jstarfish 3y ago
    It'd be easier to just Google it. Grievances start with "made in China" and end with firmware hacks from May of this year. https://blog.checkpoint.com/security/check-point-research-reveals-a-malicious-firmware-implant-for-tp-link-routers-linked-to-chinese-apt-group/ https://blog.checkpoint.com/security/check-point-research-re...
    - discardedrefuse 3y ago
      "We are unsure how the attackers managed to infect the router devices with their malicious implant. It is likely that they gained access to these devices by either scanning them for known vulnerabilities or targeting devices that used default or weak and easily guessable passwords for authentication" This implies the opposite of "the CCP has a backdoor to every device". Vulnerable devices from all manufacturers get exploited like this all the time.
jandrese 3y ago
I've had pretty bad luck with TPLink APs temporarily dropping connections and being just generally unstable. Even when you can put OpenWRT on them the hardware is just kinda buggy.
- discardedrefuse 3y ago
  I think OP means the Omada EAP's, which are dedicated access points and not the routers. I have 2 EAP225's that have been better than the Ubiquiti it replaced.

Tplink for aps and mini PCs for routers

dixie_land 3y ago

TP links are cheap and well made for its price, if you don't care that the CCP has a backdoor to every device

sgerenser 3y ago
I use TP link access points with my own cloud controller (running in docker container on my LAN) and a separate wired router. I don’t think there’s any concern with access points “phoning home” in this configuration.
discardedrefuse 3y ago
> the CCP has a backdoor to every device This is huge! Please link me to the evidence to back this up.
- mike_d 3y ago
  China deploys plausibly deniable backdoors into internationally shipped network devices. Bugs that are remotely exploitable if you know they exist, but not obvious enough that they provide justification for the devices to be banned from import. These consumer devices are not exploited for intelligence gathering, but rather deployed as proxies that fall into one of two common buckets: acting as SOCKS proxies to relay attacks, and allowing a remote operator to scan for nearby wireless networks and bridge into them. The NDAA blacklist was a happy compromise by the US government of banning the most egregious vendors that might find their way into sensitive facilities (Huawei, Hikvision, etc) while letting consumer focused brands that do the same (TPLink, Jetstream, Wavlink, etc) slip by so it didn't appear at face value to be a blockade of all Chinese made networking gear. Taiwan on the other hand is less concerned about how China perceives their relations and bans all these vendors. They also ban Zoom.
  - hughesjj 3y ago
    First, [citation needed] w.r.r tplink and other consumer grade routers 'getting off easy' Second, you seem knowledgeable about concerns w.r.t some supply chain attacks, at least from foreign actors, so do you have an alternative suggestion that isn't impacted by such concerns? Ubiquiti is a non starter imo given their recent posture
- jstarfish 3y ago
  It'd be easier to just Google it. Grievances start with "made in China" and end with firmware hacks from May of this year. https://blog.checkpoint.com/security/check-point-research-reveals-a-malicious-firmware-implant-for-tp-link-routers-linked-to-chinese-apt-group/ https://blog.checkpoint.com/security/check-point-research-re...
  - discardedrefuse 3y ago
    "We are unsure how the attackers managed to infect the router devices with their malicious implant. It is likely that they gained access to these devices by either scanning them for known vulnerabilities or targeting devices that used default or weak and easily guessable passwords for authentication" This implies the opposite of "the CCP has a backdoor to every device". Vulnerable devices from all manufacturers get exploited like this all the time.

jandrese 3y ago

I've had pretty bad luck with TPLink APs temporarily dropping connections and being just generally unstable. Even when you can put OpenWRT on them the hardware is just kinda buggy.

discardedrefuse 3y ago
I think OP means the Omada EAP's, which are dedicated access points and not the routers. I have 2 EAP225's that have been better than the Ubiquiti it replaced.