During installation, the router sent several data packets to an Amazon server in the US. These packets contained the configured SSID name and password in clear text, as well as some identification tokens for this network within a broader database and an access token for a user session that could potentially enable a MITM attack.

Linksys has refused to acknowledge/respond to the issue.

  • Admiral Patrick@dubvee.org
    link
    fedilink
    English
    arrow-up
    176
    arrow-down
    2
    ·
    14 days ago

    This. This is why I have trust issues and only run devices I can flash OpenWRT (or other appropriate custom firmware) to.

    • Max-P@lemmy.max-p.me
      link
      fedilink
      English
      arrow-up
      79
      ·
      14 days ago

      It’s like all the tech companies are actively working together to give us trust issues at this point. Used to flash things for fun because I can, more and more it feels like it’s a necessity just to get basic human rights respected.

    • sugar_in_your_tea@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      8
      ·
      14 days ago

      I use enterprise hardware that has enterprise router firmware. In my case, I use Microtik with RouterOS. If it’s good enough for big enterprises, it’s probably good enough for me.

      • Admiral Patrick@dubvee.org
        link
        fedilink
        English
        arrow-up
        4
        ·
        edit-2
        14 days ago

        I use enterprise gear, but not the original software for it (and sometimes, not even the original purpose). I get it all second hand, and the subscription / licensing is usually non active. I think the only gear I used with the original OS was my Brocade fibre channel switch.

        My current router is former Barracuda Load Balancer 340 now running OpenWRT. Cost me $45 and handles everything I need to throw at it and more.

    • Pacmanlives@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      14 days ago

      Not a bad way to do it!

      I just went down the ubiquity dream machine and a real switch with APs in mesh mode

      • Admiral Patrick@dubvee.org
        link
        fedilink
        English
        arrow-up
        6
        ·
        14 days ago

        Nice!

        A drunk eBay excursion scored me 20 Aruba AP-105s for $12. Flashing OpenWRT to them was a brute, but they’re still going strong.

        I originally set them up to mesh on the 5 GHz and provide AP coverage on the 2.4, but since they’re PoE and didn’t come with adapters, I got rid of the mesh and just have one in every room.

    • Imgonnatrythis@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      10
      arrow-down
      1
      ·
      14 days ago

      Have any good recs for nonconsumer wifi mesh system that is not too far off from consumer prices? I had a velop system for awhile and it was torture. This thing stems from horrid design and will likely always be awful. Use an Asus system now and have been happy with it. Used to run Asus systems with merlin, but admittedly running stock firmware now.

      • bobs_monkey@lemm.ee
        link
        fedilink
        English
        arrow-up
        17
        ·
        14 days ago

        Ubiquiti gear is very solid for the price. Start with their dream machine (check eBay for used, just saw one for $150, otherwise $300 new), and then add nano access points as needed. Enterprise gear for a fraction of the price.

        • ikidd@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          1
          ·
          13 days ago

          Isn’t Ubiquiti back to being a “have to make a cloud account to control all your local devices” company?

          • bobs_monkey@lemm.ee
            link
            fedilink
            English
            arrow-up
            3
            ·
            13 days ago

            They’re either or. Their configuration device is called a cloud key, but it runs locally on your network. You can choose to enable cloud management, though everything can be administered locally, nor do they punish you for it.

        • Noobnarski@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          13 days ago

          You can also run the Network Controller on any PC or even Home Assistant if you dont need to do any advanced traffic routing features.

          The only disadvantage is that updates cannot be automatically applied while the network controller is off, the APs however do work fine without it, as long as they are configured once.

      • yeehaw@lemmy.ca
        link
        fedilink
        English
        arrow-up
        8
        ·
        14 days ago

        Unifi is probably the best you’ll get for prosumer. Unfortunately it’s not without flaws either. I’d take it over the junk consumer brands any day still. Because I work in the industry and I like to use a lot more advanced things, I can’t get myself to use anything other than opnsense for home use. I have a protectli for hardware. You can install pfsense, opnsense, probably even ddwrt which is probably the most friendly of the bunch from what I hear. I use a ruckus poe fanless switch, but this is the least important for a typical home user network. Just get something that has poe and isn’t cloud managed 😂

        • ikidd@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          13 days ago

          I thought Ubiquiti moved back to cloud managed on everything? Or is that just the network cameras?

      • Crozekiel@lemmy.zip
        link
        fedilink
        English
        arrow-up
        1
        ·
        14 days ago

        Not an expert but I’ve been very happy with my synology wifi router, plenty of range for my house. I’ve had good luck in the past with ubiquiti access points for an application that needs to cover more square footage.

    • 0x0@programming.dev
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      3
      ·
      13 days ago

      You do know that enterprise doesn’t make you safer, right? Consumer gets hit by botnets, enterprise gets hit by higher level attacks.

      • yeehaw@lemmy.ca
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        1
        ·
        13 days ago

        I don’t get your point. This isn’t an attack, this is a cheap consumer company doing what they do best and stealing your personal information because $ and other crap. If this happened in enterprise they’d be in so much shit with laws. Cisco, juniper, Aruba, etc are not going to be shipping off your passwords because that liability is going to be a big problem.

        Enterprise level stuff also charge top dollar and don’t need to sell your data to make more money.

        If enterprise level stuff we’re doing this intentionally they’d be out of business. This would not fly with SOC and other security designations.

        Additionally just because a consumer uses enterprise gear, that does not make them a larger target. I’m not Microsoft. No state attacker is going to want my worthless data.

        • 0x0@programming.dev
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          13 days ago

          Additionally just because a consumer uses enterprise gear, that does not make them a larger target.

          It’ll make them a target of attacks targeting that class of gear.

          • yeehaw@lemmy.ca
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            1
            ·
            13 days ago

            Most threat actors are looking at who owns what IP space and checking the IPs of that, or what other public info they can find (website address etc). Not chasing after someone with a consumer internet IP. There is just not the same incentive.

      • PenisWenisGenius@lemmynsfw.com
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        13 days ago

        They specifically didn’t say they’re using enterprise. Diy open source solutions such as a ddwrt router for example doesn’t exactly fit in the “consumer” nor the “enterprise” category.

  • ikidd@lemmy.world
    link
    fedilink
    English
    arrow-up
    32
    arrow-down
    1
    ·
    13 days ago

    Why are they sending that data to Cisco at all? That’s a ridiculous privacy violation, especially if they’re stupid enough to do it in cleartext.

    • Hobo@lemmy.world
      link
      fedilink
      English
      arrow-up
      20
      ·
      13 days ago

      You mean Linksys, not Cisco. Cisco sold Linksys to Belkin, now Foxconn, like over a decade ago. I think it’s a pretty important distinction considering Cisco is enterprise focused and linksys is more home/consumer focused.

  • Avid Amoeba@lemmy.ca
    link
    fedilink
    English
    arrow-up
    10
    ·
    edit-2
    14 days ago

    What does this mean, that the use plain HTTP or some other protocol? I can’t see details.

    • partial_accumen@lemmy.world
      link
      fedilink
      English
      arrow-up
      76
      ·
      14 days ago

      Two important points raised:

      • Why is Linksys sending your Wifi details, as well as your private password, outside of your home
      • If they’re doing it, why are they sending your critically important private information unencrypted onto the public internet

      The answer to the first one may be semi-legit as these are mesh products. As in, the other nodes in the mesh will need this information, and it appears that Linksys has decided to store your security data in AWS for the other mesh nodes to retrieve it when you’re setting it up. I’d sure as hell like to know this before the product does this. Further, I’d much prefer to simply attached to each mesh node myself to input the secured credentials instead of sending them outside to the internet.

      There’s not excuse for Linksys sending the creds unencrypted onto the internet.

      • dev_null@lemmy.ml
        link
        fedilink
        English
        arrow-up
        2
        ·
        13 days ago

        Even then, the other nodes would only need the hash of the password, not the password itself.

        • Natanael@slrpnk.net
          link
          fedilink
          English
          arrow-up
          2
          ·
          13 days ago

          That depends entirely on the auth system, but you can use a separate credential to retrieve the password (using something like a PAKE algorithm)

      • Avid Amoeba@lemmy.ca
        link
        fedilink
        English
        arrow-up
        8
        arrow-down
        6
        ·
        14 days ago

        I’m just finding no confirmation that they send them unencrypted over the Internet and I’ve seen “researchers” calling sending passwords over HTTPS “unencrypted.”

        Mesh coordination is interesting. It’s not great. That said I doubt that any off-the-shelf consumer mesh system does go through the work to keep things local-only. It’s too easy to setup a cloud API and therefore likely all of them do that since it’s the cheapest.

        • cley_faye@lemmy.world
          link
          fedilink
          English
          arrow-up
          13
          arrow-down
          1
          ·
          14 days ago

          I’m just finding no confirmation that they send them unencrypted over the Internet

          Even if they were sending them with proper E2EE to their server, that would still be a huge fucking problem.

        • 0x0@programming.dev
          link
          fedilink
          English
          arrow-up
          5
          ·
          13 days ago

          calling sending passwords over HTTPS “unencrypted.”

          The channel is encrypted, the content is not. It is a password, why would they need it?

          • theneverfox@pawb.social
            link
            fedilink
            English
            arrow-up
            1
            ·
            12 days ago

            Because now they have your login and password - not a hashed version they can only validate against, but the real thing that can be used to log into your network. They shouldn’t ever have it, aside from them being able to sell credentials this also means someone else could probably obtain access to all of them

        • Passerby6497@lemmy.world
          link
          fedilink
          English
          arrow-up
          5
          ·
          13 days ago

          and I’ve seen “researchers” calling sending passwords over HTTPS “unencrypted.”

          That’s because the password is unencrypted.

          HTTPS will encrypt the channel and the data in flight, but the data is still unencrypted and anyone with a key that validated (assuming it actually checks for certificate validity) now has access to your unencrypted password. So yes, even over HTTPS it should be considered unencrypted.

          Whether or not they’re sending it over an encrypted channel, they’re still sending out an unencrypted password that they have no need for. Linksys has no reason to need the unencrypted password, and at best would only need a hashed password to accomplish whatever business case they’re sending that to solve. We have to assume that they’re also saving it in clear text given how they’re sending it in the clear as well.

          No password should ever leave your network unencrypted, no matter the data channel encryption. Anything less is negligence , and the vendor should not be trusted.

        • Flashback956@feddit.nl
          link
          fedilink
          English
          arrow-up
          3
          ·
          13 days ago

          How would they know that the device sends the SSID and password otherwise? If it was encrypted you would not be able to read the content of the packages.

    • mhague@lemmy.world
      link
      fedilink
      English
      arrow-up
      23
      ·
      edit-2
      14 days ago

      From what I can find, by “These routers send your credentials in plaintext”, they actually meant to say, “The mobile app sends credentials in plaintext.”

      If you use the web interface then your credentials are not sent in plaintext. The routers themselves also don’t send credentials in plaintext.

      The people who found this out got that wrong, and a lot of people are confused because they didn’t expand on “in plaintext.” They could be a little more professional / thoughtful.

      Edit: I’m also thinking about the “may expose you to a MITM” bit. I think if it was https then a MITM (assuming all they can do is examine your packets) wouldn’t work because the data can only be unlocked by the private key. It sounds like it was an http connection?

      • Avid Amoeba@lemmy.ca
        link
        fedilink
        English
        arrow-up
        5
        ·
        14 days ago

        This is what I’m thinking too. The only likely scenario under which the plaintext and MITM words make sense together is HTTP. I wouldn’t put it past Linksys to have used an HTTP API endpoint but these days a lot of things scream if you use HTTP. Thanks for the work!