Linksys Velop routers send Wi-Fi passwords in plaintext to US servers
Linksys Velop routers send Wi-Fi passwords in plaintext to US servers
During installation, the router sent several data packets to an Amazon server in the US. These packets contained the configured SSID name and password in clear text, as well as some identification tokens for this network within a broader database and an access token for a user session that could potentially enable a MITM attack.
Linksys has refused to acknowledge/respond to the issue.
This. This is why I have trust issues and only run devices I can flash OpenWRT (or other appropriate custom firmware) to.
It's like all the tech companies are actively working together to give us trust issues at this point. Used to flash things for fun because I can, more and more it feels like it's a necessity just to get basic human rights respected.
I use enterprise hardware that has enterprise router firmware. In my case, I use Microtik with RouterOS. If it's good enough for big enterprises, it's probably good enough for me.
I use enterprise gear, but not the original software for it (and sometimes, not even the original purpose). I get it all second hand, and the subscription / licensing is usually non active. I think the only gear I used with the original OS was my Brocade fibre channel switch.
My current router is former Barracuda Load Balancer 340 now running OpenWRT. Cost me $45 and handles everything I need to throw at it and more.
Not a bad way to do it!
I just went down the ubiquity dream machine and a real switch with APs in mesh mode
Nice!
A drunk eBay excursion scored me 20 Aruba AP-105s for $12. Flashing OpenWRT to them was a brute, but they're still going strong.
I originally set them up to mesh on the 5 GHz and provide AP coverage on the 2.4, but since they're PoE and didn't come with adapters, I got rid of the mesh and just have one in every room.
Me too, me too... :)
Wow, Linksys in 2024 still thinks like it's 1998.
1984
This is why I don't run consumer crap. Among other reasons.
Have any good recs for nonconsumer wifi mesh system that is not too far off from consumer prices? I had a velop system for awhile and it was torture. This thing stems from horrid design and will likely always be awful. Use an Asus system now and have been happy with it. Used to run Asus systems with merlin, but admittedly running stock firmware now.
Unifi is probably the best you'll get for prosumer. Unfortunately it's not without flaws either. I'd take it over the junk consumer brands any day still. Because I work in the industry and I like to use a lot more advanced things, I can't get myself to use anything other than opnsense for home use. I have a protectli for hardware. You can install pfsense, opnsense, probably even ddwrt which is probably the most friendly of the bunch from what I hear. I use a ruckus poe fanless switch, but this is the least important for a typical home user network. Just get something that has poe and isn't cloud managed 😂
Not an expert but I've been very happy with my synology wifi router, plenty of range for my house. I've had good luck in the past with ubiquiti access points for an application that needs to cover more square footage.
You do know that enterprise doesn't make you safer, right? Consumer gets hit by botnets, enterprise gets hit by higher level attacks.
I don't get your point. This isn't an attack, this is a cheap consumer company doing what they do best and stealing your personal information because $ and other crap. If this happened in enterprise they'd be in so much shit with laws. Cisco, juniper, Aruba, etc are not going to be shipping off your passwords because that liability is going to be a big problem.
Enterprise level stuff also charge top dollar and don't need to sell your data to make more money.
If enterprise level stuff we're doing this intentionally they'd be out of business. This would not fly with SOC and other security designations.
Additionally just because a consumer uses enterprise gear, that does not make them a larger target. I'm not Microsoft. No state attacker is going to want my worthless data.
They specifically didn't say they're using enterprise. Diy open source solutions such as a ddwrt router for example doesn't exactly fit in the "consumer" nor the "enterprise" category.
Why are they sending that data to Cisco at all? That's a ridiculous privacy violation, especially if they're stupid enough to do it in cleartext.
You mean Linksys, not Cisco. Cisco sold Linksys to Belkin, now Foxconn, like over a decade ago. I think it's a pretty important distinction considering Cisco is enterprise focused and linksys is more home/consumer focused.
What does this mean, that the use plain HTTP or some other protocol? I can't see details.
Two important points raised:
- Why is Linksys sending your Wifi details, as well as your private password, outside of your home
- If they're doing it, why are they sending your critically important private information unencrypted onto the public internet
The answer to the first one may be semi-legit as these are mesh products. As in, the other nodes in the mesh will need this information, and it appears that Linksys has decided to store your security data in AWS for the other mesh nodes to retrieve it when you're setting it up. I'd sure as hell like to know this before the product does this. Further, I'd much prefer to simply attached to each mesh node myself to input the secured credentials instead of sending them outside to the internet.
There's not excuse for Linksys sending the creds unencrypted onto the internet.
I'm just finding no confirmation that they send them unencrypted over the Internet and I've seen "researchers" calling sending passwords over HTTPS "unencrypted."
Mesh coordination is interesting. It's not great. That said I doubt that any off-the-shelf consumer mesh system does go through the work to keep things local-only. It's too easy to setup a cloud API and therefore likely all of them do that since it's the cheapest.
From what I can find, by "These routers send your credentials in plaintext", they actually meant to say, "The mobile app sends credentials in plaintext."
If you use the web interface then your credentials are not sent in plaintext. The routers themselves also don't send credentials in plaintext.
The people who found this out got that wrong, and a lot of people are confused because they didn't expand on "in plaintext." They could be a little more professional / thoughtful.
Edit: I'm also thinking about the "may expose you to a MITM" bit. I think if it was https then a MITM (assuming all they can do is examine your packets) wouldn't work because the data can only be unlocked by the private key. It sounds like it was an http connection?
This is what I'm thinking too. The only likely scenario under which the plaintext and MITM words make sense together is HTTP. I wouldn't put it past Linksys to have used an HTTP API endpoint but these days a lot of things scream if you use HTTP. Thanks for the work!