I’m beginning to think maybe I’m the only one that read this whole thing. The firmware storage isn’t the security through obscurity problem being talked about here. The hardcoded TLS private key definitely is though. And yes, it deserves shaming… terrible practice leads to terrible outcomes. Nobody is surprised that this is coming from tp-link at this point though.
I think maybe you’re reading this wrong. Reverse-engineering blog posts like this are just a fun and instructive way of telling the story of how someone did a thing. Having written and read a bunch of these in the past myself, I found this one to be a great read!
Edit: just want to add, the “how I got the firmware” part of this is also the least interesting part of this particular story.
It’s notable and interesting this research is coming out of University of Cambridge. Cambridge Analytica spun out of academia there too?
Question for folks here who may be familiar: it seems like there’s a strong connection to research (and in the case of CA, commercial application of said research) around social media manipulation and propaganda in the digital age.
Is there any six-degrees type connection to the people doing this research and those involved with the roots of CA? Not as in the same bad actors (which, tbh yes, I consider CA to have been), but as in perhaps the same department and/or professors etc.
Just want to say: Thanks! I was waiting for this article.
Thanks to Ernie Smith, to tedium.co, to HN, to community.
This is the kind of curious and intelligent response to FUD that I want to find whenever major news outlets start an insane new spin-cycle (as increasingly is the way of things in the world).
I’ll let the HN comment thread spin out (as it must), but amidst that, I just want to say that this right here is the reason I still keep coming back to this place and read all of it. So, thanks!
This is really, well... douchey. Emptying anything I have in Coinbase asap (and yes I read the whole thing)
I wonder how likely it is for CEO roles to get taken over by a sophisticated LLM at this point. I’d wager we’d see a 20x increase in value. I use and value llms in my coding and research workflows already but to fire people for careful and slow adoption speaks very poorly to individual and company maturity.
reply