|
| ▲ | sally_glance 2 days ago | parent | next [-] |
| To me the phrasing seems objective. Making your binaries available to the public is good (though source would be better). Replace [firmware] with [random popular GitHub repo] and nobody would blink. Replace [firmware] with [customer email address] and it would be a legal case. Differentiating here is important. |
| |
| ▲ | opello 2 days ago | parent | next [-] | | I think it fails to be objective because of the repetition. It's an open S3 bucket. No need to state that no authentication was required, it's already open. It's not about economy of writing but the repetition emphasizes the point, elevating the perceived significance to the author or that the author wants the reader to take away. Furthermore, the repeated use of every when discussing the breadth of access seems like it would easily fall into the "absolutes are absolutely wrong" way of thinking. At least without some careful auditing it seems like another narrative flourish to marvel at this treasure trove (candy store) of firmware images that has been left without adequate protection. But it seems like most here agree that such protection is without merit, so why does it warrant this emphasis? I'm only left with the possible thought that the author considered it significant. | | |
| ▲ | pacifika 2 days ago | parent | next [-] | | If someone DDOSes an open s3 bucket they’ll get a huge bill. If there is something in front of it, they might not. | |
| ▲ | wkat4242 2 days ago | parent | prev [-] | | An 'open S3 bucket' sounds really bad. If it were posted on an HTTPS site without authentication, like the firmware for most devices, it wouldn't sound so bad. Sure an open bucket is bad, if it's stuff you weren't planning on sharing with the whole world anyway. | | |
| ▲ | necovek 2 days ago | parent | next [-] | | Since firmware is supposed to be accessible to users worldwide, making it easier to get it is good. But how is an open, read-only S3 bucket worse than a read-only HTTPS site hosting exactly the same data? The only thing I can see is that it is much easier to make it writeable by accident (for HTTPS web site or API, you need quite some implementation effort). | | |
| ▲ | wkat4242 a day ago | parent [-] | | No wait I agree with you. I think it is bad framing as "S3 open bucket" when people would totally understand an open website :) |
| |
| ▲ | locknitpicker 2 days ago | parent | prev [-] | | > An 'open S3 bucket' sounds really bad. Only to gullible, clueless types. Full blown production SPAs are served straight from public access S3 buckets. The only hard requirement is that the S3 bucket enforces read-only access through HTTPS. That's it. Let's flip it the other way around and make it a thought experiment: what requirement do you think you're fulfilling by enforcing any sort of access restriction? When you feel compelled to shit on a design trait, the very least you should do is spend a couple of minutes thinking about what problem it solves and what are the constraints. | | |
| ▲ | wkat4242 a day ago | parent [-] | | No I agree with you. I think it is bad framing as "S3 open bucket" when people would totally understand an open website :) I'm not shitting on anything except the wording in the article. I guess I didn't word it clearly. In our company we don't really serve directly from open buckets but through cloudfront. Though this is more because we are afraid of buckets marked open by mistake so they are generally not allowed. But I agree there's nothing bad about it. I just meant it sounds much worse (at least to someone in cybersec like me) and I don't like the effect used as such in the article. |
|
|
| |
| ▲ | jacquesm 2 days ago | parent | prev [-] | | No, it clearly has a gloating tone to it. 'A reverse engineer's candy store' is clearly meant as a slur. When in fact TP-Link is doing the right thing with keeping older versions available. So this risks some higher up there thinking 'fuck it, we can't win, might as well close it all off'. | | |
| ▲ | evilsocket 2 days ago | parent [-] | | I just meant that it was very convenient to have the firmware images there on S3, nothing else :D Many vendors make the process of even just obtaining a copy of the firmware much harder than that, so for once I was glad it has been much easier. Also being able to bindiff two adjacent versions of the same firmware is great ... all in all I was just expressing my happiness :D |
|
|
|
| ▲ | locknitpicker 2 days ago | parent | prev | next [-] |
| > Highlighting (repeatedly) the ease and breadth of access is a basic writing technique to illustrate the weakness of a security system. It's a firmware distribution system. It's read-only access to a public storage account designed to provide open access to software deployment packages that the company wishes to broadcast to all products. Of course there is no auth requirement at all. The system is designed to allow everyone in the world to install updates. What compells anyone to believe the system would be designed to prevent public access? |
| |
| ▲ | lmz 2 days ago | parent [-] | | Maybe listing shouldn't be enabled even if all the files are public. | | |
| ▲ | dns_snek 2 days ago | parent | next [-] | | Why not? It's just an annoyance step that is predicated on obfuscating information that has already been made publicly available. | |
| ▲ | locknitpicker 2 days ago | parent | prev [-] | | > Maybe listing shouldn't be enabled even if all the files are public. I don't see why. Support for firmware upgrades literally involve querying available packages and downloading the latest ones (i.e., apply upgrades). Either you use something like the S3 interface, or you waste your time implementing a clone of what S3 already supports. Sometimes simple is good, specially when critics can't even provide any concrete criticism. | | |
| ▲ | lmz a day ago | parent [-] | | It's not a necessary interface. Do the clients actually use S3 listing to determine what the latest firmware is? Personally I would put a service in the middle that takes in the model number, region, etc and then returned the most recent firmware URL. There's no reason to have historical versions be easily listable by curious people. | | |
| ▲ | tyami94 18 hours ago | parent [-] | | Why not? The firmware was already public at one point. If people are analyzing your app to find an S3 bucket full of firmware, I'd assume they'd have a pretty good reason to go through the effort. |
|
|
|
|
|
| ▲ | LoganDark 2 days ago | parent | prev | next [-] |
| Or to illustrate the convenience to the point of the article, being reverse engineering; not necessarily to critique their security practices here. Being easy to reverse engineer is not necessarily a weakness of security (as the inverse would simply be obscurity). |
|
| ▲ | moron4hire 2 days ago | parent | prev [-] |
| Yeah, that writing definitely reeks of incredulity. |
