TP-Link Kasa cameras leaked home GPS via unauthenticated UDP for 6 years
234 points
• 2 days ago
• Article
Link
针对运行固件版本 2.3.26 的 Kasa Spot EC71 摄像头进行的全面安全分析揭示了严重漏洞，损害了设备的机密性和安全性。研究人员发现了多项关键问题，包括使用硬编码、整个平台通用的 RSA 私钥；以不安全的未加盐 MD5 哈希存储用户凭证；以及未经身份验证以明文形式暴露精确的 GPS 定位数据。这些缺陷使得可能发生跨域账户接管，攻击者可借此未授权访问包括智能门锁和网络基础设施在内的整个 TP-Link 产品生态系统。
调查特别指出了 GPS 数据泄露的持续性问题：向 9999 端口发送一条未经身份验证的 UDP 数据包即可强制设备返回其精确坐标和唯一硬件指纹。这一漏洞属于更广泛的问题模式——自 2016 年以来，各类 TP-Link 产品线上已多次记录到类似问题。尽管此前有过公开披露，但厂商并未在所有设备上持续修补这些风险，显示出其更倾向于渐进式、针对性的修复，而非进行全面的架构性安全审查。
经过数月的协调披露流程后，厂商最终发布了固件版本 2.4.1 来修复这些问题。更新引入了多项必要的安全改进，例如以每台设备独立证书替换整平台通用的 RSA 密钥，确保敏感凭证的存储得到妥善加密；同时通过限制未经身份验证的 UDP 响应修正了 GPS 泄露问题，有效封堵了未经授权的位置发现和设备指纹识别的主要途径。
研究还发现了显著的二手市场风险：售出、捐赠或恢复出厂设置的设备并未充分清除敏感用户数据。在旧固件上，即便恢复出厂设置后，仍可能从设备闪存中恢复前任所有者的账户凭证和家庭位置信息。这为攻击者提供了途径：购买二手摄像头后即可轻易将设备与前任所有者的身份和实际住址关联起来。
披露过程也面临挑战，包括在问题初筛阶段的沟通失误，以及一次测试固件的 beta 发布意外使测试设备变砖，需进行硬件级恢复。尽管这些漏洞在最新固件中已被修补，研究作者仍强调，这些发现凸显了物联网行业建立更高安全标准的必要性。最终的解决过程表明，严格且协调的安全研究仍是促使制造商采用更稳健安全架构的重要推动力。
A comprehensive security analysis of the Kasa Spot EC71 camera, running firmware version 2.3.26, has uncovered significant vulnerabilities that compromised the device's confidentiality and security. Researchers identified critical issues including the use of hardcoded, fleet-wide RSA private keys, the storage of user credentials using insecure unsalted MD5 hashes, and an unauthenticated, cleartext exposure of precise GPS location data. These flaws allowed for potential cross-domain account takeovers, where an attacker could gain unauthorized access to an entire ecosystem of connected TP-Link products, including smart locks and network infrastructure.
The investigation highlighted a persistent issue regarding GPS data leakage. A single, unauthenticated UDP packet sent to port 9999 could force the device to return its precise coordinates and a unique hardware fingerprint. This specific vulnerability is part of a larger pattern, as similar issues have been documented across various TP-Link product lines since 2016. Despite prior public disclosures, the company had not consistently remediated these risks across all its devices, pointing to a strategy of incremental, targeted fixes rather than a thorough architectural security review.
Following a coordinated disclosure process that spanned several months, the vendor eventually released firmware version 2.4.1 to address these findings. The update implemented several necessary security improvements, such as replacing the fleet-wide RSA keys with per-device certificates and ensuring that sensitive credential storage is properly encrypted. The update also corrected the GPS exposure by restricting the unauthenticated UDP response, effectively closing the primary path for unauthorized location discovery and device fingerprinting.
The research also uncovered a notable secondary market risk, where devices sold, donated, or returned to factory settings did not adequately purge sensitive user data. On the older firmware, it was possible to recover a previous owner's account credentials and home location coordinates from the device's flash storage, even after a reset. This created an attack path where a malicious actor could purchase a secondhand camera and easily correlate the device with the previous owner's identity and physical home address.
The disclosure timeline was marked by challenges, including communication failures during the triage process and a beta firmware release that inadvertently bricked test devices, requiring hardware-level recovery. While the vulnerabilities are now patched in the latest firmware, the author of the research emphasizes that these findings underscore the necessity for stronger security standards in the IoT industry. The final resolution demonstrates that rigorous, coordinated research remains an essential mechanism for prompting manufacturers to adopt more robust security architectures.
87 comments • Comments Link
• IoT 设备默认不应直接通过公共互联网通信，以降低廉价且安全性不足的硬件带来的固有风险。
• 漏洞在国内外厂商中普遍存在，表明这是一个系统性问题，而非局限于某个地区。
• 依赖 AI coding assistants 并不能从根本上提升安全性，因为这些模型可能会建议不安全的做法或"临时"代码，开发者往往会在未经充分审查的情况下将其推向生产环境。
• 消费级 IoT 要做到真正安全仍很困难，市场更重视便利与低成本，普通用户也缺乏配置 VPN 或 VLAN 等复杂方案的技术能力。
• 像 Apple's HomeKit 这样的家庭中枢可以集中管理设备并在隐私上优于依赖通用云服务的方案，但用户仍需信任中枢设备的制造商。
• 非 IP 协议（如 Zigbee）通过将设备与互联网隔离，提供了潜在的安全优势，但与标准 Wi‑Fi 设备相比，其可靠性与用户体验仍存在差异。
• 安全专家与普通消费者之间存在明显脱节：专家主张使用更高端设备或复杂的网络隔离，而消费者更倾向于购买便宜、即插即用的产品来监控家庭。
• 许多厂商在安全实践上存在明显不足，包括使用硬编码凭据、采用未加密的协议，以及在恢复出厂设置时未能彻底清除用户数据。
• 协同披露流程常常令人沮丧且效率低下，供应商不仅淡化漏洞严重性，还可能发布导致设备报废（brick）的有缺陷补丁，未能根治长期存在的安全缺陷。
• 实时位置数据常通过未加密的协议泄露，带来隐私风险，敏感信息可能被本地网络上的未授权方拦截。
总体共识反映出对消费级 IoT 现状的深切挫败：市场由廉价且设计拙劣的硬件主导，虽然专家们主张网络隔离和高质量设备，但消费者对便利性和价格的需求导致竞相降标，促使厂商忽视安全。人们对向 AI 辅助开发转型或依赖当前披露流程能否解决这些根本缺陷几乎没有信心，因为问题根源在于企业文化，而非单纯缺乏工具。 • IoT devices should be restricted from communicating over the public internet by default to mitigate the risks inherent in cheap, poorly secured hardware.
• Vulnerabilities are widespread across both domestic and international manufacturers, suggesting the issue is systemic rather than confined to any specific region.
• Relying on AI coding assistants does not inherently improve security, as these models can suggest insecure practices or "temporary" code that developers often push to production without proper review.
• Effective security in consumer IoT remains difficult because the market prioritizes convenience and low cost over rigorous standards, and average users lack the expertise to implement complex solutions like VPNs or VLANs.
• While home hub systems like Apple's HomeKit can centralize device control and offer better privacy than generic cloud-dependent alternatives, they still require users to trust the hub manufacturer.
• Non-IP protocols like Zigbee offer potential security benefits by isolating devices from the internet, though their reliability and user experience remain inconsistent compared to standard Wi-Fi gear.
• A significant disconnect exists between security professionals, who advocate for high-end equipment or complex network isolation, and average consumers, who simply want affordable "plug and play" devices to monitor their homes.
• Manufacturers frequently exhibit poor security hygiene, including the use of hardcoded credentials, unencrypted protocols, and failure to properly purge user data during factory resets.
• Coordinated disclosure processes are often frustrating and ineffective, with vendors downplaying the severity of vulnerabilities, releasing flawed patches that can brick devices, and failing to address long-standing security flaws.
• Real-time location data is often exposed via unencrypted protocols, creating privacy risks where sensitive information can be intercepted by unauthorized parties on a local network.
The consensus reflects a deep frustration with the current state of consumer IoT, where cheap, poorly engineered hardware dominates the market. While experts argue for network isolation and high-quality equipment, the average consumer's demand for convenience and affordability creates a race to the bottom that incentivizes manufacturers to neglect security. There is little confidence that either the transition to AI-assisted development or current disclosure processes will resolve these foundational flaws, as the systemic issues are rooted in corporate culture rather than a lack of tooling.