Reverse Engineering the TP-Link HS110 | Hacker News Reader

Reverse Engineering the TP-Link HS110

softscheck.com

100 pointszdw22 comments

> The binary TDDP protocol merits further research since it is available on a broad range of TP-Link devices.

The tdpServer binary regularly get abused to root TP-link devices for Pwn2Own Tokyo : https://www.thezdi.com/blog/2020/4/6/exploiting-the-tp-link-...

Also :

- https://mjg59.dreamwidth.org/51672.html - https://www.coresecurity.com/core-labs/advisories/tp-link-td... - https://medium.com/@CoreSecurity/a-story-about-tp-link-devic...

> This is the certificate used to verify the identity of the cloud server. The file contains the “VeriSign Class 3 Public Primary Certification Authority – G5” root certificate. This means the only check performed when establishing a TLS connection to the cloud is if the provided server certificate has been signed by the Symantec/VeriSign CA for Extended Validation (EV) certificates (CA pinning). A determined attacker could buy his own EV certificate and use it to impersonate a cloud server.

This part I don't get. Do they mean the firmware verifies the CA but NOT that the cert is actually for the domain/CN they want? If they made such a glaring mistake I would expect the write up to say it explicitly.

The way this is written seems to imply that all you need to impersonate a server is to buy a cert from the same CA it uses, which is obviously not the case.

You missed the part where you can change the server address with remote command.

Basically you can change cloud server address, but it will still check for symantec root, so you need to buy EV certificate from them.

Windows has a prominent setting that does exactly this for 802.1x authentication: choose the authority from a big, prominent list and optionally specify the server name it‘ll automatically send your credentials to (over wireless, no less).

edit

I’m not buying his argument that because the root certificate is on the image, that’s the only thing the script checks.

Good write up - it’s worth adding that TP Link recently removed this local api on port 9999 from these devices. This has caused a bit of a fuss since they are quite popular for use with Home Assistant. You can get it reenabled by contacting tp link support for a custom firmware but they have burned a lot of customers with this. A shame because the hardware is not bad, they just want people to use their own, unintegrated app with it.

> it’s worth adding that TP Link recently removed this local api on port 9999 from these devices. This has caused a bit of a fuss since they are quite popular for use with Home Assistant.

I have the HS100 which I use for occasional/seasonal automation (Christmas lighting etc).

I don’t like that all :(

I have a hardware version 4 HS100, and it's completely updated. It receives commands on port 9999 fine, so maybe the beta firmware has been rolled out generally, at least for V4 devices.

I think someone on Tweakers.net mentioned it was only rolled out to certain regions. I don't own one myself though so I wouldn't know.

I used this blog post as the basis for a small library to control my own closely related LB130 lightbulbs from the command line a while ago[0], works like a charm.

[0]: https://github.com/falkaer/tplink-lb130-api

What equivalents wit open source firmware do you suggest?

I've come across a few other projects, but haven't written the links down. Here are some:

http://benlo.com/esp8266/KankunSmartPlug.html

https://tasmota.github.io/docs/Tuya-Convert/

And similar to the last one, there is the esphome project: https://esphome.io/index.html

You should be looking for something that is compatible with tuya-convert.

That lets you do OTA upgrades to a basic tasmota firmware. Once that is done it's trivial to load full tasmota on there which gives you a MQTT interface & a basic webserver

Also tuya hardware is generally quite nice compared to other cheap alternatives.

The bad

> Phones home even if set up as local-only

This ought to be illegal.

Maybe it is... Go to China and sue them, lol

If they sell in your country, you can sue them here.

If they don't, you imported and got what you paid for.

I am working on a similar project, but I'm currently puzzling around prying the firmware apart.

The article casually mentions

> After decompiling the Kasa app

How does one do that ?

I can get to the ARM dissasembly, but my disassemby reading skills are a bit poor. Is there an ARM decompiler I could use, that gives me some sort of C-like code? I found the Radare project, but I'm a bit stuck there.

Android apps are usually written in Java, and more recently in Kotlin. These kind of apps are quite easily reverse engineered, because java binaries are not machine code binaries, rather java byte code. Today's IDEs will decompile the java byte code in no time, giving you access to the source code.

The only line of defense the developers have is to obfuscate the code, but that only means that you will get access to a version of the source code where the original name of the variables, functions, classes was changed to abstract names so that code is harder to read. Even so, you are in much better state that going through disassembling an ELF binary.

Seriously nice write up! Kudos for taking your time to do this research.

On the reverse engineering side, is it... Legal?

depends on (roughly in descending order) the software licence agreement, local laws, the extent of encryption and/or obfuscation, and your ethical viewpoint. RE can be used for good, bad and anything inbetween. I for one believe it's valuable to expose crappy engineering in IoT devices and the like

How about, who cares? The device is yours, you own it.

I've recently taken an interest in these types of articles. Time read this one and the one in which someone reimplements the protocol used by their exercise bike. What are some good resources a beginner can h3ck out to learn what is attempted here?

Very nice writeup.

I tried the script on one of my HS105's and noticed I had a location in there. Promptly removed it using the app, and it was gone from the next call of the script.

I think it's good I set those up on a separate very limited VLAN...

Reply on news.ycombinator.com