Linksys Velop routers send Wi-Fi passwords in plaintext to US servers

Link📌 Summary:

根據Testaankoop的調查,發現兩款Linksys路由器正在以明文的方式將Wi-Fi登入資訊傳送到位於美國的亞馬遜(AWS)伺服器,包括Linksys Velop Pro 6E和Velop Pro 7這兩款mesh路由器。這個漏洞讓攻擊者能夠攔截傳輸過程中的Wi-Fi網路名稱(SSID)和密碼,從而進行竊聽和惡意攻擊。儘管Testaankoop多次向Linksys提出警告,但該公司並未採取有效措施,直到Testaankoop再次聯絡後才進行了更新,但仍未解決問題。這個問題可能源於Linksys固件中使用的第三方軟體,但無論如何,這種漏洞仍然存在,即使是最新的Linksys 7 Pro,都無法避免。研究人員建議消費者不要購買這些路由器,因為存在嚴重的網路入侵和資料損失的風險。

🎯 Key Points:

Testaankoop發現兩款Linksys路由器在明文中將Wi-Fi登入資訊傳送到AWS伺服器,包括Linksys Velop Pro 6E和Velop Pro 7。
這個漏洞讓攻擊者能夠攔截SSID和密碼,進行竊聽和惡意攻擊。
Testaankoop多次向Linksys提出警告,但該公司未採取有效措施。
更新後的固件仍無法解決問題。
這個問題可能源於Linksys固件中使用的第三方軟體,但無論如何,這種漏洞仍然存在。
研究人員建議不要購買這些路由器,並建議用戶更改Wi-Fi網路名稱和密碼。

#Linksys #router #meshnetworking #dataprotection #cybersecurity #vulnerability #AWS #thirdpartysoftware #SSID #password #cleartext #plaintext #man-in-the-middle #attack #firmware #security #wiring #hacking #officeenvironments #Patagonia #AI #privacyviolation #classactionlawsuit #Snowflake #MFA #databreaches

🔖 Keywords:

#Linksys #router #meshnetworking #dataprotection #cybersecurity #vulnerability #AWS #thirdpartysoftware #SSID #password #cleartext #plaintext #man-in-the-middle #attack #firmware #security #wiring #hacking #officeenvironments #Patagonia #AI #privacyviolation #classactionlawsuit #Snowflake #MFA #databreaches

Linksys Velop routers send Wi-Fi passwords in plaintext to US servers

According to Testaankoop, the Belgian equivalent of the Consumers' Association, two types of Linksys routers are sending Wi-Fi login details in plaintext

Stack Diary

so, twitter limits us to 5 accounts on the desktop website. which is kind of annoying because, in addition to the current 5 accounts i have on there, i want to also add the one that addresses exersise, but the 5 i have are the ones i more need. this is just one reason the move to ban third party twitter apps is/was annoying and even then kind of the same situation for reddit: there's little bits of features that different people will find useful and a ban on third party applications can sort of make a bit of a mess. i mean, financially, they want to consolidate a little bit i guess. and so, in a way, reddit is being *slightly* kinder? than twitter, in terms of, they're sort of still letting *a few* third party apps now like relay and redreader etc. even if they'll eventually be paid only, at least they'll still exist so that they can be used by *some* people.

#thirdparty
#thirdpartyapps
#3rdparty
#3rdpartyapps
#apps
#software
#thirdpartysoftware
#features

The World Economic Forum recently released its Global Cybersecurity Outlook for 2023 (https://lnkd.in/eaYRjDif). It's worth a read if you haven't yet.

One particular article and chart from that report caught my eye (https://lnkd.in/et2nQFdk) because it relates to research released this week by @cyentiainst and SecurityScorecard examining data on 230k orgs and their 73k 3rd/4th party connections.

In the image below, I've highlighted some findings from that report (in purple) that pertain to what the WEF learned from business leaders about their plans for managing geopolitical risk. I'd say implementing those plans won't be (have never been) easy...but there's good support for putting in the effort.

#infosec #cybersecurity #thirdparty #supplychain #supplychainsecurity #3rdpartyapps #thirdpartysoftware

Global Cybersecurity Outlook 2023

Latest cybersecurity trends and leadership priorities from the World Economic Forum's Global Cybersecurity Outlook 2023

#LastPass has experienced another data #breach, but this time, it exposed #usersdatas. Hackers accessed a third-party cloud storage service used by the password manager and were able to “gain access to certain elements” of “customers’ information.”
https://www.theverge.com/2022/11/30/23486902/lastpass-hackers-customer-information-breach
#passwords #thirdpartysoftware #security
LastPass' latest data breach exposed some customer information

LastPass experienced a data breach that exposed some customer data. The company says a hacker accessed the third-party cloud storage system used by LastPass.

The Verge
Millions of Guests Impacted in Marriott Data Breach, Again

The second breach in less than 24 months stemmed from employee account compromises.

Threatpost - English - Global - threatpost.com