The IT Nerd

China based TP-Link who make routers that are pretty popular here in North America are being fingered by US lawmakers for being a national security threat. Here’s the details:

In a letter sent this week to Commerce Secretary Gina Raimondo, Reps. John Moolenaar (R-MI) and Raja Krishnamoorthi (D-IL) claimed TP-Link’s routers have been found to have an “unusual degree of vulnerabilities.” They called on the department to respond with findings on the company’s security risks by the end of August, and to determine if TP-Link products should be restricted in the U.S. 

Amid China’s “increasingly draconian data protectionist and national security-focused legal regime,” the lawmakers wrote, “companies like TP-Link are required to provide data to the PRC [People’s Republic of China] government and otherwise comply with the demands of its national security apparatus.”  

The congressmen, who lead the House Select Committee on China, cited the cyber activity by the Chinese APT group Volt Typhoon as a reason for concern around home and office routers. A hallmark of the group’s hacking campaign against U.S. critical infrastructure is the infiltration of home routers for the purpose of launching other attacks.

And the thing is that flaws in these routers that hackers can exploit are a thing:

For years, critical vulnerabilities in TP-Link routers have been abused by hackerswho use them as cover for subsequent attacks or add them to powerful botnetsthat disrupt websites with bogus traffic.  

In May 2023, researchers at the cybersecurity firm Check Point attributed cyberattacks on “European foreign affairs entities” to a Chinese state-sponsored group they called “Camaro Dragon.” The hackers used a firmware implant for TP-Link routers to get control of infected devices and access networks.  

TP-Link denies the accusations. But if you have a TP-Link router, you may want to reconsider if you want to use it. It could be perfectly safe. But it also may not be safe. These days you can’t take any chances.

This entry was posted on August 19, 2024 at 8:14 am and is filed under Commentary with tags TP-Link. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.