Tenable's research team writes about security research, including reverse engineering, router and app vulnerabilities, Ghidra tooling and Rust optimization.
HN commenters link it for its Discord reverse engineering post, G-3PO for Ghidra, router authentication bypasses, and the WebRTC ICE port scanning discussion.
Pretty much, yes. WakaSaba's major offering - at least, that's what the headline and demo video focused on - seems to be a new control toolkit for video meetings, and I feel like it should be possible to get a good chunk of that without doing all the hard to work to develop, host, and maintain your own videoconferencing suite. Like, say I wanted to advance my slideshow without walking over to the keyboard on the podium; I could build a fancy smart remote that talks to the cloud with its own GSM radio and interfaces with a novel presentation suite specifically designed to integrate with my remote, or I could make my remote a bluetooth keyboard that can only press the left and right arrow keys and then keep PowerPoint focused.
I don't know what enterprise conferencing suite would be easiest to talk to. It'd be straightforward if I wanted to use a local video stream, proxy `navigator.mediaDevices.getUserMedia` and generate synthetic click/keyboard events as necessary [1] or make like the remote and pretend to be a keyboard, but the really interesting thing would be to run WakaSaba on a second device and use it to control my "primary" presence. I took a quick spin through some different videoconferencing suites to see what looked doable:
FaceTime: No API, no client SDK, no browser client, dead end.
Google Meet: No API, no client SDK, but a web client. If they're using html5 video elements (which I haven't checked) you could probably intercept the streams, correlate them with…
Yes, a few days ago there was a story in HN that went mostly ignored: “G-3PO: A Protocol Droid for Ghidra” https://medium.com/tenable-techblog/g-3po-a-protocol-droid-for-ghidra-4b46fa72f1ff
https://news.ycombinator.com/item?id=34161642
That’s a script for the reverse-engineering tool Ghidra that uses GPT-3 to de-compile machine code and to write plain English explanations of what a piece of code does.
The article is quite detailed and describes both its capabilities and its limitations.
That G-3PO script is open source, MIT license: https://github.com/tenable/ghidra_tools/tree/main/g3po
There was also another HN story about what at first sight looks like an alternative implementation of the same idea: “GptHidra – Ghidra plugin that asks OpenAI Chat GPT to explain functions”
https://news.ycombinator.com/item?id=34165291
This one is more recent and lacks that good write-up mentioned above. The script is smaller and it seems to have fewer features.
I suggest checking both of them.
You are right, ICE does support TCP. Not all ICE implementations support it though, probably where the incorrect anecdote comes from.
ICE TCP did get a little more limited recently in Chromium though [0] because of the TCP port scanning issue [1]
I have also heard that some gateways/firewalls/$x don't allow any non-TLS traffic, so you can't even establish ICE. In those cases the DTLS/TLS transport of TURN is nice.
[0] https://lists.w3.org/Archives/Public/public-webrtc/2020Feb/0022.html
[1] https://medium.com/tenable-techblog/using-webrtc-ice-servers-for-port-scanning-in-chrome-ce17b19dd474
Excellent catches. I would like to put https://medium.com/tenable-techblog/g-3po-a-protocol-droid-for-ghidra-4b46fa72f1ff in the second-chance pool (so it would get a random placement on HN's front page - see https://news.ycombinator.com/item?id=26998308), but unfortunately https://news.ycombinator.com/item?id=34161642 is too old and I can't contact the submitter.
Would you be willing to submit https://medium.com/tenable-techblog/g-3po-a-protocol-droid-for-ghidra-4b46fa72f1ff and email us at hn@ycombinator.com so we can put it in the SCP manually?
Web server itself could be an attack vector too.
Although not specified to TP-Link, There are many exploits on other brands that can bypass the Authentication. For example this one:
https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
Even allowing access the web server from internet could be dangerous.
Data from a lot of users? I mean, they inspect all audio/video communications in real-time[1] and save all your messages, pictures etc. It also helps a lot that basically no one cares about privacy anymore, so further growth seems secured.
[1] https://medium.com/tenable-techblog/lets-reverse-engineer-discord-1976773f4626