This topic

Smart Hub 2 Possible Security Issue or weird bug?

_jonny — Sat, 05 Aug 2023 07:16:20 GMT

Been having some issues recently with the stability of the line so I decided to login into the admin page of the hub. To my surprise though I see network details (SSID etc) which aren't my own. I click through to the connected devices and I see my neighbours phone tablet etc.

If I refresh the page it seems to revert back to my network again with my devices etc. Has anyone seen behaviour like this before? Strangely the first SSID in the picture doesn't seem to actually exist

Re: Smart Hub 2 Possible Security Issue or weird bug?

_jonny — Fri, 04 Aug 2023 22:55:46 GMT

Additional screenshot from the devices page. These are my neighbours devices (they have never been inside my house)

Re: Smart Hub 2 Possible Security Issue or weird bug?

gg30340 — Fri, 04 Aug 2023 23:53:52 GMT

Do you or your neighbour use powerline adaptors?

Re: Smart Hub 2 Possible Security Issue or weird bug?

Perceptive — Sat, 05 Aug 2023 04:59:01 GMT

This is interesting and it would be useful if it stayed on the main thread and was discussed here; especially with regard to any solution.

I do not normally use the Smart Hub 2 but I was forced to, earlier this week, when we had speed issues and generally I was quite impressed by it which was a surprise because I had heard that it was very poor. (That said we use very little wifi but the wifi range of our SH2 was good).

One this that I do not like about the SH2 is that when we login via 192.168.1.254 we do not need to enter a user name and a user password to access the device information which on most router that I use is unusual.

It is hard for me to see the screenshots but you appear to be saying that you can inadvertently access your neighbours SH2, (as well as your own and access is switched between both routers as the page is refreshed). - Is that correct?

When you use the 192.168.1.254 login, can you navigate around the router you can see information about and can you navigate to the advanced areas that need an Admin Password and if so does your Admin Password gain full access or is it locked to your neighbour?

A few more questions:

(1). Are you connected via wifi ?

(2). Are you connected via ethernet ?

(3). Are you on the same electric meter as your neighbour?

If you are connected via wifi: has your neighbour every allowed you to use his internet when yours was off and if so could your device have remembered his wifi password or is your neighbours wifi unlocked/open ?

Since power line adapters can work on wiring on the same electrical phase some powerline adapters can pass through consumer units but if you are not on the same electric meter as your neighbour then the powerline option is not considered to be possible.

Re: Smart Hub 2 Possible Security Issue or weird bug?

gg30340 — Sat, 05 Aug 2023 06:55:40 GMT

@Perceptive

"Since power line adapters can work on wiring on the same electrical phase some powerline adapters can pass through consumer units but if you are not on the same electric meter as your neighbour then the powerline option is not considered to be possible".

There have been instances on this forum where forum members who have been using power line adaptors have had this problem where they share a wall with their neighbour and the electrical circuits run beside each other even when on a different consumer unit (meter).

Re: Smart Hub 2 Possible Security Issue or weird bug?

Perceptive — Sat, 05 Aug 2023 09:20:49 GMT

We learn something new every day.

It seems that there was a thread about this, on a on another forum, a few years ago;

https://community.tp-link.com/en/home/forum/topic/197450

The evidence seems to be anacdotal but in the senario you put forward it is possible.

Re: Smart Hub 2 Possible Security Issue or weird bug?

gg30340 — Sat, 05 Aug 2023 09:26:05 GMT

If you can be bothered to search this forum threads you will find that there are a few threads about it and they are not anecdotal because the problem was resolved when the "rogue" powerline adaptors were replaced the problem was resolved.

Re: Smart Hub 2 Possible Security Issue or weird bug?

_jonny — Sat, 05 Aug 2023 16:25:49 GMT

I use power line adapters, not sure about my neighbours but from the evidence you've suggested I'm guessing they do too. I'm surprised that they've ended up connecting because we are on different meters but maybe living in a block of flats there is some kind of route between the circuits.

It actually makes sense because it explains the intermittent speed issues I've been having lately but the hub was reporting it's usual sync speed. I suppose the easiest solution is to change the IP of the hub and range the DHCP server is assigning IPs from

Re: Smart Hub 2 Possible Security Issue or weird bug?

gg30340 — Sat, 05 Aug 2023 17:55:11 GMT

Make sure that you have the powerlines set up with a password and I would suggest that you inform your neighbour to do the same.

The problem appears to be that the the signal being sent along one electrical cable can cross over to another electrical cable if they are running beside each other which can be the case in adjoining houses.

If the powerline adaptors are password protected it should go some way to stop the signal being read.

The electrical meter has nothing to do with any of this. What was previously referred to only applies if the ring mains are on different consumer units formally known as fuse boxes.

Re: Smart Hub 2 Possible Security Issue or weird bug?

WSH — Sat, 05 Aug 2023 20:07:05 GMT

As I understand it, the confusion comes about because of issues with 3-phase. The signal can only be passed to another phase if the wiring goes through the same meter. More of a problem in industrial premises than residential homes. I agree with the advice, however, always change the default encryption on anything you buy.

Re: Smart Hub 2 Possible Security Issue or weird bug?

gg30340 — Sat, 05 Aug 2023 20:53:05 GMT

@WSH

So how does it happen in domestic premises that do not share a meter!

Re: Smart Hub 2 Possible Security Issue or weird bug?

WSH — Sat, 05 Aug 2023 21:20:57 GMT

Sorry, didn’t make myself clear.

I was referring passing the signal between different parts of the same building that are on different phases. For anyone that doesn’t know, quite often industrial premises have different phases to different parts of the building so the supply can get away with delivering enough current. I don’t know how true it is, as I’ve never had to make it work, but I read years ago that getting the different phases to share the signal works if they are coupled at the meter.

Re: Smart Hub 2 Possible Security Issue or weird bug?

gg30340 — Sat, 05 Aug 2023 21:51:28 GMT

Your post was clear but as I have pointed out, the broadband signal can apparently be passed to different electrical cables that are in a domestic situation as in this case, and that are not connected to the same meter as in this case, so I fail to see the relevance of what you are saying unless it is to just point out that the broadband signal can cross between electrical cables.

In any event until the OP posts back with more info about his neighbours set up and what action they have taken there is really nothing further to add at this stage.

Re: Smart Hub 2 Possible Security Issue or weird bug?

licquorice — Sat, 05 Aug 2023 21:53:32 GMT

Mains electricity is delivered by 3 phase supply. In a domestic environment only a single phase is required and the 3 phases are delivered in sequence to houses. Therefore next door neighbours are not on the same phase but are 3 houses apart. However, occasionally this is not the case and adjacent houses are on the same phase which means the signal attenuation between them is not as great as it could be and signals can pass between the premises if both are using power line devices.

Re: Smart Hub 2 Possible Security Issue or weird bug?

WSH — Sat, 05 Aug 2023 22:02:20 GMT

@gg30340

I merely meant, that is where the confusion about meters comes from. You make a fair point, though, so I’ll leave you to it.

@licquorice

Yes, that’s more likely to be the problem here.

Re: Smart Hub 2 Possible Security Issue or weird bug?

Perceptive — Sun, 06 Aug 2023 00:33:04 GMT

All of this is still anecdotal but I do accept that it is possible and I am pleased that I automatically password protected my own powerline devices when I used them 20 years ago and password protecting the powerline devices was the solution that was suggested in the link, (to a TP Link forum discussion), that I provided.

We may be missing the "Elephant in the Room": in that as I pointed out earlier in the thread;

when we login, (to the SH2), via 192.168.1.254 we do not need to enter a user name and a user password to access the device information which on most routers that I use is unusual.

Most other routers that I have used have needed the user to pass a login screen to access to the router information and the Smart Hub 2 does not and IMHO this is a security flaw.

Once a third party has accessed the SH2 via the powerline security flaw or via another glitch in the case of the SH2 the third party can see information about the neighbours router that should not be accessible.

Re: Smart Hub 2 Possible Security Issue or weird bug?

licquorice — Sun, 06 Aug 2023 08:29:20 GMT

I fail to see a security risk.

The hub manager can only be accessed when connected to the LAN, not externally.

Without entering a password, it is read only.