Software neglect forces perfectly good hardware obsolete. I was suprised it could strike such basic devices as
an ethernet switch.
Few years ago I bought a TP-Link gigabit switch for home network. TL-SG2216 model ticked all the
boxes: 16 ports, 2 SFP slots (if I ever get FTTH), VLANs, IPv6 support and remote management, 5 years warranty.
Although ssh required strange dances since the beginning
(ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oCiphers=aes256-cbc -oHostKeyAlgorithms=+ssh-dss …), the HTTPS
interface worked fine. Until it broke last year.
Firefox was adamant – SSL_ERROR_NO_CYPHER_OVERLAP. Chromium threw similar tantrum: ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
HTTPS management UI on my switch ceased to be secure enough for modern browsers. The world rushed forward,
obsoleting and disabling old, unsecure algorthms and protocols. In the meantime my switch stood still.
Eventually the world surpassed what was possible with TP-Link.
From my perspective, the web UI broke. I bought a switch with HTTPS management, and this feature stopped working.
So, in the last days of my warranty coverage, I reported the issue to TP-Link. Long story short, it was denied on
a technicality. I should have opened the issue through the distributor who sold me the switch, not directly
with TP-Link. I've got this information after the warranty lapsed, which ended the story.
But frankly, I do not think TP-Link would be able to salvage this situation. I put only a tiny blame on them.
They designed the switch couple years ago. It was good enough and worked with the ecosystem of its time.
They provided couple minor firmware upgrades, and after a decade on the market, EOLed the switch.
It is the world which changed.
Couple decades ago, network hardware once deployed would be working for years, practically forever. Security risks weren't
so serious as we have now. No one would deprecate and remove protocols in the name of security.
How long 3DES (hell, even single DES?) was with us?
Today, security is paramount. Our lifes are entwined with TCP/IP services. Protocols are phased out
and improved when needed. Web browsers automatically update to newer versions. And this is good.
But manufactures need to catch up. Product development cannot end when market availability starts.
Fixes, updates are required to do more work to retain functionality. Even bigger changes like adding new TLS protocol
needs to happen during the device lifetime. We need regulators (like EU) to enforce that.
We also need to vote with our wallets. Maybe pay a bit more, but buy from companies providing better support
for their products, through their shelf-life and beyond. Couple of years ago I was dissapointed
[2] with Motorola not delivering on promise of upgrades for Moto G. I will not buy Motorola Android phone
again.
What options do I have with the switch?
I could replace the switch with something modern, but it's just spending money and generating electro-waste.
I could get a little VM with obsolete operating system and an old browser just to manage this switch. This is unsafe,
makes me shudder and is too cumbersome to even consider.
Finally, I can manage the device using plain, unencrypted HTTP. Given it's accessible in my LAN only,
this is the way to go. I will be sad inside, but that's the only loss.
sslscan output below shows the sad state of TP-SG2216 web management:
Testing SSL server distrans.pipebreaker.pl on port 443 using SNI name distrans.pipebreaker.pl
SSL/TLS Protocols:
SSLv2 disabled
SSLv3 disabled
TLSv1.0 enabled
TLSv1.1 disabled
TLSv1.2 disabled
TLSv1.3 disabled
Supported Server Cipher(s):
Preferred TLSv1.0 128 bits RC4-SHA
Accepted TLSv1.0 128 bits RC4-MD5
Accepted TLSv1.0 112 bits DES-CBC3-SHA
Accepted TLSv1.0 56 bits TLS_RSA_WITH_DES_CBC_SHA
Tomasz Torcz
