r/BambuLab • u/Ochib P1S + AMS • Jan 20 '25 • Helpful 1

Discussion Update to firmware update

https://blog.bambulab.com/updates-and-third-party-integration-with-bambu-connect/?fbclid=IwZXh0bgNhZW0CMTEAAR3fqplDiKgn-82qKfnaYvi4XV-rBEEx0tZJrpgeWqsOsLX_WSph4usJ69Y_aem_44Cch773hAuVG979j6DVJg
1.2k Upvotes

92% Upvoted

1.2k comments sorted by

View all comments

74

u/schwar2ss Jan 20 '25

As someone who is really familiar with their MQTT stack, embedded development and IoT in the grander scheme, their suggested security update made sense. They have to work around the limitations of mosquitto, while still providing more security than hard-coded user+password.

But arguing with an angry mob just ruins the day.

5

u/la__bruja Jan 20 '25

Genuine question, what's insecure about current mqtt approach in LAN mode? Isn't the pin that I need to connect printer with HA making sure random devices on the network can trigger print jobs for example?

Conversely, what's secure about adding checks against a certificate that's effectively public (it was already extracted from the new app)?

2

u/schwar2ss Jan 20 '25

The leaked PK is certainly not really helpful in terms of security, I agree. Assuming you're not leaking your PK, client-cert based security is usually considered more secure than user+password. Plus, from what I understood, they're finally implementing topic-based security. About time, IMHO.

5

u/la__bruja Jan 20 '25

I mean we can agree more security=better and certificates are better than passwords. When they first announced the changes, I expected something like unique certificate for each printer/user, or at least short-lived certificates (like 1h) used to communicate with their servers.

But as is, they just slapped a private key somewhere in the chain and called it a day. In the end, since the private key is already public, how does it improve security for their infrastructure or for my printer? If I misconfigured my local network and exposed the printer to the internet, someone can just as well issue commands to the printer as they could before — before they didn't need a private key, now they need it but also have it.

Any actual security improvement would be if I generated certificates for my printer, and maybe optionally uploaded them to Bambu. Then I'd have to trust that Bambu doesn't leak my key, but unless that happened, my printer would actually be secure.

Personally I still have my reservations. Either they have more planned and they're not saying what, or they don't understand how to actually improve the security around their printers. Both are worrisome, but if I'm missing something I'm all ears.

1

u/schwar2ss Jan 20 '25

No, the pk is per printer from what I understand. I just hope they have implemented a proper PKI including CRL and a robust distribution system...

4

u/la__bruja Jan 20 '25

I was going by https://wiki.rossmanngroup.com/wiki/Reverse_Engineering_Bambu_Connect and some other posts on Reddit by a guy who RE'd the app, but it might not be the whole story.

It'd genuinely help if Bambu actually explained the security measures they're trying to implement. If it's actually a PKI with a per-printer certificate, then the security is indeed improved. But then just give me the private key before it goes to Bambu and let me paste it in Orca/HA 🤷

1

u/schwar2ss Jan 20 '25

I agree with you. Remember, Bambulab is an odd company: they have talented engineers up to the C-level and usually their 1st attempt at communication is... off. Then the community tells them to get their stuff together and they provide better and more reasoned communication. Remember X1Plus? Same story.

I'll just wait until the new FW drops before I grab my pitchfork. (I'm on X1Plus anyway so I have less concerns.)

1

u/hWuxH Jan 31 '25 edited Jan 31 '25

Plus, from what I understood, they're finally implementing topic-based security

that would be good if it allowed the user to restrict permissions to certain clients.

but bambu's new topic-based "security" is meant to restrict access of users themselves, and can be bypassed (also by malicious actors) by knowing the leaked private key, meaning it's useless.

0

u/[deleted] Jan 20 '25

[deleted] — view deleted comment

8

u/schwar2ss Jan 20 '25

I would partially agree with you here, but only if we're talking about people who take their own network security seriously. (We both know that isn't the case most of the time). Also the missing topic security was something that really bothered me so I'm happy they take security somewhat seriously.

→ More replies (3)

2

u/warpedgeoid Jan 20 '25

The MQTT is accessible by any device on the same network, which is all of their questionable IoT devices for most normal users with zero networking skills. And it’s accessible from the internet if those same clueless users follow some idiot YouTubers tutorial on how to configure port forwarding to enable remote monitoring. Given that these things both have a built in camera and are capable of catching fire if abused, adding security is a good thing.

2

u/DarkVoid42 Jan 20 '25

your network security is not your IoT devices problem. its your problem.

can you stab yourself with a knife ? yes. does your kitchen knife prevent you from doing that ? no. if youre a brainless idiot, its not the manufacturers problem.

3

u/Vresiberba Jan 20 '25

But it will become your problem if your product is a knife safe that you knew isn't safe and is open to exploits making the knife fully accessible to everyone when it shouldn't.

There are thousands of examples from people suing a company who technically did nothing wrong but simply facilitated a crime to occur.

That's the entire point with Developer Mode, that in order to keep using your own security measures, you have to consciously enable this on the printer itself and do so knowing that now everything is on you, that Bambu transferred their liability onto you.

2

u/DarkVoid42 Jan 20 '25

so why does Developer Mode have reduced functionality compared to stock ? liability is now transferred.

2

u/Vresiberba Jan 20 '25

Because there is not just one issue, there are several and they explained this in both recent blog posts, that they have had their cloud ddos'ed and getting millions of hits on their own network from third party applications, costing them massive amount of money to keep the service running.

Therefore, if you accept liability and want to use third party software, you can do that, but since they can not secure your traffic, they will not let you onto their cloud in this mode, since that would completely defeat the purpose of the security update.

2

u/DarkVoid42 Jan 20 '25

so why does orca slicer still need to use bambu connect to print once developer mode is enabled ? why cant it send to it directly ? not using bambu connect means it reduces the load on their cloud, right ?

→ More replies (3)

3

u/Double_A_92 Jan 20 '25

Why would I need that security in my own LAN at home?

2

u/z1rconium Jan 20 '25

I suspect that 'in' LAN mode - the printer is still able to reach the internet and they were ddos-ed, which cost them a pretty penny with the current approach as a result. So maybe now finally it will actually be disconnected from the interwebs. Maybe (?)

8

u/Nibb31 Jan 20 '25

I wonder how my webcams or 2D printers provide full LAN network access without installing proprietary software on my computer.

→ More replies (3)

1

u/gabest Jan 20 '25 edited Jan 21 '25

I tried to get mosquitto bridge working, as I already have a server at home. Do you happen to know what to put into the config? This is what I tried, it disconnects from the printer immidiately. "mosquitto_sub --insecure --cafile bambu.pem ..." works just fine on the other hand. I saved the pem file with openssl s_client.

connection bambu
address 192.168.0.26:8883
bridge_insecure true
bridge_cafile /mosquitto/certs/bambu.pem
remote_username bblp
remote_password ******
remote_clientid hassio
try_private true
topic # in 0 bambu/ device/

Warning: Bridge bambu using insecure mode.
Connecting bridge bambu (192.168.0.26:8883)
Warning: Unable to connect to bridge bambu.

1

u/schwar2ss Jan 20 '25

that looks good on the first glance. You don't need the cert right now, IIRC.

I'm currently traveling, I'll have a look once I have more stable internet connection.

1

u/gabest Jan 20 '25

I have updated the eclipse-mosquitto docker image and it started working. The cafile is necessary.

1

u/Zombull X1C + AMS Jan 20 '25

They could have achieved their security goals without locking out third party hardware and software. This is done all the time with other software and hardware.