TP-Link Router Exploitation

I recently received an email notification from Spectrum, my internet service provider. It warned that some TP-Link routers may be vulnerable following a recent FBI-identified security issue. Because I don’t rent my modem and router from Spectrum, they can’t fix it remotely. They recommend that I (1) update the firmware, (2) change the admin password, and (3) replace the router if it’s over 5 years old.

I explored the links provided in the Spectrum email notification. The first is a link to an FBI Public Service Announcement (PSA). It says that the Russian military, specifically the group known as APT28, Fancy Bear, or Forest Blizzard, is conducting attacks on vulnerable home and small-office routers around the world. This allows them to intercept internet traffic so they can steal passwords, authentication tokens, emails, and browsing data. High-value targets include military, government, and critical infrastructure.

Specifically, the PSA refers to CVE-2023-50224 where CVE stands for “common vulnerabilities and exposures”, 2023 is the year the vulnerability was found, and 50224 is a unique identifier for the flaw. A TP-Link security advisory lists the legacy products that are impacted by CVE-2023-50224 (i.e., the models targeted by APT28) and their remediation status.

Fortunately my TP-Link Deco S4 version 3.6 mesh router system is not on the list. I updated the firmware just over a year ago to build 20240927 (i.e., September 27, 2024). The firmware description does not comment on whether specific CVEs have been fixed, but given that CVE-2023-50224 was identified in 2023 and the firmware update was Build 20240927 (i.e., September 27, 2024), I assume the vulnerability, if it existed on my model in the first place, has been patched.

On a related note, I came across a list of TP-Link End of Life Products and discovered that my TP-Link Deco S4 version 3.6 has an “EOS Notification Date” of 7/27/2025 and an “EOS Date” of 1/27/2026. TP-Link defines End of Life (EOL) products as “products where the production has either ended on the model or the specific version of the model.” Of greater relevance to security vulnerabilities are 2 additional milestones as defined in the TP-Link EOL Policy. The End of Sales (EOS) date is when TP-Link discontinues a product. The End of Maintenance (EOM) date is when TP-Link will no longer provide support or maintenance for a product. So if I interpret these definitions correctly, the first thing that happens is EOL when TP-Link stops producing a model. Then EOS occurs when TP-Link stops selling and accepting new orders for the product. And finally EOM occurs when TP-Link no longer supports the product (I assume this includes firmware updates). So even though my Deco S4 version 3.6 is no longer sold (at least not by TP-Link; it is still sold by Amazon via the link above) according to the EOS Date, I have not received any clear indication that it is no longer maintained. According to ChatGPT, TP-Link does not publicly disclose EOM dates but in general, EOM occurs roughly 3 years after EOS and the only way to determine the EOM date for a specific model is to contact TP-Link support.

The PSA also refers to a UK National Cyber Security Centre Cybersecurity Advisory. It provides a more detailed description of APT28 malicious activity and provides a non-exhaustive list of specific TP-Link router models targeted by APT28 that closely resembles the TP-Link security advisory for CVE-2023-50224.

The bottom line, as described in the Spectrum email notification, is that your router is a device that can have security holes, similar to your desktop/laptop computer or phone. It is therefore important to keep your router firmware updated similar to how you’d update the operating system on your computer or phone. Additionally, you should practice good security hygiene by using strong passwords and replacing equipment that is no longer supported by the manufacturer.

Online Tracking Technologies

In a previous “Hospital Websites and Meta Pixel” post, I discussed how the Meta Pixel tracker was found on many hospital websites, including appointment scheduling pages and password-protected patient portals. This could result in Meta (the parent company of Facebook) obtaining protected health information (PHI) which would violate the law, namely the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

A few days ago, the Office for Civil Rights (OCR, a federal agency under the U.S. Department of Health and Human Services) and the Federal Trade Commission (FTC) issued a press release to warn hospital systems that “the use of online tracking technologies that may be integrated into their websites or mobile apps that may be impermissibly disclosing consumers’ sensitive personal health data to third parties.”

It also links to a joint letter that was sent to approximately 130 hospital systems and telehealth providers whose intent was to emphasize potential risks around the use of online tracking technologies. The letter specifically names Meta/Facebook Pixel and Google Analytics as examples of online trackers that can “gather identifiable information about users as they interact with a website or mobile app, often in ways which are not avoidable by and largely unknown to users.”

Although no enforcement activity was mentioned, it concluded by recommending the following: “To the extent you are using the tracking technologies described in this letter on your website or app, we strongly encourage you to review the laws cited in this letter and take actions to protect the privacy and security of individuals’ health information.”

In December 2022, the OCR had issued guidance for the use of online tracking technologies and specifically mentioned that “Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules.”

It is clear that healthcare provider organizations have been put on notice about patient privacy and security requirements under HIPAA law. It will be interesting to see if there are any officially documented violations that result in enforcement action.

Hospital Websites and Meta Pixel

Meta (the company formerly known as Facebook) is in the hot seat again, this time in conjunction with many hospitals and health systems across the country. A tracker called the Meta Pixel was discovered on many hospital websites, bringing into question once again how much you can trust third parties with your sensitive information. According to an article by The Markup, 33 of Newsweek’s top 100 hospitals in the country were sending sensitive data to Facebook via Meta Pixel as of June 15, 2022. The Meta Pixel tracker was found on multiple areas of hospital websites including appointment scheduling pages and password-protected patient portals. The information included medications, allergies, search terms for how doctors were found (e.g., “pregnancy termination”), and other data. Details of how The Markup obtained this information are provided here.

It is common knowledge to many individuals, particularly those who have watched The Social Dilemma, that Meta tracks personal information for its users. So why is the discovery of Meta Pixel such a big deal? In healthcare, a law called the Health Insurance Portability and Accountability Act (HIPAA) prohibits “covered entities” like hospitals from sharing “protected health information” (PHI) with third parties like Meta.

A covered entity is an individual, organization, or agency that transmits personally identifiable information. It includes health care providers, health plans, and health care clearinghouses. The hospitals that were found to have Meta Pixel installed on their websites are covered entities.

PHI (a.k.a. “Individually identifiable health information” or “personally identifiable health information” or other variations) is defined as information, including demographic data, that relates to:

• the individual’s past, present or future physical or mental health or condition,
• the provision of health care to the individual, or
• the past, present, or future payment for the provision of health care to the individual,

and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.

In other words, HIPAA law is written in a way that individuals and organizations who have access to patient information are expected to keep it private and only use it when necessary to deliver patient care, handle payment, or perform other permitted administrative functions. According to The Markup:

“I am deeply troubled by what [the hospitals] are doing with the capture of their data and the sharing of it,” said David Holtzman, a health privacy consultant who previously served as a senior privacy adviser in the U.S. Department of Health and Human Services’ Office for Civil Rights, which enforces HIPAA. “I cannot say [sharing this data] is for certain a HIPAA violation. It is quite likely a HIPAA violation.”

Meta Pixel has been the subject of several class action lawsuits in several states. Results have been mixed, and you read more about them in the “Legal Implications” section of the article by The Markup. Meanwhile, as patients and as users of technology, we have to ask ourselves if we trust social media and if we trust our hospitals to safeguard our health information.