迁移宽带后续，不经意发现光猫里的 b01odmv3 插件疑似会上报光猫下所有设备 MAC 地址

倒腾光猫 Telnet 时，发现虽然默认账户一大堆文件没权限写，但是少部分目录是给了读取权限的，比如光猫 saf 的插件目录 /opt/upt/apps

快速遍历了一下这个目录，发现有个 json 文件，用 cat 命令看了看，发现里面有连到过光猫的所有设备名和 MAC

上网查了下，这个插件貌似和小翼助手有关，猜测是光猫会上报所有连到光猫的 MAC 地址给小翼助手的服务器，然后服务器根据 MAC 地址得到设备类型和设备 ID

感觉这么做有点过度收集用户隐私了，准备单独买个非运营商的公版猫了

文件路径是 /opt/upt/apps/apps/opt/preinstall/b01odmv3/data/conf_init.json，下面是内容，隐私已经处理

[{
	"action": "write",
	"subtype": "appuse",
	"policies": {},
	"addr": "message.189cube.com:9890"
}, {
	"action": "write",
	"subtype": "appctrl",
	"policies": {},
	"addr": "message.189cube.com:9890"
}, {
	"subtype": "osinfo",
	"period": 0,
	"action": "write",
	"pdev_conf": {
		"devices": [{
			"osid": 40105,
			"mac": "XX:XX:XX:XX:XX:XX",
			"desc": {
				"id": 40105,
				"devtype": 1,
				"elinktype": 0,
				"groupid": 1,
				"model": "三星 Galaxy S",
				"brand": "三星",
				"ostype": 1
			}
		}, {
			"osid": 13444,
			"mac": "XX:XX:XX:XX:XX:XX",
			"desc": {
				"id": 13444,
				"devtype": 1,
				"elinktype": 0,
				"groupid": 4,
				"model": "华为 P40",
				"brand": "华为",
				"ostype": 1
			}
		}, {
			"osid": 45000,
			"mac": "XX:XX:XX:XX:XX:XX",
			"desc": {
				"id": 45000,
				"devtype": 1,
				"elinktype": 0,
				"groupid": 12,
				"model": "vivo Y3",
				"brand": "vivo",
				"ostype": 1
			}
		}, {
			"osid": 65507,
			"mac": "XX:XX:XX:XX:XX:XX",
			"desc": {
				"id": 65507,
				"devtype": 7,
				"elinktype": 0,
				"groupid": 352,
				"model": "电脑",
				"brand": "其它",
				"ostype": 3
			}
		}, {
			"desc": {
				"os": "",
				"elinktype": 1,
				"dev_type": "elink",
				"model": "PSDN-TC30",
				"brand": "HUAWEI",
				"devtypeint": 5
			},
			"mac": "XX:XX:XX:XX:XX:XX"
		}, {
			"osid": 42054,
			"mac": "XX:XX:XX:XX:XX:XX",
			"desc": {
				"id": 42054,
				"devtype": 5,
				"elinktype": 0,
				"groupid": 7,
				"model": "新路由路由器",
				"brand": "联想",
				"ostype": 4
			}
		}, {
			"osid": 40000,
			"mac": "XX:XX:XX:XX:XX:XX",
			"desc": {
				"id": 40000,
				"devtype": 0,
				"elinktype": 0,
				"groupid": 352,
				"model": "安卓设备",
				"brand": "其它",
				"ostype": 1
			}
		}]
	},
	"type": "lua_cmd"
}, {
	"action_type": "0xff12",
	"subtype": "appmlp",
	"action": "write",
	"policies": {},
	"addr": "message.189cube.com:9890"
}, {
	"period": 1800,
	"type": "__svr_data",
	"seed": "1702450915619",
	"addr": ["b01-data-reported.189cube.com:7890"]
}, {
	"max_asterisk": 128,
	"type": "__http_rule",
	"max_simple": 10240,
	"seed": ""
}, {
	"type": "sys",
	"sw_def_enabled": true,
	"action": "write"
}, {
	"type": "sigcollect",
	"action": "write",
	"send_brshowerr": false
}, {
	"subtype": "postmsg",
	"write": {},
	"action": "write"
}, {
	"subtype": "pktpolicy",
	"policies": {},
	"action": "write"
}]

ttyUSB0

262 天前

@jim9606
1. 电信光猫的 useradmin 前台是看不到插件状态的，只有超级用户里的插件下发记录面板中能看到，或者在 telnet 中执行 ps 或者 top 命令查到进程号。但即便是上面说的这些方法，也只是简单的查看插件状态，不能操作插件
2. 另外，我这款光猫没有 WiFi ，谈不上蹭网，而且电信提供的光猫，网页里面更没有给用户留 MAC 黑白名单或者 DHCP 静态分配的设置
3. 退一步说，即便存在您提到的这些功能，且这些功能是小翼管家 App 独占的，需要依赖这个插件，难道光猫把局域网所有 MAC 地址传给第三方服务器就是一定合理的吗？
4. 最后，JSON 中留下的 URLs ，从语义上看也很明显是用来上报数据的，所以很难不引起怀疑