It seems that the controller connects to kcart.alipay.com when started on OC200/OC300 or when changing settings on the »Maintenance« menu.

Presumably, the controller checks which subscribed features requiring monthly fees are to be activated when the (native) Omada Cloud Controller goes online soon. Could be that one can subscribe to those features and make a payment via Alipay, which is the Chinese version of Paypal.

Could also be just a stub to test this function since I didn't see any actual traffic going to Alipay.

IMO this code should have been removed from OC200/OC300 controller versions. But maybe TP-Link plans to offer those features on the SW/HW controller, too, or just forgot to remove the test code before release of the software.

I don't think that it is malware or are you being asked to pay something when changing settings?

SecThrowA_y wrote

This happens on a standard software install of SDN on ubuntu.

Please proof that actual data is flowing to Alipay (tcpdump, iptables). I couldn't see any traffic, just a browser message »Waiting for response from kcart.alipay.com«. Even when blocking Alipay in the firewall I didn't see any dropped packets during appearance of this message . 

As I wrote, you can force this browser message by changing and applying any setting on the »Maintenance« page, even in SW controller. Only on OC200/OC300 the message appears at start / reboot of the controller according to my observations. So please use tcpdump or Wireshark, trace the traffic which is actually exchanged and post it here.

So when a device that literally sits in the datapath of _all_ traffic gratuitously opens connections to a cloud provider in an entirely different country, with no documentation or elaboration of purpose. It becomes a very legitimate concern for any entity (corporate or private).

It's definitely wrong that the controller handles all traffic. It does not. I have Omada SW Controller running in our own cloud for years now and no, it does not sit in the data path for all traffic. No Auranet/EAP/Omada controller version ever did that. It just receives status messages and responds to change requests. User data still flows from EAPs to routers directly. Please get the facts right.

So what's to assure the users of SDN that their networks security is not already compromised? It's literally a few bytes worth of an https post request to send corporate wifi security credentials.

You demand a bit too much of insider knowledge from us users, don't you? Nobody of us has the source code! Why don't you ask TP-Link support who should know? Open a ticket!

When asking in the forum, you will get answers from users, not necessarily from TP-Link support. And as always, those answers can't be authoritative.

@SecThrowA_y, ok, than that was a mis-understanding regarding all traffic. English is not my native language.

Also, I don't take anything personally and certainly not concerning WLAN stuff from whichever manufacturer.

I just share my observation that albeit there is a message in the browser telling us it's waiting for a response from Alipay, no traffic is actually send/received from Alipay. I noticed this message as early as in the beta test for Omada SDN controller, but I don't worry unless there is real traffic. That's why I guessed it could be a left-over from tests for the cloud payment method.

As for me, if I cannot proof that data is flowing to/from Alipay, I do not claim that any data is exchanged with Alipay.

Dear @SecThrowA_y,

Sorry for the confusion and late response.

The URL is invalid and no data is sending to the URL, it has nothing to do with malware. Please do not worry about it too much.

I've forward this to the developer team who will remove the URL in the next 4.2.7 version. Thank you for your valued feedback!

Dear @Pugs,

Also seeing this connection (kcart.alipay.com). Needs to be removed on next update, don't care if its not Malware, QA should have removed this if devs were mucking around with a URL for testing purposes. Thankfully, blocked by Pi-Hole.

Noted, thank you for your kind feedback. The R&D team will remove all the invalid URL in the next 4.2.7 version.