Kevin_Z wrote

Hi,

 

Because the SSL protocol is old/out of date so that it is quarantined when the specific device access the Deco M9.

 

You can get this device via its MAC address showing in the antivirus history page and update it.

 

Good day. 

 

 

Hi, thanks.

However, the MAC address belongs to the Deco M9 base station (as shown in the anti-virus history!?). Does that mean the SSL protocol on the base station is out of date? And if so, how to fix that?

Hi,

Yes please see below.

Thanks for the help!

Ok thanks. However, not sure I fully understand.

1) How can I know what specific device has the out-of-date SSL protocol when the Anti virus history says it is the Deco?

2) This happened at a time when noone was at home, so I dont know what device would try and establish a SSL connection all by itself. The only device that would still be at home at that time, could be an AppleTV but that would likely be sleeping - and does not have an out-of-date SSL protocol accoridng to the latest tvOS?

3) If indeed it was the AppleTv (or another device) why is it not the AppleTv that is blocked/quarantined, instead of the Deco itself? All other anti-virus alerts block the specific device (despite the device obsviously using the Deco to connect to the internet).

4) What is in quarantine now - the Deco or some other device? According to the MAC adress it should be the Deco...?!

5) How can I know for sure that the Deco has not been compromised?

6) What does the quarantine practically do? Will there be limited functionality? For how long will the Deco/device stay in quarantine?

This is still not very clear to me.

Thanks for your help.

Q. Why is my device quarantined?

Sometimes you may find in your Messages that your device is being quarantined, this situation may occur when your device is sending sensitive information or security threats out of your network.

To find out the reason why the device is quarantined, please click the “>” button on the Message.

The Quarantine will only prevent infected devices from sending sensitive information or security threats to clients. But secure packets will still be sent out. In other words, it does not affect the normal use of the device itself.

Sometimes when you see the device quarantined, you may not want it to be quarantined. Then you can turn off the option Infected Device Quarantine in Antivirus.

Not hugely clear and even still, everything points to the Deco being the source of the problem (else it would have the internal IP of the thing which needed quarantining or the external host of whomever is attacking. 

I suspect this is either a bug of the mislabling of the device,  or indeed the Deco itself has attempted to connect to something which is susecptable to the FREAK vuln :-/  either is far from ideal.  

Come on TPLink/Kevin.  lets be a bit more clear as to what the issue is here.

I have the same issue. Some checking showed me that the quarantined device is one of my Deco M9+ devices (MAC address matches). It happened about 5 times within the space of an hour, haven't seen it before or since.

The quarantine itself doesn't seem to impact anything though. Devices connected to the Deco device still have access and the app doesn't report any other issues.

Haven't added any screenshots as the ones above show EXACTLY what I see on mine. Same device name (different MAC obviously).