If you have a router from the manufacturer TP-Link from the Archer range or a Wi-Fi Mesh system from the Deco family, it is very possible that TP-Link is sharing all the web browsing traffic you are doing with Avira, the cybersecurity company which is responsible for providing security protection when browsing the Internet thanks to TP-Link HomeCare Pro. TP-Link HomeCare Pro is software integrated into routers and Wi-Fi Mesh systems that is responsible for monitoring our connection to prevent possible attacks, however, even if you deactivate it, it seems that it continues to send all the data to Avira for treatment and improvement of the product.
What is TP-Link HomeCare?
Today’s home routers and WiFi mesh systems come with a lot of extra software to protect clients connecting to them. For example, the manufacturer ASUS with its AiProtection and AiProtection Pro uses TrendMicro technology to protect us against threats, incorporating intrusion prevention systems and is even capable of detecting if a client is infected with malware and makes malicious communications. The manufacturer NETGEAR also incorporates software of this style called NETGEAR Armor, and together with the collaboration of the BitDefender cybersecurity company, it is capable of providing its clients with complete protection when they connect to the WiFi at home.
In the case of TP-Link, we have TP-Link HomeCare, which also uses TrendMicro services to properly protect its customers, whether they are wired or WiFi customers. However, some high-end routers and Wi-Fi Mesh systems incorporate TP-Link HomeCare Pro whose services are provided by the popular firm Avira. It is in the latter case that TP-Link is accused of spying on customers, even though the HomeCare Pro service itself is completely disabled.
Avira’s standard features are aimed at providing protection to users against malicious content on the Internet, it also protects against network intrusions, and it is even capable of detecting infected devices on the network and quarantining them, just like other manufacturers such as ASUS or NETGEAR with their protection technologies for connected clients. This security suite also incorporates basic parental control features, such as content filtering and time control.
Why is TP-Link accused of spying on users?
The problem is that there is no way to disable the TP-Link HomeCare feature on Wi-Fi Mesh routers and systems, even though it is apparently disabled through the GUI, in reality it is not, and it keeps sending all data to Avira for further processing. According to some users who have been able to investigate this behavior, TP-Link sends a large amount of data to Avira, around 80,000 requests in just 24 hours. May of last year in XDA-Developers did an in-depth analysis of the firmware from TP-Link and the manufacturer informed them that they were working on a firmware update to allow the Avira service to be completely disabled.
Therefore, TP-Link knew that the HomeCare service was not effectively deactivated even though it did appear as deactivated through the graphical user interface. However, it seems that the manufacturer has not followed through on what he said, at least for now. This type of data that TP-Link sends to Avira is done to improve products and detect possible security threats, so all the manufacturer’s customers benefit from this “collective” traffic, however, it is very possible that TP-Link is in breach of the General Data Protection Regulation by sending user data to a third party without the user’s consent. When we activate AiProtection in ASUS we must always accept the terms of the agreement, indicating that you agree to this information being shared with TrendMicro, however, TP-Link is not doing this because it is supposed to be disabled.
About sending 80,000 requests per day, TP-Link told a Reddit user that the data is only sent to verify if the owner has activated HomeCare or not, which sounds like an excuse because they are sending a huge amount of information, from order of one request per second. Many Reddit users They have intervened indicating that they are also affected, and it is not possible to block the exit of these packets because they continually retry and generate high CPU usage spikes and cause problems with the general use of the router. Other users signed up for the free version of HomeCare to see if this behavior changed, but it’s exactly the same. On the positive side, Avira is a German company and is bound by the GDPR, so it might be forced to change the way its service works.
Therefore, if you have a router or a Wi-Fi Mesh system with TP-Link HomeCare where Avira is used, know that right now they are sending a large amount of information even if it appears as disabled.
