NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Orbi anywhere access architecture
Is there any documentation available on how the Orbi anywhere access app works? If I had some basic understanding of this I could probably solve my own problem with anywhere access. For example, Netge...
Ferrellt wrote:
Is there any documentation available on how the Orbi anywhere access app works?
Not that I have found. I have a suspicion that iCloud Private Relay is more relevant to the situation than randomized MAC addresses. The network will not pass MAC information. If the app is somehow storing the MAC address, then one would certainly hope that the developers store the actual hardware MAC. That iCloud Private Relay business with 'hiding' IPs and rewriting DNS queries may mess with Netgear's cloud in Amazon Web Services.
I am 99% certain that the actual connection is encrypted (https) and thus really difficult to examine. I can capture the packets, but have not yet found a way to see what is actually in them. (Having no Apple devices, whatever I find might not be relevant to the problem anyway.)
These features seem to one of the major differences between the Android world and the Apple world. Although the Android version of the Orbi app has had several "ups and downs", this particular problem appears to be an "Apple issue".
I have an android phone that I no longer use. I'm going see if works when I back home on Friday. It does not work on my iPhone 14 Pro Max or my 2022 iPad Pro.
I've found the anywhere access by Orbi works fine on an iPhone and iPad using Private Wi-Fi Address. I had an issue starting earlier in the year where setting the Orbi app to "Connect Locally" failed, even on my local Wi-Fi and only Anywhere Access worked, regardless of having private networking set not. This issue stayed throughout various iOS and Orbi app updates and only resolved itself when I nuked the RBR50 to supposedly resolve the Armor issue with Orbi, that incidentally is still present.
My Netgear account is not registered using iCloud hide my email - I wouldn't risk using this for important device or paid for registrations and subscriptions like this until it's been thoroughly debunked.
Keen to hear what insights you discover from your Orbi app debunking and API sniffing, and if Anywhere Access is vulnerable - assuming you'd make use of Netgear's vulnerability disclosure or bug bounty process 🙂 you can Google netgear's kudos rewards program or bug bounty offerings, not on par of Apple's but could pay for a pizza or two.
Of course there's this KB article from Netgear NETGEAR Mobile Applications and Apple Devices FAQ - NETGEAR Communities
Seems it would be easy enough (for now) to have the Orbi app check to see if these settigs are in a non-preferred state and warn the user the Anywhere Access feature probably won't work.
