Slashdot Mirror
Thieves Hacking Security Cameras?
The FBI is investigating fifteen store robberies in eleven states, committed via phone and internet. The perpetrators hack the store's security system so they can observe their victims. They then make customers take their clothes off and get the store to wire money. From the article, "A telephone caller making a bomb threat to a Hutchinson, Kan., grocery store kept more than 100 people hostage, demanding they disrobe and that the store wire money to his bank account. ... officials were investigating whether the caller was out of state and may have hacked into the store's security system. "If they can access the Internet, they can get to anything," Hutchinson Police Chief Dick Heitschmidt said. "Anyone in the whole world could have access, if that's what really happened.""
Has there ever been a more stupid quote than:
"If they can access the Internet, they can get to anything," Hutchinson Police Chief Dick Heitschmidt said. "Anyone in the whole world could have access, if that's what really happened."
I'm sure Jack Thompson will blame this on BioShock.
Can't they follow the money trail from there?
Strange.
Why don't these stores copyright their video feed and then let loose the RIAA on the perps. That'll stop 'em!
threadeds blog
He did not record the security camera footage and upload it to You Tube? Dumb idiot. This is what dumbing down of America has done to the respectable profession of robbery.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Why are the security cameras on anything other than a closed circuit? It makes no sense for their cameras to be connected to the internet.
My humor is probably your flamebait
My wife came in a found me sitting on the floor in my underwear. I had only skimmed the slashdot article and thought that it was a disrobe-or-get-bombed threat against me. It seems that the Slashdot is only _reporting_ a bomb threat and isn't actually going to blow us up.
Also, would CowboyNeal please send back my $3,000?
It's a valid question. Companies put security cameras on the internet to enable remote recording and control. It lets the central office or outsourced security firm handle all the digital video and dispatch police/fire services from a cost-efficient central location. If you owned 100 convenience stores in 10 states, where would you put the security office and how would you link them?
Rather than build a dedicated hardwired telecom network, companies are using the internet to connect everything together (security systems, financial systems, medical records, industrial control, etc.) As we can see from this example, they think they've created their own virtual network (of some degree of privacy), but in practice, the system is extremely vulnerable. I'd bet that more than a few internet-connected security cameras run with factory-default passwords.
Two wrongs don't make a right, but three lefts do.
"officials were investigating whether the caller was out of state and may have hacked into the store's security system"
...
"If they can access the Internet, they can get to anything"
"Anyone in the whole world could have access, if that's what really happened"
What kind of idiot would connect the security system to the Internet so that 'they' could get to anything. Didn't they put it on a private VPN or use a password even?
"The FBI was looking into whether the calls to the banks and stores were being placed from overseas"
I thought DCSNet was designed to provide instant access to such information. Provides absolutly no evidence of any such hacking. Sounds to me like a low level extortion plot apart from the mention of the (scary) Internet and hackers (even more scary). Since when do sophisticated thieves use Western Union and wire themselves $3,000 with a $150 service charge. Who paid the charge I wonder.
We get bomb threats here all the time, so don't take any notice
davecb5620@gmail.com
There are many store monitor camera systems that are installed with poor defaults and wide open access. Several makers' web interfaces have easy formulaic URLs to select different store views, and these commonly can be searched with plain old web search engines. This was a fun thing to do a few years back, with whole sites dedicated to lists of web cams that were likely not intended for global viewership. Without any real evidence that the web cameras were "hacked" I think it's a big stretch to assume any skill was involved here.
[
I'm sure that in some states, 100 naked people in a store legally counts as an orgy.
People are stupid. Google for: inurl:"ViewerFrame?Mode="
And have fun...
In my WarDriving travels, I've come apon many SSID-hidden wireless networks around stores. Sometimes they aren't even encrypted. My recent curiosity with these nets reveals a few wifi networked cameras in some locations, and sometimes if you log into these networks, you can find a nat. From there it's simply accessing a site that gives you a IP.
But why bother when you already have access to there cameras via a unsecured access point?
Anonymous for obvious reasons.
I usually have Security Expert I & II equipped, so I have significantly less alarm and overload tiles. Every camera I see I take a few pictures of because then I can see the 'weaknesses' of the camera.
Of course when I have positioned myself directly under the camera I can't see me anymore and if it hangs too high I can just jump up and finish my hack in mid air.
Unfortunatly, the guards are a bitch. For them it always seems to be "bring your daugther to work day".
Other then that, hacking cameras is a breeze, like I said, with just a simple minigame they are asking for it.
Mostly it's incompetent IT and store managers that have installed panasonic IP cameras and left them not only wide open but on the internet because the store managers are retarted and want to spend their life watching the employees.
ALL of this stuff goes right back to raging incompetence. It's incredible how little these stores pay for IT, I had to teach the IT specialists for Walmart how to do basic networking when we were helping a client set up their network for their restaurant inside a new walmart store. The Walmart head of networking, or so he claimed to be, told me it was impossible to tunnel IP traffic safely through a network, no. he did not understand what a VPN was and then told me that VPN is not allowed as it's insecure and unencrypted!.... and then I had to hold their hands and show them how easy is really is to patch a phone line to a cat 5 jack in the phone room. Their network engineer told me flat out that DSL will not work over cat-5e cable. "The phone company uses Cat6 to your house!" is what he said. I was amazed at how undereducated these IT and networking people were.
With that kind of incompetence due to very low pay, it does not surprise me that security cameras are put on the net directly.
Do not look at laser with remaining good eye.
Have you tried
"Hi, I am ze plumber. I haf com to examine ze pipework, ver can I place my tooool ? It is ver huge and I can't keep it in here much longer"
That's no wonder. What happens here is the combination of some unhealthy factors.
1. The cheapest guy gets the job. Now, the cheapest is never the best, and rarely even good enough to actually do it good.
2. As soon as it "works", stop working on it. As soon as the picture somehow appears on the screen of the manager, he's satisfied. He does not care about whether someone else can see it. If he is, his wannabe-admin will lie to him because he'd have to fix it in his (unpaid) overtime and the manager can't test it anyway.
3. The admin does not care. Even if he did (and why the hell should he?), he cannot. He does not know what dangers lurk in the shadows. He goes by try and error to patch the thing together somehow, i.e. he runs into an error, copy/pastes the error message into Google and goes from there.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Probably testing the waters (i.e. make sure they're intimidated into doing whatever the thieves say) before giving them bank account information to do the wire transfers.
We've secretly replaced Slashdot with new Folgers Crystals - let's see if it notices.
1. Open store
2. Receive bomb threat
3. Ignore demands, find bomb
4. Sell bomb on black market
5. Profit!!!
6. Goto Step2
link?
Yeah, wire me the money - I'll get it someday when the police aren't looking...
This was a hoax, a prank. Somebody was just having fun jerking people around.
And see how easy it was. Anybody remember the Chinese Fire Drill in the book "Illuminatus?" Act authoritative - or threatening in this case - and spew out some orders, and everybody falls right into line like lemmings.
The first response to the bomb threat should have been, "Fine - set it off. We'll settle up later, asshole."
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!