Slashdot Mirror

← Back to Stories (view on slashdot.org)

Owning a Wireless Camera, Its User and Its Network

Posted by Zonk on from the is-that-owning-or-pwning dept.

twistedmoney99 writes "InformIT has posted a two part article by Seth Fogie that describes how a wireless IP camera can be owned and abused. The first part describes how the camera's feed can be sniffed, replaced, or even DoSed off the air by a PDA. The second part then takes a look at the web application interface of the camera (an Axis207W) and exposes numerous vulnerabilities that lead to exposed passwords, a software based DoS, global XSS — and the kicker — a CRSF attack through which an attacker can remotely penetrate the network it is installed on."

15 of 59 comments (clear)

  1. Spying by Manos_Of_Fate · · Score: 3, Funny

    I wonder how many people are going to see this and immediately think about that hot girl that lives upstairs?

    --
    Isn't enough that I ruined a pony, making a gift for you?
  2. not too surprizing by Anonymous Coward · · Score: 3, Interesting

    Some IP cameras don't even need to be DoS'd, leave 'em out in the sun for 2 hours and they overheat... in fact, try to pull a stream from them and half the time they overheat. And we're talking about several hundreds of dollars worth of equipment rendered worthless by a bit of sunlight.

    1. Re:not too surprizing by PlusFiveTroll · · Score: 2, Interesting

      Here in the sunbelt I mount all of our outside wireless equipment in containers with solar fans. One benefit of an outside camera being wireless is network isolation from lighting strikes. I've seen far too many installations where people don't install one these http://www.hyperlinktech.com/web/hgln_cat5-2.php on their externally mounted wired equipment.

  3. "Owned"? by Poromenos1 · · Score: 2

    Are we using "owned" to mean "taken control of" in official context now, or is it just me?

    --
    Send email from the afterlife! Write your e-will at Dead Man's Switch.
    1. Re:"Owned"? by Yath · · Score: 3, Insightful

      No, it's still slang that doesn't belong in a Slashdot headline. Zonk should show more professionalism.

      --
      I always mod up spelling trolls.
    2. Re:"Owned"? by joe+155 · · Score: 3, Insightful

      this is one time when "pwning" would actually have been more useful, I read this and thought that it was advice on how to own one - literally things like how to purchase it and why you might want to; maybe a short review.

      Hacking a camera should have a title like "hacking a wireless camera..." (or, dare I say it, even the stupid "cracking"). Or, as I say, if they must use some form of "down with the kids" newspeak then for god's sake get it right and use pwn.

      --
      *''I can't believe it's not a hyperlink.''
  4. Wireless networking reminds me of JavaScript. by Anonymous Coward · · Score: 3, Insightful

    Wireless communication reminds me a lot of JavaScript: it's just plain insecure.

    With JavaScript, we have to worry about cross-site scripting, easily-thieved JavaScript code, and so many other issues.

    It's much the same with wireless networking: we have to be concerned about intercepted transmissions.

    So like with JavaScript, a lot of half-assed measures are put in place to try and deal with the inherently insecure nature of the medium. Most of these measures actually fail outright, or at least don't make the situation any better.

    With computers still becoming faster at a rapid pace, the wireless encryption policies used today will be easily crackable by a typical PC within two or three years.

  5. Unsecured wireless networks are insecure by DrPepper · · Score: 2, Insightful

    Headline News! If you don't secure your wireless network, people can see the traffic on it and spoof responses! I'll concede the camera has a few bugs that should be fixed. But this article doesn't really raise any issues that the average Slashdot reader wouldn't know about.

    The article is obviously aimed at a less experienced audience - in which case it really should provide some tips on securing your network, rather than trying to scare people about wireless network technologies.

    1. Re:Unsecured wireless networks are insecure by Wog · · Score: 2, Insightful

      The DOS concerns are absolutely valid, but the rest of the article is absolute garbage.

      Congratulations to the author for revealing to us that equipment operating on an unencrypted network is vulnerable to interception or takeover.

    2. Re:Unsecured wireless networks are insecure by value_added · · Score: 3, Insightful

      The article is obviously aimed at a less experienced audience - in which case it really should provide some tips on securing your network, rather than trying to scare people about wireless network technologies.

      Human nature being what it is, my vote would be to do both, irrespective of the audience.

  6. I can't say by piojo · · Score: 3, Funny

    I can't say I've ever owned a wireless camera or its user.

    --
    A cat can't teach a dog to bark.
  7. Ewww. You sick puppy. by Colin+Smith · · Score: 5, Funny

    On Slashdot, that "hot girl that lives upstairs" is probably going to be their mother... Hell, the best interpretation is that it's their sister.

    --
    Deleted
  8. CRSF by ceroklis · · Score: 2, Funny

    Aah, the dreaded Canadian Rope Skipping Federation attack.

  9. Doing what? by glwtta · · Score: 3, Insightful

    You know, it's a little silly to use the word "own" to mean "exploit a vulnerability" when you are speaking in complete sentences, not substituting vaguely similar looking numbers for letters, and generally trying to sound like a grown-up.

    --
    sic transit gloria mundi
  10. AXIS 207W by kaszeta · · Score: 2, Interesting
    I've used these cameras for quite a few projects (including one for the Department of Homeland Security), and have found the same thing mentioned in this article: the security on them is pretty poor.

    Before deploying these, we ended up disabling the wireless support, and coupling each camera with a Gumstix computer that was serving as both an image buffer and a nicely firewalled configuration that provided much more secure wireless communications.