Slashdot Mirror
Wi-Fi Enabled Digital Cameras Easily Exploitable
An anonymous reader writes with some news that might make you think twice before getting a network-enabled camera. From the article: "Users' desire to share things online has influenced many markets, including the digital camera one. Newer cameras increasingly sport built-in Wi-Fi capabilities or allow users to add SD cards to achieve them in order to be able to upload and share photos and videos as soon as they take them. But, as proven by Daniel Mende and Pascal Turbing, security researchers with ERNW, these capabilities also have security flaws that can be easily exploited for turning these cameras into spying devices. The researchers chose to compromise Canon's EOS-1D X DSLR camera and exploit each of the four ways it can communicate with a network. Not only have they been able to hijack the information sent from the camera, but have also managed to gain complete control of it."
Now it should be simple to make a smartphone app to control the camera. Before, you had to get the API from the manufacturer, sign an NDA, often pay money and then pour through the poorly documented mess.
Progress!
Faster! Faster! Faster would be better!
Hijacking thousands of vacation pictures may prove fatal to the pirates who steal them, contracting terminal boredom. Meanwhile, spies and celebrities should avoid using cameras with remote access vulnerabilities
The makers of the camera's want to produce the cheapest camera for the highest amount of profit possible. Spending money on securing the add features that consumers want (ie. wifi) cuts into the bottom line.
Will it stop consumers from buying the models? My guess is no.
What will the camera makers do? Make a new model, same as the old model, but with added security features. Of course, you will pay 50% more for the new "model".
Be seeing you...
Seriously, this is one of them. I love the idea of sharing and all, but we can wait to see your vacation or ...other... pics more than 15 minutes after you take it. A camera does not need to be directly connected to the internet, and all it does is open up potential security flaws. Find a good way to remotely exploit this and next thing you know, you can just take a vacation vicariously, through someone's (unsuspecting) lens. With the way tablets, smartphones etc are going, they can be great and (more) secure gateways to posting things, plus it gives you the chance to *filter* your photos...
This trend of making all things that exist wireless can have pretty bad consequences if companies aren't held accountable for what they produce. I'm sorry, it's not hard. It just takes code correctness and some discipline to not take a route only cause it's easy. I'm not naive; I understand being first out of the gate matters, but making that a priority at the cost of some basic security is unacceptable.
If the programmers aren't delivering on time or creating insecure code, then part of the problem may be management. As Scott Adams wrote today, Management exists to minimize the problems created by its own hiring mistakes. It's some kind of endmic disease that technical people are expected to push through a product quickly first, securely second.
If computers were people, I'd be a misanthrope.
Interesting, but the article itself mentions a camera body that's meant for professionals who are handed contracts to deliver photos within a time frame following events. (most MAJOR sporting events the photos need to be uploaded from the camera back to a central repo within 4 hours of the event, so they can go to print for the following morning. )
Saving a few minutes here and there is KEY to getting ahead in that industry.
On the contrary. When recording the police, it's best to upload live, so when they steal your camera, they don't get the footage.
“He’s not deformed, he’s just drunk!”
We can achieve cameras by adding SD cards? What?
We can achieve adding Wi-Fi capabilities to cameras by adding an SD card, yes.
Eye-fi. And yes, mine works quite well.
The cost for web cams and 100' USB cables is like 20$. So give a home 5 security cameras for $100. Hook em up on their computer and have code that records a buffered state so far back. Or if you're concerned about disk space, attach motion sensors to the recording states. Write some software that allows them to check out their house on their smart phone. Installation shouldn't take more than a a few hours.
So if you wanted to start your own security system, you'd be back 100$ for 5 cameras/cables. You'd need to write some code, or have someone write it for you, but this is only a one time cost. And you can charge people 45$/month or a one time fee of 500-700$, and that is way cheaper that what is on the market, and what is on the market doesn't let you check your security cameras from your smart phone.
Home security looks like a cash cow at first glance, what am I missing besides lawyer stuff?
God spoke to me
Eye-fi.
It only talks to networks you have told it about. Ad-hoc to a laptop, or to a wifi router. Via WPA. It does not talk directly to 'the internet', unless you tell it to. It can upload directly to flickr/facebook/etc....if you tell it to. I don't.
I do a lot of macro photography at home , and not having to swap the card between camera and PC is a godsend.
Is it exploitable? Don't know. Maybe.
Now...if I were going to attend an 'event' where my camera might get confiscated, I might have a nearby compatriot with a netbook in his backpack, and the camera continuously talking to it. Not that I'd put myself in that position, though.
Is that the marginal cost of production, the amortized cost of production (i.e. sunk costs spread out over the entire production run), or the amortized costs of production, marketing/sales, support (warranties aren't free, folks), etc.?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Home security looks like a cash cow at first glance, what am I missing besides lawyer stuff?
The plethora of cheap, standalone, multicam systems by Lorex, Zmodo, etc that already do this.
You're kind of assuming the photographer is right next to the cameras - professional wireless whatsits (e.g. Nikon and Canon) are intended for full remote control of multiple cameras. So at a sports event, a photographer might have one down behind the goal with a wide-angle lens, another pointing at the other goal, etc. etc. etc. - all uploading to the photo agency for up-to-the-moment imagery. Newspapers needed things soon, the internet needs it now.
Still decidedly embarrassing if they are so easily compromised, of course.
Tedious Bloggy Stuff - hooray?
Not unexpected, but its kinda hard to take candid photos from a hijacked camera when the lens cap is on. And those WIFI systems are not generally left on anyhow.
I don't understand why they used a 1Dx though, which would require an external WIFI adapter to even have a WIFI capability. I would be more interested in penetration testing something like the Canon 6D which has the WIFI built-in. I fully expect there to be holes, Canon's WIFI software has always been quite primitive and even the new stuff is still quite primitive.
But if we make enough noise and Canon will fix it in a software update.
Currently I only use the 6D's built-in WIFI to be able to review pictures in-camera from an android tablet... quite a useful feature. I'm not particularly worried about hijacking there since the Camera's WIFI transmitter has rather limited range. And most of the time the WIFI is turned off anyway since it eats the battery otherwise.
-Matt
managed to gain complete control of it
Aiming the camera under remote control via software is a pretty good trick. Ordinarily, you need to mount it on a pan-tilt device.
Removing the lens cap from software is another good trick. Powering the thing on remotely with batteries removed is amazing.
Yes, this is pedantic, but I'm guessing they don't have complete control of the camera. They may have control of the camera software.
So a devious photographer may create an automated wifi entry and corruption script and fire it up on a critical event, walking away with the only usable money shot.
Defining Statistics and Social Research