Slashdot Mirror
Website Peeps Into 73,000 Unsecured Security Cameras Via Default Passwords
colinneagle writes: After coming across a Russian website that streams video from unsecured video cameras that employ default usernames and passwords (the site claims it's doing it to raise awareness of privacy risks), a blogger used the information available to try to contact the people who were unwittingly streamed on the site. It didn't go well. The owner of a pizza restaurant, for example, cursed her out over the phone and accused her of "hacking" the cameras herself. And whoever (finally) answered the phone at a military building whose cameras were streaming on the site told her to "call the Pentagon."
The most common location of the cameras was the U.S., but many others were accessed from South Korea, China, Mexico, the UK, Italy, and France, among others. Some are from businesses, and some are from personal residences. Particularly alarming was the number of camera feeds of sleeping babies, which people often set up to protect them, but, being unaware of the risks, don't change the username or password from the default options that came with the cameras.
It's not the first time this kind of issue has come to light. In September 2013, the FTC cracked down on TRENDnet after its unsecured cameras were found to be accessible online. But the Russian site accesses cameras from several manufacturers, raising some new questions — why are strong passwords not required for these cameras? And, once this becomes mandatory, what can be done about the millions of unsecured cameras that remain live in peoples' homes?
The most common location of the cameras was the U.S., but many others were accessed from South Korea, China, Mexico, the UK, Italy, and France, among others. Some are from businesses, and some are from personal residences. Particularly alarming was the number of camera feeds of sleeping babies, which people often set up to protect them, but, being unaware of the risks, don't change the username or password from the default options that came with the cameras.
It's not the first time this kind of issue has come to light. In September 2013, the FTC cracked down on TRENDnet after its unsecured cameras were found to be accessible online. But the Russian site accesses cameras from several manufacturers, raising some new questions — why are strong passwords not required for these cameras? And, once this becomes mandatory, what can be done about the millions of unsecured cameras that remain live in peoples' homes?
Just because a door is unlocked does not mean you may walk inside, even if it is to tell the owner their door is unlocked.
Don't blame me, I voted for Baltar.
my father in law went to the at&t store with help on his wifi only ipad. he's totally confused by the need for an itunes store account password, wifi password on his home wifi and wifi passwords at other places
Film at 11...
The truth is, many people are using technology today without really understanding any of it. Even my own wife is pretty gumby with computers, if I wasn't there to do something about it, I have no doubt they would be full of malware and viruses.
To quote my own Mother, "I don't want to learn all that technical stuff, I just want to use my computer".
Yea, I have to say, I have to clean her machine off of crap every year. Every time I go over there, Internet Explorer has 5 or 6 toolbars installed because she clicks on everything.
And no, she won't let me restrict and lock down the machine, I've tried that.
Strong passwords are not mandatory because it's the responsibility of the user to read the instructions and secure the device. If they don't, they have no reason to complain. It was their choice to disregard the instructions.
A question is whether people who are that stupid should be allowed to own surveillance devices. The risk of stupid people reacting inappropriately to real situations and causing harm instead of preventing it seems rather high.
"Sure, a geek could Google Dork or use Shodan to end up with the same results, but that doesn’t mean the unsecured surveillance footage would be aggregated into one place that’s bound to be popular among voyeurs."
So by making it convenient, that's the real game changer?
What is the actual risk here to those using cameras as baby monitors?
Step 1: Someone sees a baby sleeping
Step 2: ????
Step 3: Profit?
"Help! A stranger saw my baby turn over. Call the police!!!" ?
It goes to show that, especially in the computer security world, no good deed goes unpunished. You hear about it over and over, try to tell someone something is wrong with their computer security and the instant reaction is to shoot the messenger.
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
"Take it back to the store, You're too dumb to own a computer" Are these threats now as dangerous or potentially dangerous as operating a motor vehicle?
Training and License? Why not? It couldn't be any worse than it is now. I've literally had a client complaining that he couldn't get his email using Wordpad...
How dumb and negligent do we need people to be before we do something serious about this?
Spam, drive by downloads, malware. Isn't it about time we told the users to smarten up? How much productivity and electricity is wasted because of users dumb mistakes?
I'm not anti-social, I'm anti-idiot.
Because not everything needs to be legislated, FFS. The last thing we need are more rules and laws.
I just found a video of myself typing this comment.
If you are so thoroughly convinced that these misconfigured/vulnerable cameras are a threat to their owners (not going to step into that argument) then just use the default credentials to go in and set a strong random password, or change the IP address to 127.0.0.1, or break the Wifi config (usually these cams are Wifi connected) and poof the threat is gone. Would that be illegal? Yes. Would it be less illegal than chronicling default passwords (which still constitute access protection, btw) and publicizing them? Probably not. These guys are all in and should just see it through. Meanwhile I am going to go check the firmware revs of all my internet facing cams.
If these cameras get secured, how will law enforcement hack into them, get a partial reflection of a face in a hubcap, enhance and run it through facial recognition software and have the perps drivers license picture onscreen within 40 seconds?
Is everyone on here too young to remember putting some basic search strings into Google to find open cams and printers?
what is it and why was it not in the OP? that right because OP is a fagot like the rest of slashdot and dice.
This a user problem.
As long as we continue to provide technology to average consumers, this type of issue will exist. The message that needs to be sent is "If it has connectivity to a remote destination of any kind (wired/wifi etc.) you are at risk of exposing data". Even if you secure the storage locations, many people never consider the pipe between device and storage. I love all those wifi storage devices...
Until the "user community" catches up with modern security concerns, there is very little the technology can do. Even the best secured devices have options to reduce their security.
This unlocked webcam is by far the most exciting on the Internet ;)
Cameras are a problem, but it's not just cameras anymore. Nest thermostats, for instance, have occupancy sensors and they connect to the internet to work. So your thermostat tells a server on the internet if anyone's home (potentially). Smart meters have similar problems. We recently bought a temperature sensor (AVTECH brand) for our small server closet, and it automatically connected to GoToMyDevices.com as soon as I got it on the network, and started uploading sensor data. There was nowhere in the device's built-in web interface to enable or even disable this "feature". Nothing in the documentation. I looked online and found a forum where it explained that you had to telnet to the device, and at the main menu you had to select a hidden menu item, and then type a command to turn off this feature. It's that kind of absurdity that makes the whole "internet of things" just a house of cards waiting to collapse.
"I have never let my schooling interfere with my education." - Mark Twain
why are strong passwords not required for these cameras?
Mainly because most programmers don't know/care about security. Security is hard even when you care (for example a default password isn't a security vulnerability if your userbase is sophisticated enough to change it, and even ssh has had a vulnerability), but if you don't care, it's impossible.
Sad but true.
"First they came for the slanderers and i said nothing."
Great use of the Straw Man argument!
A normal person would knock on the door.
Regrettably, there is no real link between a closed door and an IP Camera spitting out frames. By nature, a door separates and a camera shares.
I love the way the pages come with adverts for people selling CCTV cameras for the home!
the "unfortunately" part. A machine that effectively extends human intelligence and communication beyond its natural limits, among other things, can't be toaster-level stupid while maintaining its vast flexibility.
I think dumbing it down would cost functionality (as well as jobs, like mine ;)).
why are strong passwords not required for these cameras?
Maybe that is what they need to do. Make the default password something gibberish like df73j5hdfg/5rtdf88GG so that users will change it when they set it up. Even if they change it to FluffyBunny22 at least it won't be the default.
I refuse to sign
I think this is the important one, most devices come with a 1 page guide in at least 5 languages that say "CHANGE THE PASSWORD BY DOING THIS ONE THING" and people don't even bother to read the 1 page guide. It's not just an issue of understanding, it's apathy and laziness.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
This is because of people who are too lazy or too intimidated by technology to understand it. You buy the camera, many times you open a port on a router, but you fail to change the password. I am not going to blame the manufacturer for that.
However, manufacturers could make the default a lot more secure by using methods to randomize the default passwords of the cameras. I've setup routers where the default password is printed on a plate on the bottom (next to the mac address and default IP). This gives you a degree of randomness and makes brute force near impossible without physical access to the device. This way, the user still has the freedom to change to a blank password, 'password' as password etc. if they choose to unprotect themselves. But the default becomes reasonably secure.
This is mostly a problem with users, but sometimes the manufacturer needs to adjust the process to help the intimidated, ignorant, or lazy user along.
the site is worthless pages dont even load..
timeouts on every thing... bad gateways..
the cams are only thumbnails not live live streams
would of been nice if they had included link to the ip address's
I haven't seen any comments mentioning how these cameras have a public IP address, which is at least as bad as having a default password. Given that most (consumer) routers default to using NAT with an RFC 1918 address (generally in 192.168.x.x) this misconfiguration would presumably have taken effort, i.e. it was deliberate if probably not maliciously so. Even if the cameras have a private IP, they could still be remotely accessed via port forwarding, which also implies such installer/user incompetence.
If there's a need for a remote user to access these cameras' feeds, that's what a VPN is for.
You don't even have to know the passwords if it's Y-Cam :p Just ask the camera to disclose them!
https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-007.txt
http://www.y-cam.com/y-cam-security-fix/
People are stupid, People when confronted with technology are triple stupid.
Do not look at laser with remaining good eye.
Great use of the Straw Man argument!
A normal person would knock on the door.
Regrettably, there is no real link between a closed door and an IP Camera spitting out frames. By nature, a door separates and a camera shares.
An IP camera doesn't spit out frames, though. It waits for a user to authenticate (however trivially) and then it spits out frames. The expectation of privacy is still there.
I cant wait until i get my new tv subscription!
So... some random person somewhere... can see my sleeping baby. But they have no idea where that baby is other than the last hop out of my ISP so they might know I'm somewhere in Atlanta... or whatever. Maybe if they stared at the feed 24/7 for years I might drop my water bill in the crib before I picked the baby up so they could get my address or something... But ok, so they can see a video feed of my sleeping baby? So what?
Short of a camera pointed directly at my bed, or my toilet, I don't see how this would be that god awful. First, I'd never point a camera at my bed. Any camera. Second, someone seeing pictures of me walking around my pizza restaurant? With no address and no idea who I am or where my restaurant is? So what?!?! There are plenty of horribly invasive privacy problems out there. This isn't one of them.
... after an hour of poking around. Nothing to see.
It little behooves the best of us to comment on the rest of us.
How are these cameras visible on the internet even with the default username / password? When setting up my fascam I had for use port forwarding to get from the external ip address to the camera, along with binding the Mac address to a static internal IP address, I also had to set up DDNS for the domain name and when my ISP change my external IP address. Surely the router firewall would block all this traffic by default?
Every laptop I've owned, if it had a web cam, also had a piece of black electrical tape over the camera.
While a lot will say it is the consumer's fault for not securing (and I'm not saying they're wrong), it's just as much the manufacturers fault for not putting a bigger emphasis on security. People are so willingly ignorant of what kind of functionality their devices have outside of what they want. When setting up ANY device that can be accessed remotely, changing the default logon should be mandatory. Would consumers whine? Probably, but with a brief statement of WHY it has to be done any reasonably thinking person would be willing to put in the effort to change these defaults to avoid this kind of breach.
One argument is to write a script to do the following:
1) change password
2) break the network configuration to take it offline
No invasion of privacy (never saw anything). Failsafe. Owner can simply reset to defaults and replay.
There are plentiful ethical people to help do it. Though it would be funny if they rented a pwnd PC inside a government agency to do it.
Does that sound any better? Maybe there is more than one "right" way to do it? Just try not to overthink it.
2005 wasn't that long ago, was it?
http://it.slashdot.org/story/0...
In Soviet Russia...michael would be rotting in Siberia!
There are a lot of things you can do with some printers that enable web servers without any authentication at all. Print things, ask to do a scan (people forget things on scanners), view and modify contact lists for FAX and scan to email tools, etc. Definitely potential for "denial of ink and paper" attacks on a printer.
IMO manufacturers should only allow local network access to these devices unless you explicitly set or modify the default login.
One of the security camera pictures on the page of the article looks exactly like Hunter's room in Paranormal Activity 2.
and post the URL of the site.
" Particularly alarming was the number of camera feeds of sleeping babies, which people often set up to protect them, but, being unaware of the risks, don't change the username or password from the default options that came with the cameras."
What risk, exactly? I can't imagine anything more boring than a video of a sleeping baby.
"Particularly alarming was the number of camera feeds of sleeping babies, which people often set up to protect them, but, being unaware of the risks, don't change the username or password from the default options that came with the cameras." so, where exactly is the risk of someone seeing my sleeping baby - unless i'm a pedophile and doing dirty things to it live on camera?
I would find it much more interesting if they peeped into people's houses, and let me select the house address by location on a map like google maps.
You know. If I could 'select' something on a map. say 'hey, check out this map' - and kablammo I have access to someone's house.
or better yet. I could target a person and just hit 'follow mode'
And yet here I am, receiving frames from it without authenticating, which is of course, what the original article was about. People looking at that site aren't logging into the cameras, or even connecting to them - they're receiving images from a server in Russia. The people running that site are accessing those routers, yes, but the hypothetical person telling the owner that the door is unlocked/open never went inside.
The analogy breaks down fast and hard there - it's more of "if you see that someone's door is open, and someone is taking pictures of what's inside and passing them around without the owner knowing, should you tell the owner?"
The person telling the owner isn't breaking any laws at all, or even contacting the camera owned by whoever they're contacting - they're informing them that someone else has done so, and is posting the pictures on the internet.
And the "risk" of someone viewing the image of an unknown sleeping baby, at some unknown location, is...? This is the same insanity that keeps parents from posting their kids pictures on line. Do they really think kidnappers are trolling facebook in order to find victims? Does that make any sense?
People should not have a great expectation of privacy when they hook surveillance equipment to the public electronic publishing platform. People should however, be able to do things they would like to do without first checking with you. People may want to take a jog in the park, for instance, without first checking if you would like to mug them if they do. Do I need to provide more examples?
I've encountered a camera that actively uses UPnP (Gateway profile) to ask the router to forward port 80 to itself and also connects to a Chinese dynamic DNS service as a bonus by default. While you can disable the dynamic DNS setting, you have no say in the UPnP thing.
These cameras are so badly thought out that they crash when a different UPnP device on your network responds.
But hey, they're cheap. You find them on Alibaba (the guys with the big IPO).
Question for religious people: where do unrepentant masochists go when they die?
Are these cameras accessible through a NAT firewall or are they communicating with an outside server somewhere that exposes them?