Slashdot Mirror
Despite Reports of Hacking, Baby Monitors Remain Woefully Insecure
itwbennett writes: Researchers from security firm Rapid7 have found serious vulnerabilities in nine video baby monitors from various manufacturers. Among them: Hidden and hard-coded credentials providing local and remote access over services like SSH or Telnet; unencrypted video streams sent to the user's mobile phone; unencrypted Web and mobile application functions and unprotected API keys and credentials; and other vulnerabilities that could allow attackers to abuse the devices, according to a white paper released Tuesday. Rapid7 reported the issues it found to the affected manufacturers and to US-CERT back in July, but many vulnerabilities remain unpatched.
Would be nice if there were an organization like UL Underwriters for network security, call it Network Underwriters Themed, Security Assured Credentials -- NUTSAC for short.
Silliness aside, until manufacturers have to pay the price in the marketplace for their crappy wares, they won't bother to do it right.
--
Everything in the Universe sucks: It's the law!
Everything in the Universe sucks: It's the law!
Listening to/watching a publicly broadcast, unsecured video/audio stream isn't hacking.
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
It is really telling that Philips, not TrendNET, was the most responsive to the security researchers. Based on the Feb 2014 agreement that TrendNET entered into with the FTC, they should already have in place a method of responding to this type of report. In fact, the FTC announcement from last year included:
TRENDnet also is required to establish a comprehensive information security program designed to address security risks that could result in unauthorized access to or use of the company’s devices, and to protect the security, confidentiality, and integrity of information that is stored, captured, accessed, or transmitted by its devices. The company also is required to obtain third-party assessments of its security programs every two years for the next 20 years.
So this begs the question, why isn't the comprehensive information security program required by the FTC responsive to the security researchers? Also, why didn't the third-party assessment catch this?
This has less to do with security and more to do with the fact that people don't really care. A baby monitor is there so you can hear / see your baby and make sure it is still breathing and to see if you really do need to go into their room when they are crying. While most people would be creeped out by the idea of someone else looking at their baby on a monitor they don't really care that much. It's not like parents see baby monitors as something that stops you stealing the baby.
i don't see the internet flooded with bare boobie breastfeeding videos siphoned-off of these monitors.
Analogue baby monitors transmit and receives on CB frequencies or nearby. So everyone with a short wave radio or a CB rig could listen, an if the propagation is strong, signals from hundreds of kilometers away could be received by the baby monitor, and every trucker nearby could eavesdrop in your home.
Nobody cares less about this problems and buys these, because are cheap, ruggend and consumes low power.
Laws will happen. Just as soon as the first death is caused by a hack (or a hack gone wrong). However indirectly. That's what it takes for average people, and thus their representatives, to pay attention and figure out that something actually does matter. Then it will be a CRISIS! and we must do something NOW!
And that's the worst part of the problem. Because they won't fix security problem, they will make it illegal to install custom rom to any wireless device.
NSA weirdos are watching your babies. And jerking off. A lot.
What a way to enter this world. God damn china/ruskie commies just got to do evil.
If you care about people listening in to your baby monitor then you probably also:
- Have all the windows of your house blacked out.
- Are not connected to standard utilities such as electricity, water, sewers....
- Enter and leave the premises via a secret tunnel, in disguise.
are you saying someone could park outside my house and listen to me moan about my child kicking shit all over the walls? that's terrible.
sag
I bought a dirt cheap baby monitor. We used it for the first 3 months full time and maybe the next 3 months as needed.
I fully suspected someone could use the signal if they were in close enough proximity. I really didn't care because the chances of someone doing that are astronomically small.
This was not an internet enabled device. The range was barely enough to cover the house. First someone would either have to know I had a child or randomly be wardriving looking for signals. Second, if someone was looking for signals I have to expect their either some kind of pervert or want to cause harm to my baby. If they're a pervert, shame on them but they won't be seeing much because we were mostly using it for audio and most of the time the video was blocked by a physical object. If they meant to cause harm to my baby, that's where the 2nd amendment helps out. It's not like I'm leaving the baby at home and going out.
It really wasn't a big deal. Maybe I'd care more if I was in an apartment complex in the middle of the city but I am in low crime suburbia.
Just about spit my drink out.
I have a RF audio-only baby monitor. Our house is quite big, and during our twins' first ~three months, it was hard to hear them from a different room. After the fourth month (they are six months old now), we haven't bothered to connect the monitor again, as their lungs are strong enough for us to hear whatever happens.
And yes, we mainly used our monitor to quickly go check on them, to make the distress time as small as possible.
Now, continuously streaming a video feed of my babies over the Internet... What good would that be for? Maybe only for me to ensure a hypothetical nanny didn't abandon or mistreat them while I'm at work — But I'd have to be always on watch!
What kind of reaction could I as a parent have were I monitoring my kids away from home? What use would this really have for my kids' safety?
The IoT is coming, I know, and we will soon have intelligent flowerpots. The cats' litter box will tweet every time a cat goes to pee. Yay for tech!
But sometimes there's no need at all for more intelligence in our devices. I want a baby monitor to be reliable, easy to check and fix... And not dependent on issues that might break (i.e. my Internet uplink being down for some minutes). Sometimes dumber devices are more intelligent.
This is why I went with the old stand-by: audio-only baby monitor.
Yes, the security is terrible, but as long as we kept the data to baby breathing/crying/not there, I didn't really care.
If someone had the time to sit there and listen to my baby breath while within radio range, then I guess I just will let them hear it.
We also removed them as soon as we could.