Slashdot Mirror

← Back to Stories (view on slashdot.org)

IoT Devices Are Secretly Phoning Home (thenewstack.io)

Posted by BeauHD on from the fear-the-internet dept.

An anonymous reader writes: A popular internet-enabled security camera "secretly and constantly connects into a vast peer-to-peer network run by the Chinese manufacturer of the hardware," according to security blogger Brian Krebs. While the device is not necessarily sharing video from your camera, it is punching through firewalls to connect with other devices. Even if the user discovers it, it's still extremely hard to turn off. Krebs notes that the same behavior has been detected in DVRs and smart plugs -- they're secretly connecting to the same IP address in China, apparently without any mention of this in the product's packaging. One security researcher told Krebs the behavior is an "insanely bad idea," and that it opens an attack vector into home networks.

42 of 196 comments (clear)

  1. it's not a secret by turkeydance · · Score: 3, Insightful

    c'mon, man. they're all doing it. damn you ET.

    1. Re:it's not a secret by arglebargle_xiv · · Score: 3, Funny

      You're only saying that because you've never seen "ET Porn Home" in all its VHS glory.

  2. Not new by penguinoid · · Score: 3, Informative

    Anyone familiar with IoT knows that most of them phone home to report.

    --
    Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
    1. Re:Not new by Dutch+Gun · · Score: 4, Interesting

      Agreed. This doesn't surprise me one bit. Maybe the name gives it away... you know... that these Things communicate over the Internet?

      I'm going to take a potentially contrary position, though, and argue that if a device is internet enabled, it absolutely should be phoning home on a regular basis, and for very good reasons. The recent glibc library vulnerability only helps to validate my opinion, in fact, which is that it's absolutely inevitable that serious vulnerabilities will be found in ANY internet-facing device, and so these devices MUST be able to automatically update themselves. What's more, manufacturers should be responsible for providing security updates for a reasonable product lifetime - otherwise, they're no longer fit to stay connected, and essentially must be discarded in order to keep your network secure.

      I'm sure there are those who would argue against such a policy, but these are *consumer* devices, and we damn well know by now that a typical consumer will never update the firmware on their own device. We now accept that browsers must self-update in order to remain secure, and we're just now grappling with the notion that OSes must do it too. Frankly, anything that's internet-facing needs to be treated the same way. The manufacturer must take responsibility for this. Otherwise, we're going to have billions of tiny infection vectors that will last as long as the devices do, which could be decades. Look at how much of a problem this is for old desktops, servers, and routers sitting on the internet, spewing botnet-controlled traffic because they've never been updated. Granted, this has to be done in a secure manner, so that MITM attacks are not possible, but it's absolutely possible to do it right.

      Of course, we all know what's really going to happen, which is that these companies with absolutely no clue how to do internet security are going to get many thousands of people infected through these crappy little internet-enabled gizmos, and the people who get infected with the Zeus banking trojan or crypto-ransomware will be outraged, and articles will be written, and eventually things *may* improve slightly. I'm sure as hell not going to be one of the early-adoption suckers.

      --
      Irony: Agile development has too much intertia to be abandoned now.
    2. Re: Not new by nehumanuscrede · · Score: 4, Insightful

      Easy for the typical /. reader perhaps, not so much for your everyday consumer. Go ask random folks what a Vlan is and you'll understand pretty quickly.

      The typical user isn't even aware of the possibility of this sort of thing.

    3. Re:Not new by Anonymous Coward · · Score: 4, Interesting

      Then they don't work. Some have to have a 24/7 Internet connection, and if it gets cut, the devices turn off. I'm just waiting for everything out there, be it fridges, TVs, and anything else to either follow suit, or have a 3G antenna, so it has its own private pipe to tattle user info on.

    4. Re:Not new by mlts · · Score: 4, Interesting

      Perhaps an even better thing would be to go to a hub and spoke topology? That way, devices can communicate with the center hub (or hubs, if redundancy is desired), and if there is a fix, the hub asks for it on behalf of one device, caches it, so other devices can use that same fix without issue. It is basically what happens when devices communicate through an access point, but the devices would use a low power, low range protocol as opposed to Wi-Fi, or even opening themselves for attack by touching the Internet directly. Plus, with a hub and spoke, an IDS/IPS mechanism can be places so if one device starts behaving suspiciously that is out of the design parameters (nmapping everything it can find), its connection gets dropped, and life goes on. As an added bonus, an attacker would either have to be physically nearer to intercept the low power protocol, or would have to attack the hardened hub (which could run on fairly modest hardware and use virtual machines to separate the firewall instance from the instance that deals with the devices.)

    5. Re:Not new by arglebargle_xiv · · Score: 2

      Doesn't work, they either need to connect out to report data or you need to connect in to read data from them. You then end up with this ghastly mishmash of per-device firewall config rules to handle the requirements of each unit.

    6. Re:Not new by wisnoskij · · Score: 2

      That's assuming that the device does has an offline mode, and will work without that connection to a Chinese server.

      --
      Troll is not a replacement for I disagree.
    7. Re: Not new by Anonymous Coward · · Score: 2, Funny

      Just configure it to phone home so you can update its configuration periodically to cover new IoT devices that phone home....

    8. Re:Not new by AmiMoJo · · Score: 2

      I like your idea but I think it misses the fundamental problem with IoT devices: Lifespan.

      Older wifi chipsets don't support WPA2 and can't be upgraded. The only option is to replace them, which fortunately is an option with most laptops/computers. Old phones, games consoles, TVs though... You are screwed. The only options are to disable the functionality or use WEP which can be cracked in minutes.

      Unless people are going to be happy replacing their IoT doorbell, light switches, smoke alarms, thermostat, cooker, fridge, coffee machine, bathroom scales, toilet, bed, light bulbs, robot vacuum cleaner, car, garage door, CCTV cameras and more every few years we are going to have a problem.

      Consumers are short sighted. They won't pay more for a product that uses parts with upgradable firmware and long term support from the manufacturer. Often it's multiple manufacturers that need to keep supporting the device, because if the company making the coffee machine buys a wifi chipset that doesn't get security fixes in the firmware/driver from its manufacturer there isn't much they can do.

      Not to mention the difficulty of reporting vulnerabilities to customers.

      It's really not an easy one to solve. Your hub idea is a lot better than what we have now, but will only work if the hub is willing to be ruthless about cutting vulnerable devices off, including itself. But then who do you trust to maintain the list of vulnerable devices?

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    9. Re:Not new by MitchDev · · Score: 2

      Don't connect them in the first place.

      Better yet, DON'T EVEN BUY these things...

    10. Re:Not new by Gr8Apes · · Score: 2

      if it "requires an internet connection" you can be pretty sure it's not what you want, unless you know enough to hack it.

      --
      The cesspool just got a check and balance.
  3. If don't have the source you don't own the device. by Anonymous Coward · · Score: 4, Insightful

    It's really simple. It's separate from source code quality. If you have proprietary software running free on your device then you don't own the device, whoever set up the software owns it. Windows phones home because it's working for Microsoft. Your IOT devices phone home because they are working for a Chinese company. Your Android phone phones home because it's working for Samsung and your mobile operator. This is not different and it's not complicated.

  4. IoT devices by ickleberry · · Score: 3, Insightful

    These used to be just IP Cameras, they have been around for years, but now they are suddenly being called IoT devices. I wish this I(di)oT fad would die off and people would just call a spade a spade (or even an IP Spade)

    1. Re:IoT devices by ArylAkamov · · Score: 2

      But...but the hype!

      I need more Internet of Things on the Cloud* so I can control my scary DRONE!

    2. Re:IoT devices by KGIII · · Score: 2

      The turn of phrase existed long before the word spade was an ethnic slur.

      --
      "So long and thanks for all the fish."
  5. "insanely bad idea" by Bruce66423 · · Score: 3, Interesting

    Depends on your perspective, doesn't it? If you are aiming to ensure that a cyber attack by the People's Liberation Army on the Imperialists will do a lot of damage, it seems like a GREAT idea...

  6. If you think by Ol+Olsoc · · Score: 3, Interesting

    That Internet of Things phoning home is some sort of secret, you've been living under a rock the last few years. Phoning home is what they are designed to do. It's the core principle of the IoT.

    --
    The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
    1. Re:If you think by jones_supa · · Score: 3, Informative

      That's not true at all. IoT simply means an embedded device connected to Internet.

  7. DDNS by 110010001000 · · Score: 5, Informative

    This "secret network" is a "DDNS network" so you can more easily connect to your camera from the Internet. Clickbait.

  8. Total FUD by Theaetetus · · Score: 5, Informative
    Just because something says P2P doesn't mean it "connects to a vast peer-to-peer network". These particular cameras are made to work with a smartphone or tablet app: the camera connects to the company's servers to tell them its IP address; your tablet connects to the server to find out the IP address of your camera; and then your tablet and the camera establish a peer-to-peer connection, so that none of the video travels via the company's servers.

    That's it - the two peers are your camera and your mobile device, not some fast torrent network or something.

    Now, sure, this could've been documented better, but Krebs should also know better than to jump to hyperbole based on two letters and a number in a configuration screen.

  9. Updates by phorm · · Score: 2

    Phoning home isn't notable unless you know what it's doing so for. It could be to send information back, or it could just be to just for updates etc.

  10. Reasons why I don't like the Internet of Things. by Anonymous Coward · · Score: 5, Insightful

    Here's a list of reasons why I don't like the Internet of Things:

    1) Internet of Things devices could watch me while I sleep.

    2) Internet of Things devices could watch me while I pee.

    3) Internet of Things devices could watch me while I make kaka.

    4) Internet of Things devices could watch me while I pleasure myself.

    5) Internet of Things devices could watch me while I wash my body in the shower.

    6) Internet of Things devices could watch me while I relax in the tub.

    7) Internet of Things devices could watch me while I brush my teeth.

    8) Internet of Things devices could watch me while I make passionate love to my wife.

    9) Internet of Things devices could watch me while I brush my hair.

    10) Internet of Things devices could watch me while I read a book.

    11) Internet of Things devices could watch me while I read Slashdot.

    12) Internet of Things devices could watch me while I bake cake.

    13) Internet of Things devices could watch me while I put in my contact lenses.

    14) Internet of Things devices could watch me while I get ready to play golf.

    15) Internet of Things devices could watch me while I do my laundry.

    16) Internet of Things devices could watch me while I think about rugby.

    17) Internet of Things devices could watch me while I tie my shoes.

    18) Internet of Things devices could watch me while I celebrate the 4th of July.

    19) Internet of Things devices could watch me while I water my flowers.

    20) Internet of Things devices could watch me while I eat ham.

    21) Internet of Things devices could watch me while I use my stapler to staple documents.

    22) Internet of Things devices could watch me while I chew bubble gum.

    23) Internet of Things devices could watch me while I check the oil in my car.

    24) Internet of Things devices could watch me while I look for my TV remote.

    25) Internet of Things devices could watch me while I blow my nose.

    26) Internet of Things devices could watch me while I rearrange my stamp collection.

    27) Internet of Things devices could watch me while I listen to the Backstreet Boys.

    28) Internet of Things devices could watch me while I do my calisthenics.

    29) Internet of Things devices could watch me while I search for a paper clip.

    30) Internet of Things devices could send information about me to advertisers.

    31) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I sleep.

    32) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pee.

    33) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make kaka.

    34) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pleasure myself.

    35) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I wash my body in the shower.

    36) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I relax in the tub.

    37) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my teeth.

    38) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make passionate love to my wife.

    39) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my hair.

    40) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read a book.

    41) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read Slashdot.

    42) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I bake cake.

    43) Internet of Things devices could let advertisers use the data unsuspectingly coll

  11. Insanely bad idea? by gstoddart · · Score: 4, Insightful

    the behavior is an "insanely bad idea," and that it opens an attack vector into home networks

    I'm sorry, but based on what we've been seeing, so far the entire Internet of Things is an insanely bad idea ... shoddy security by incompetent idiots who want more analytics data and ad revenue, and don't give a crap about your security.

    Fuck that, I want my toaster connected to the internet why again?

    That this is happening should no longer come as a surprise to anybody who has paid even the smallest amount of attention to how much of a mess the IoT is.

    --
    Lost at C:>. Found at C.
    1. Re:Insanely bad idea? by bigdavex · · Score: 3, Funny

      Fuck that, I want my toaster connected to the internet why again?

      How else do you think it will keep its antivirus software up-to-date?

      --
      -Dave
    2. Re:Insanely bad idea? by thegarbz · · Score: 2, Insightful

      So what exactly is the point of IoT in consumer space?

      For most products it's the same as it is in the commercial space. The only difference is that assets under monitor and control are physical things you own rather than a mix of customer connected monitoring devices ala "sensor network".

      Ultimately "sensor network" is it. Data aggregation of your life and monitoring of your things is the goal of IoT. (Though admittedly many corporations believe that "them monitoring you" is what it's all about and that is just fucking with an otherwise good concept).
      Examples from my house:
      - Trends from the temperature in my apartment show I had the heater turned on a good hour before I got home from work. But in the week the heater was off I realised I spent that hour leeching heat from the neighbours anyway and while it normally took an hour to get the apartment up to temperature on a week day at 4pm I could do it in 15min.
      - Trends from my water meter shows a leaking pipe under ground costing me money I would likely have not noticed before something actually got damaged.
      - Trends from my power meter showed my fridge was set to the wrong temperature after a power outage. I could see that due to the duty cycle changing.
      - Video monitoring of my old house showed that it wasn't the cat stealing food at night, it was a possum.

      If none of this sounds like a new concept, it isn't. IoT is nothing more than the sensor networks discussed 20 years ago... around about the same time as we were discussion the damn internet connected toaster.

      In the commercial space it is far more important but ultimately the same. Microsoft + ThyssenKrupp have a great presentation they like to show of how they used some IoT hardware and Azure's management platform to pro-actively predict failures of elevators. All the additional data they've gathered means they not only predict failures, but can accurately schedule maintenance for hours where the elevator are shown to be used the least.

      IoT is a shitty name for something otherwise quite good and useful.
      IoT is a great concept that unfortunately some companies are shitting on by collecting and selling your data to 3rd parties.

    3. Re:Insanely bad idea? by Endymion · · Score: 2

      Ultimately "sensor network" is it. Data aggregation of your life and monitoring of your things is the goal of IoT.

      That's exactly why we call it an "insanely bad idea". When you aggregate that much data about people, the risks are huge while the benefits are small and in many cases, still theoretical. Unfortunately, humans are bad at evaluating risk, which may be why you react strongly to the claim that the IoT is and will be full of "shoddy security by incompetent idiots who want more analytics data and ad revenue, and don't give a crap about your security".

      It is patently obvious the data that "sensor network" produces will be exfiltrated quickly and easily. We have seen a many cases in the last year where data was stolen from business and government agencies. Only a total fool would claim that they have perfect security and will be able protect all that personal data forever. Even worse, current products show how the data will be exfiltrated by the manufacturer, as a "feature". By centralizing data, they make a better target and a single point of failure that only needs to be attacked once. Of course, attacking a network of cheap mass-produced IoT devices shouldn't be hard - it's a monoculture that will all fall to the same type of attack.

      This security problem should be obvious, and anybody involved in making these 1oT "sensor networks" is either wilfully negligent or has another agenda. A responsible person would notice that "ease of use" never overrides "safety".

      Trends ...

      Yet again, you do not need internet access to make devices that logs trends in sensor data. The only reason that is so important is that you either don't understand the various hardware possibilities you could be using instead, or you are hiding that you are a thief trying to "monetize" the "analytics" produced by these devices.

      --
      Ce n'est pas une signature automatique.
    4. Re:Insanely bad idea? by Endymion · · Score: 2

      stored local to the sensor network

      That still creates an exfiltration risk. Pretending that risk doesn't exist is negligence. Don't pretend any device has perfect security; most embedded hardware runs ancient kernels that have know exploits.

      aggregating sensor data is not a bad idea as long as the data is ... anonymized

      Yes, that's still a terrible idea. It is very difficult to "anonymize" personal data, as it can usual be re-correlated back to whomever generated the data. Even simple traffic analysis - without knowing the content of the network packets - can betray important information to the world.

      Even combining a bunch of sensor data so that you can reconstruct someone's whole schedule is useless without knowing who that person is

      I don't believe you are really this stupid. Of course you can connect it back to the person. Listen to when the packets were sent from their house and correlate that with the timestamps on the server. That's only one way to de-anonymize records; some creative thinking will reveal more.

      "Anonymized data" is magic pixie dust that internet businesses use to disguise how they monetizing user data.

      On Taxis and Rainbows

      “Anonymized” data really isn’t

      --
      Ce n'est pas une signature automatique.
  12. ESP 8266-12E to invade the world! by MindPrison · · Score: 2

    I'm a user of the now Arduino compatible ESP 8266-12E ever so popular IoT 2$ device. It's a WiFi on a chip + a nice 80 MHz microcontroller (32 bit) with 4MBit flash ram to boot, it's insanely cheap for what you actually get...

    If you just use them as they are (With the AT+ command set, hayes compatible) - they already phone home because they can Upgrade the firmware - albeit you can initiate that yourself).

    But unless you've got a WiFi hotspot with a firewall where you can Wireshark monitor your network traffic - you will have NO idea whether this thing is phoning home with a few extra details about your network, it's bad enough that it actually phones "home" with your IP address, I'm not sure if it does that - but it's def. worth an extra look. Anyone know the details about this? Have anyone tried looking into the ESP8266 series to see if they even phone home after they've been bootloaded with the Arduino Bootloader?

    We've got to be a little careful about this - I agree completely - It's so tempting to just insert those wonderful all-in-one IoT devices here and there...and forget about the advanced details...because lets face it - they've made it wonderfully practical for us to use with very little skill or knowledge required to get these things talking to each other (while - perhaps...hiding a darker side).

    --
    What this world is coming to - is for you and me to decide.
    1. Re:ESP 8266-12E to invade the world! by silas_moeckel · · Score: 2

      IoT Subnet, it needs not be able to reach the internet ever.

      --
      No sir I dont like it.
  13. Philips Hue does this too by james_marsh · · Score: 2

    Any IOT device that has access from a smartphone does something like this. If you look at the traffic from a Philips Hue hub you'll see SSDP broadcasts, NTP synchronisation and phoning home with details of it's local IP address and checking for updated firmware.

    This article seems to be yet more anti-Chinese nonsense. There was a very similar one recently by an American "journalist" that didn't understand that NTP is a distributed protocol either and implied these devices were somehow infiltrating US homes and forming a secret network. It possibly inspired this article, though unfortunately I can't find the original just now to link to.

    The answer is to put IOT devices in a DMZ/restricted guest network which more and more routers are supporting out of the box.

  14. IoT devops = security nightmare by JesseEnjaian · · Score: 2

    At the current state of affairs, almost all IoT devices are programmed using development environments provided by the semiconductor (e.g., http://www.nxp.com/products/so...). And most of these are a composition of open-source tools (i.e., GCC, Eclipse, etc.) with some proprietary interfacing software (e.g., something like JTAG to program the chip with). The vendor-specific IDEs (e.g., customized Eclipse) often come with networking libraries (i.e., something BSD sockets-esque for Internet) they made and /maybe/ some simple threading library (i.e., no operating system). The programs compile to real-time code and this code is then "flashed" to the chip/flash using something like JTAG. That's it. Security nightmare. The "obfuscation" of JTAG and compiling to ARM (versus x86) has let A LOT of companies do some crazy programming on IoT devices. My IoT camera has a physical kill-switch I use when I get home (i.e., I unplug it).

  15. No need to phone home. by fyngyrz · · Score: 3, Interesting

    And it is completely, absolutely, 100% unnecessary.

    o Plug in not-yet configured device.

    o Shortly thereafter, it accepts DHCP configuration. Now it has an IP.

    o Then it vomits out a tiny UDP (broadcast) packet every 60 seconds or so that says "I'm a WackyWidget and my IP is Yad.daY.yad.daY"

    o You start app, it listens for the UDP packet, when it hears it, it begins comm via TCP at the IP identified in the UDP broadcast. UDP broadcasts then cease until, or unless, the TCP (and possibly the DHCP) connection is dropped, in which case, begin again at whatever step is needed.

    That's it. That's ALL of it. You need nothing more for an IP camera, a smart power plug, a smart lightbulb, an aquarium controller, the garage door opener, etc., etc., ad infinitum.

    If you THEN want to expose WackyWidget to the WAN, you could enable that separately.

    If you were out of your damned mind.

    If you haven't yet figured out that "the cloud" is nothing but a way to take/get things from you -- money, data, ownership of media, etc. -- then you really need to look at all this harder.

    --
    I've fallen off your lawn, and I can't get up.
    1. Re: No need to phone home. by guruevi · · Score: 3, Insightful

      You're describing Bonjour/mDNS and yes it works within LANs but not if you want to connect from outside your network. People want convenience, punching a hole in your firewall is a "lot of work" and sometimes impossible depending on your configuration.

      And yes, anyone with the information could possibly have your camera talking to them but most people don't care or refuse to understand the issue. Whether it's China or the NSA, as long as people have "bread and circuses" they'll be fine.

      --
      Custom electronics and digital signage for your business: www.evcircuits.com
    2. Re: No need to phone home. by techabuse · · Score: 4, Interesting

      I own a few Chinese IP cameras i bought for experimenting, and no two of them work with the same app/P2P cloud bullshit/whatever. They do, however, all expose Telnet and SSH to the world. There's no way I'd let them anywhere near the WAN because they're all running Linux on a decently snappy ARM SOC and phoning home. Can you say beach head?

    3. Re:No need to phone home. by Theaetetus · · Score: 3, Interesting

      And it is completely, absolutely, 100% unnecessary.

      o Plug in not-yet configured device.

      o Shortly thereafter, it accepts DHCP configuration. Now it has an IP.

      o Then it vomits out a tiny UDP (broadcast) packet every 60 seconds or so that says "I'm a WackyWidget and my IP is Yad.daY.yad.daY"

      o You start app, it listens for the UDP packet, when it hears it, it begins comm via TCP at the IP identified in the UDP broadcast. UDP broadcasts then cease until, or unless, the TCP (and possibly the DHCP) connection is dropped, in which case, begin again at whatever step is needed.

      That's it. That's ALL of it. You need nothing more for an IP camera, a smart power plug, a smart lightbulb, an aquarium controller, the garage door opener, etc., etc., ad infinitum.

      If you THEN want to expose WackyWidget to the WAN, you could enable that separately.

      If you were out of your damned mind.

      If you haven't yet figured out that "the cloud" is nothing but a way to take/get things from you -- money, data, ownership of media, etc. -- then you really need to look at all this harder.

      That's a really long and condescending way to say "I don't understand how subnets work". While it may work fine on your household network, this camera is designed to be accessed over the public internet. Most people don't need to check security cameras that are in the same room as them.

    4. Re:No need to phone home. by tlhIngan · · Score: 3, Informative

      And it is completely, absolutely, 100% unnecessary.

      o Plug in not-yet configured device.

      o Shortly thereafter, it accepts DHCP configuration. Now it has an IP.

      o Then it vomits out a tiny UDP (broadcast) packet every 60 seconds or so that says "I'm a WackyWidget and my IP is Yad.daY.yad.daY"

      o You start app, it listens for the UDP packet, when it hears it, it begins comm via TCP at the IP identified in the UDP broadcast. UDP broadcasts then cease until, or unless, the TCP (and possibly the DHCP) connection is dropped, in which case, begin again at whatever step is needed.

      That's it. That's ALL of it. You need nothing more for an IP camera, a smart power plug, a smart lightbulb, an aquarium controller, the garage door opener, etc., etc., ad infinitum.

      If you THEN want to expose WackyWidget to the WAN, you could enable that separately.

      If you were out of your damned mind.

      If you haven't yet figured out that "the cloud" is nothing but a way to take/get things from you -- money, data, ownership of media, etc. -- then you really need to look at all this harder.

      which makes the device useless to the people who buy it. People buy security cameras with IP connectivity so they can view their camera from a remote location, for alerts and the ability to view and control devices remotely.

      Like you have a camera on your front door. It sends you an alert someone is there, to which you access your camera to see who it is. Generally, this is useful if the UPS or FedEx guy comes while you're at work, at which point you can ask them to drop the package off in the garage (which you open and close remotely). No package left on the door stop, and the garage door is closed by you so it's safe and waiting for you.

      And that's the reason why people are going for the "cloud" stuff. Sure there's probably a few lazy asses using it inside their home (or their home is a huge mansion that takes 10 minutes to get from one side to the other), but the key selling point of this "IoT" devices is remote access.

      Remotely turn on the lights. Remotely turn on the heat or AC so you come home to a warm or cool house. View cameras and recordings while you're out.

      What you propose is secure, but gives consumers none of that. They're buying it for the remote accessibility and giving them only local access until they do a bunch of fancy stuff is basically counter to what consumers are buying the things for.

    5. Re: No need to phone home. by edtice1559 · · Score: 2

      Indeed if it were trivial, there wouldn't be entire DDNS businesses! Even with DDNS you have some work to do. AFAIK the default configuration on most wireless APs is to use NAT. So even if I know unrouetable IP address of the camera it wouldn't help. I'd venture that the manufacturers get way more calls saying its too hard to get configured than requests for the information necessary to secure these things.

  16. It's Foscam you /.pussys by EvilSS · · Score: 3, Informative

    Really Dice, scared shitless to mention the manufacturer?

    Here is the Krebs link if you want the actual details and don't want to dig it out of the articles linked in the summary: http://krebsonsecurity.com/201...

    --
    I browse on +1 so AC's need not respond, I won't see it.
  17. Have some fun by PPH · · Score: 4, Funny

    Set up a honeypot consisting of a Chinese DVR and a bunch of security cams pointing at pictures of Minuteman ICBMs sitting in their silos. Sit back and watch your IP address get hacked.

    --
    Have gnu, will travel.
  18. Dumb quote by ArchieBunker · · Score: 2

    Spy features could just as easily be hidden in hardware. Unless you want to verify the die and masks used, you still have no clue what this device can do.

    --
    Only the State obtains its revenue by coercion. - Murray Rothbard