Slashdot Mirror
Surveillance Cameras Sold On Amazon Found Infected With Malware (zdnet.com)
An anonymous reader shares a report on ZDNet: Security researcher Mike Olsen has warned that some products sold through the Amazon marketplace are harboring a dark secret -- malware. Olsen said in a blog post that while scouring Amazon for a decent set of outdoor surveillance cameras for a friend, he came across a deal for 6 PoE cameras and recording equipment. The seller, Urban Security Group, had generally good reviews and was offering a particular Sony setup on sale. After purchasing the kit, Olsen started setting up the surveillance system, logging into the administrator panel to configure it. [...] Upon investigation, Olsen found that the device was talking to a server with hostname Brenz.pl, which is linked to malware distribution. If the device's firmware links to this domain, malware can be downloaded and installed, potentially leading to unlawful surveillance and data theft.Perhaps the company which made the device didn't realize its source code was compromised. While the aforementioned incident should serve as a reminder to people on why they need to be wary of the product they are purchasing, this isolated occurrence doesn't prove in any way that "plenty" of cameras on Amazon are also infected, as the article and the original blog post are subtly trying to imply.
Here's a list of reasons why I don't like the Internet of Things:
1) Internet of Things devices could watch me while I sleep.
2) Internet of Things devices could watch me while I pee.
3) Internet of Things devices could watch me while I make kaka.
4) Internet of Things devices could watch me while I pleasure myself.
5) Internet of Things devices could watch me while I wash my body in the shower.
6) Internet of Things devices could watch me while I relax in the tub.
7) Internet of Things devices could watch me while I brush my teeth.
8) Internet of Things devices could watch me while I make passionate love to my wife.
9) Internet of Things devices could watch me while I brush my hair.
10) Internet of Things devices could watch me while I read a book.
11) Internet of Things devices could watch me while I read Slashdot.
12) Internet of Things devices could watch me while I bake cake.
13) Internet of Things devices could watch me while I put in my contact lenses.
14) Internet of Things devices could watch me while I get ready to play golf.
15) Internet of Things devices could watch me while I do my laundry.
16) Internet of Things devices could watch me while I think about rugby.
17) Internet of Things devices could watch me while I tie my shoes.
18) Internet of Things devices could watch me while I celebrate the 4th of July.
19) Internet of Things devices could watch me while I water my flowers.
20) Internet of Things devices could watch me while I eat ham.
21) Internet of Things devices could watch me while I use my stapler to staple documents.
22) Internet of Things devices could watch me while I chew bubble gum.
23) Internet of Things devices could watch me while I check the oil in my car.
24) Internet of Things devices could watch me while I look for my TV remote.
25) Internet of Things devices could watch me while I blow my nose.
26) Internet of Things devices could watch me while I rearrange my stamp collection.
27) Internet of Things devices could watch me while I listen to the Backstreet Boys.
28) Internet of Things devices could watch me while I do my calisthenics.
29) Internet of Things devices could watch me while I search for a paper clip.
30) Internet of Things devices could send information about me to advertisers.
31) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I sleep.
32) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pee.
33) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make kaka.
34) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pleasure myself.
35) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I wash my body in the shower.
36) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I relax in the tub.
37) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my teeth.
38) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make passionate love to my wife.
39) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my hair.
40) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read a book.
41) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read Slashdot.
42) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I bake cake.
43) Internet of Things devices could let advertisers use the data unsuspectingly coll
made in china.
And there they can slip someone say $1000 to plant code on the system (that may be running on a unlicensed windows xp os) That is used to load the firmware on the systems.
No, what do you mean "nuke them from orbit"? WTF?
I'm saying that the only way to be sure these days is by using open-source software on single board computers, such as the Raspberry Pi. But even then, you need to trust all the ICs on the damn thing but at least there's only a few of them to test.
1) Internet of Things devices could do things I don't want them to.
FTFY.
Someone has to watch the watchers. No?
An editorial comment that actually LESSENS the alarmism in the submission, rather than adding to it?
This is... nearly unheard of on slashdot! What is happening???
How dare maniacs bring common sense and rational thinking into TFS! I want my old click bait slashdot back /s
While the aforementioned incident should serve as a reminder to people on why they need to be wary of the product they are purchasing, this isolated occurrence doesn't prove in any way that "plenty" of cameras on Amazon are also infected, as the article and the original blog post are subtly trying to imply.
The truth must be that he's a shill for the Urban Security Group. Yeah that's it, you insensitive clod. Net craft confirms it. So take your hot grits and a beowulf cluster of Natalie Portmans and let Soviet Russia shove you.
I am Slashdot. Are you Slashdot as well?
I buy as much stuff off Amazon as anyone but I have learned one thing. Pay careful attention to who is actually selling the product. Amazon is full of brand-names you've never heard of (and might never again), ditto vendors. If it isn't a recognized name brand and sold by Amazon itself I don't buy it. More often lately, I am trying to be a lot less lazy and actually going to the various manufacturer or big-name vendor's web sites directly. With security camera systems there seems to be a lot of product on offer through 3rd parties rather than manufacturer direct.
Just a quick google on the brenz.pl domain and I see that its been tied to malware distribution since 2009! What the hell does it take to get that domain yanked off the Internet? Is Poland a haven for malware creators?
As in ALL.
nothing to see here - move along
I've always wanted to know: what if the app appers aren't modern? What if they are, say, 60 years old?
This.
Slashdot has become SJW Weekly
Capcha: begging
Krebs and others have been talking about these kinds of Chinese surveillance products for awhile: https://news.slashdot.org/stor...
Here's another: http://news.softpedia.com/news...
The catch with *this* story is that it is about a product available through Amazon. That's it, in a nutshell.
I deny that I have not avoided attaining the opposite of that which I do not want.
But what about the Internet of Thongs?
I guess that already exists - I bet all you need to do is search for it.
anyone can set up shop on amazon marketplace. no surprise that products sold by a third party merchant are tainted.
WTF does this have to do with Sony? That isn't a "Sony setup"
This is news for nerds because first, it took a nerd to find it (most people don't have the ability to check where a device is attempting to open ports to) and because it's more news of a pre-hacked piece of equipment that most people would trust to be secure out-of-the-box from arguably the largest retailer in the world. If this was fulfilled by Amazon then it's more evidence that Amazon needs to do more quality control when they agree to stock something. They need at least SQCs and if it's widespread enough, SQEs to do this kind of random-lot testing.
Do not look into laser with remaining eye.
An editor actually trying to defuse a potentially mediatic, attention grabbing, clickbaiting article and being reasonable? Just checked, it's really Slashdot... Mind, blown! (Irony aside, great work!)
You must be kidding. Amazon sells millions of products. They aren't going to test them out for you. Plus: woooossshh
half the crap on amazon isn't sold by amazon but by no name fly by night operations or direct from china. be wary of buying anything on the internet but then this is how name brands got started almost 100 years ago and stupid millenials are figuring it all out again
I love how Mike Olsen is termed as a "security researcher", rather than some guy that does PR for Symantec. Anybody can become a self-proclaimed "security researcher" these days - all you need is a blog and a press release, apparently.
Funny enough, I was just looking around Amazon Canada for a cheap IP camera. There are lots of $40-$50 cameras and not a single one comes from a company I've ever heard of and they all seem to require some sort of account to view the stream. I just want one I can watch from my laptop with only local access.
I remembered about hearing about sketchy IoT devices, especially cameras and it's just not worth the risks. Most have no reviews or 1 or 2 reviews from someone with very poor English (hmmmm).
Even the "brand name" ones seem pretty sketchy and I don't really trust DLINK anymore than Foscam or JOOAN, whoever they are.
I could just be clever and fabricoble one from an Raspberri Pi or an Arduino or something but that's still not really worth the cost + time.
Why would you actually hook these up to a network that has Internet access? Of course you make a separate VLAN or network for your "security" devices and other monitoring, ^H^H^H^H^H IoT devices that can only talk to preapproved connections. That is what a firewall is for.
-- I have a private email server in my basement.
Rule 34 says it exists.
The real "Libtards" are the Libertarians!
Devise a generally applicable antivirus for IoT devices.
Undoubtedly any such software would be OS-specific, which would quickly lead to pressure to standardize the operating systems on these devices.
I usually filter by "Amazon Prime" which cuts out a lot of the weird third party sellers. I have noticed this does get you a certain amount of "Sold by Acme Widgets, fulfilled by Amazon".
My assumption is that if the product is some kind of actual brand name you might find somewhere besides Amazon and the fulfillment is by Amazon, the "seller" part is some kind of electronic arbitrage and the product itself is the same thing you might get if you bought it from Amazon as the seller.
It's like the "seller" bought the stuff on paper and is willing to sell it for an even smaller margin than Amazon and in reality it's all the same SKU on the same shelf in their warehouse and the next unit in line to be shipped someplace could be sold by either Amazon or the third party seller.
Is this at all accurate? Or is it possible to set yourself up as an Amazon seller, buy counterfeit crap from China and just funnel it through Amazon's logistics chain to buy that thin veneer of respectability?
I wish slashdot's servers would automatically ban any IP address that tries to post this fucking spam that shows up every goddamn time there's a story like this. Even a 24 hour ban would get the point across.
Sony: Malwares Are Okay, Because No One Knows What They Are
No excuses. It's the baseline foundation we should have for security. It's not security in and of itself, but it is a quintessential part you can't be without to use the word 'security' in describing a product.
Can someone tell me where this meme came from? I obviously missed it's inception and google is failing me...
Only crack the nuts that crack. You don't put the ones that don't crack in the sack.
I assume that all cameras from China a spying on me, does not bother me though they are on a specially setup vlan and cannot get on the internet.
It probably fell out the back end of a cow.
34) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pleasure myself.
The domain is registered to CERT's Polish subsidiary...???