Slashdot Mirror
Burglars Can Easily Make Google Nest Security Cameras Stop Recording (helpnetsecurity.com)
Orome1 quotes a report from Help Net Security: Google Nest's Dropcam, Dropcam Pro, Nest Cam Outdoor and Nest Cam Indoor security cameras can be easily disabled by an attacker that's in their Bluetooth range. The vulnerabilities are present in the latest firmware version running on the devices (v5.2.1). They were discovered by researcher Jason Doyle last fall, and their existence responsibly disclosed to Google, but have still not been patched. The first two flaws can be triggered and lead to a buffer overflow condition if the attacker sends to the camera a too-long Wi-Fi SSID parameter or a long encrypted password parameter, respectively. Triggering one of these flaws will make the devices crash and reboot. The third flaw is a bit more serious, as it allows the attacker to force the camera to temporarily disconnect from the wireless network to which it is connected by supplying it a new SSID to connect to. If that particular SSID does not exist, the camera drops its attempt to associate with it and return to the original Wi-Fi network, but the whole process can last from 60 to 90 seconds, during which the camera won't be recording. Nest has apparently already prepared a patch but hasn't pushed it out yet. (It should be rolling out "in the coming days.")
Yet another piece of surveillance technology that will happily send what you're doing to whomever asks, but will also never protect you from any actual threats.
with the same blunt instrument they used to break in your windows/doors.
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
Aside from the egregious delay in fixing these things; does anyone else get a very, very, bad feeling about the expected quality of the firmware when 'supply a string longer than a normal user would type' is a successful attack?
If you aren't sanitizing your inputs against that one; what are you sanitizing?
Sounds like a win-win for everyone.
Having said that, it is probably not the common or garden variety burglar taking advantage of this kind of bug.
Judging from footage, burglars seem to fall into two categories: the amateur criminals of opportunity who simply smash a window and make off with whatever they can get, or fail comically. And the more professional burglars who take a few very simple precautions, come in wearing hoodies and gloves, and leave in minutes. They are professional in the sense that they know how to enter a home quickly without making too much noise, spot homes where the owners are absent and the take is likely to be high, and know which valuables to grab and where they are usually "hidden". But they certainly do not employ any sophisticated methods to bypass alarms or defeat security cameras. They simply skip homes with alarms or ignore their presence depending on how long they are expecting to hang around, and make sure they cannot be recognized with the aforementioned hoodies.
And over here, most burglars don't give a rat's arse about being caught: sentences are low, there's little additional punishment for repeat offenders (the other day they caught a burglar with 33 prior convictions, think he's going to reform much?), and if the police actually do turn up the heat a bit too much for comfort, one simply relocates to the next EU country.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
Or they could just as easily cut the power to the house. Who here actually remembers to put their home alarms on a UPS?
Burglars couldn't care less about your Bluetooth vulnerabilities when they can use a mask and be quick about it. :P
Because a burglar would never use a cheap RF jammer they can get for 50 bucks. If your security relies on wireless continuing to function it's broken by design.
No sir I dont like it.
Nest is such shit anyway. Spies on you from the get-go. Everything that's wrong with tech. "Energy saving" shit that vampires so much it doesn't really save anything. Then when it breaks it'll be eWaste anyway, so if you wanna save energy you're better off just getting some LED bulbs and better insulation. If you want security cameras, there's no guarantee you won't have issues with other companies; but Nest is a stupid choice for anything and you get what you deserve.
I don't need to exploit your device to make it stop recording. I can just boot it from your network with a deauth. Then smash it.
2.4Ghz jammers are a dime a dozen, too.
So what?
The crackhead that burgled one of my tenants did it with a vice grips after leaving their window open an a Macbook visible from the window. The bars weren't attached with security bolts (one way) but rather regular bolts (two ways.) That burglar didn't even bother bring a ratchet to make removing the bolts happen quicker. Do you think he's going to be able to make security cameras stop responding with his in-depth knowledge of the BlueTooth protocol and years of experience working cyber security at a National Laboratory? I don't. The other time my tenant was burgled they left a bicycle locked to a wooden structure, which was ripped apart with a chain tied to a truck. The other other time a different (not the same) tenant was burgled they left a GPS, binoculars, and some other valuable thing visible in their car. That burglar used a cinder block.
Don't leave your valuables visible when you're not around to back them up with your 2nd amendment rights.
Seriously, this entire posting is retarded. Try and keep a shotgun handy (no aiming!) a big dog, and friends/tenants/roommates around to keep the diversity of the city outside your domicile. Nest security cameras aren't going to do anything against the nondescript minority/white guy in a hoodie that's ready to throw the dice and jack your shit with a brick.
This is why Albuquerque can't have nice things, and Breaking Bad was filmed here.
Are they talking about these (https://nest.com/camera/meet-nest-cam-outdoor/)? The exterior security cameras with very long and noticeable power cords? Screw Bluetooth hacks, just walk obliquely up to it and unplug the darned thing.
Like Netgear Arlo. :/
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Some years ago I was in a hotel, and the WiFI was very slow. I went to the front office to find out what I was doing wrong. I found out I was surfing the Internet through a security camera!
What about the neighbors who drop their dog waste in your can, after garbage pickup and before you return home from work, that you have to store that dog waste in your garage until the next week? If it rained there is water in the bottom of the can in which the plastic baggie is swimming (we have robotic-arm collection trucks, and the lid is often open after a collection). Ewww!
That's the need for that Nest device.
The flaw that keeps on giving. Don't you love it when drive-by security researchers audit your code without understanding it, and their patches insert more buffer overflows than they fix? Many eyes, zero brains, infosec bro!
OK, google. Stop recording!
Blame unicode. It needs to accept Bungobungian metarunes or the SJWs will complain that it's RAAAAASCIST.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."