Slashdot Mirror
Someone Is Taking Over Insecure Cameras and Spying on Device Owners (bleepingcomputer.com)
As security webcams, security cameras, and pet and baby monitors become part of our lives, their underlying technology is increasingly receiving scrutiny from researchers. Many of these devices are woefully insecure, and an attacker could -- and in some cases, has -- take over these devices to perform internet scans, among other things. BleepingComputer's Catalin Cimpanu dives into the subject: In the last nine months, two security firms have published research on the matter. Both pieces of research detail how the camera vendor lets customers use a mobile app to control their device from remote locations and view its video stream. The mobile app requires the user to enter a device ID, and a password found on the device's box or the device itself. Under the hood, the mobile app connects to the vendor's backend cloud server, and this server establishes connections to each of the user's device in turn, based on the device ID and the last IP address the device has reported from.
This indicates that it's a rare or relatively small occurrence, when in reality this is happening by thousands of people at any one moment. Stop buying terrible insecure public-facing IP cameras!
Please use the right term. I know the other can mean it but..ugh
We now can have hackers tapping all those cameras in schools!
30 years ago I was sysadmin for a network of maybe 20 Sun workstations. We got some new machines, naturally the boss got the first one. Found out about the mic and told the boss this might be a problem. He asked "why? It can be useful". I asked him to give me a minute, then call someone into his office and small talk for a minute. I went to my cube, logged into his machine, recorded him for a minute or so, then mailed him the audio file.
Spent the next couple hours opening up these brand new workstations and clipping a wire.
Why yes, I do have tape over my laptop camera. Why do you ask?
I just do it ... uum ... for your /security/.
That usually makes you swallow ALL the shit. So we're good, right?
"Never go into anyone else's house ever again."
... in the previous story: Should facial recognition cameras be in schools?
Check your premises.
It is a step in the right direction for once that the cameras have passwords that aren't just admin/admin or guest/guest.
No h265. All those Chinese cameras actually offer better capabilities than Foscam.
Good lord but these vendors must be lazy and incompetent idiots.
These are products driven by marketing, but with terrible engineering.
If you can access it from the internet, chances are someone else can. And, from the sounds of it, the company who made them could themselves spy on any of these cameras because they have all of the information needed to login.
No thanks, you can keep your crappy internet connected stuff.
Proper security is to drop traffic by default, white list what you need. You never truly know what your devices will try to do. As an example fitting to this article, I installed security cameras outside my home and linked them to a linux based PVR for the interface/recording. I noticed that my firewall was dropping tons of data from the IPs assigned to the cameras. A quick dump of the traffic uncovered all cameras trying to connect out to a pair of IPs hosted on amazonaws. I never asked or gave consent for this to happen. The same thing would go with any other network device really, I don't want it to have access to the Internet unless I explicitly give it access.
master@EdgeRouter:~$ sudo tcpdump -i eth0 host 192.168.1.248
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
22:13:46.947684 IP 192.168.1.248.58611 > 192.168.1.1.domain: 895+ A? www.nwsvr1.com. (32)
22:13:46.948215 IP 192.168.1.1.domain > 192.168.1.248.58611: 895 1/0/0 A 54.247.103.91 (48)
22:13:48.191871 IP 192.168.1.248.14620 > ec2-54-245-98-57.us-west-2.compute.amazonaws.com.32100: UDP, length 4
22:13:48.192026 IP 192.168.1.248.14620 > 123.56.159.92.32100: UDP, length 4
22:13:48.192104 IP 192.168.1.248.14620 > ec2-54-217-201-148.eu-west-1.compute.amazonaws.com.32100: UDP, length 4
Do you want your devices to serve you, or do you want your devices to serve the device maker or some other random person due to insecurity? It might seem extreme to some but as far as I'm concerned the only sane thing to do is treat *every* device as hostile until you know otherwise, drop all packets with a hardware firewall by default, and only approve the traffic you want to go out.
You mean putting an always on, always connected streaming camera in your home is a privacy and security issue?
I just can't believe that.
is your boss a retard
Spotted the teenager.
And yours is in your head.
The other one.
It little behooves the best of us to comment on the rest of us.
This title feels to me like the time I heard that "The Nigerian Prince scam has been shut down". The? The? The? Does anyone actually believe that any of these things are due to one bad actor?
So does Scarlett Johansson have a baby monitor?
Asking for a friend.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Someone? Some- one ? Singular?
You sure?
The cloud server cannot connect to the camera. The camera has to be permanently connected to the server because it is usually behind a home router. Unless it is a very old ip cam which only has a http based mjpeg stream.
but i seen this sort of thing happening so i bought a second router just for my four cams i use to monitor four different directions outside my home, none of them are connected to the internet because this second router does not have internet access it is a LAN only setup, not only does it keep the cameras off the internet those four cameras streaming live video are a bandwith hog so my internet is not being bogged down with straming video on the LAN side
Politics is Treachery, Religion is Brainwashing