4 ms·

While I agree this is bad, I think it's a misuse of the term IoT. Webcams have been around since the 90s.

masklinn 11y ago
Online webcams are part of the IoS, and if webcams remain insecure after having been in use for 20 years, there's little hope for the rest of IoS to be any better.
- Houshalter 11y ago
  What does this have to do with ios?
oxide 11y ago
I think it's a perfect example of lackluster security oversight when it comes to the IoT. people want a webcam they can plug in and use, most people don't consider the features it offers nor do they secure it beyond what is enabled by default. webcams are a thing, like it or not, and they use the internet, like it or not. if you think a rascally teenager turning your webcam lights on in the middle of the night is bad, wait until he changes your e-fridge settings and all your food spoils.
paulojreis 11y ago
Maybe it is. But, on the other hand, it's a nice example because it makes you wonder: if companies who've been making webcams are failing so much in security, what should we expect from companies making products which aren't related to IT at all? How are the oven-making companies faring, security-wise, in this IoT thing?
- Symbiote 11y ago
  TLDR: the "authenticate" HTTP call on my heating system is optional, so you can change the temperature without the PIN. For one example, I recently moved into a newly refurbished apartment. It has underfloor heating, with a central control box and remote sensors/controllers in each room. [1] It cost something like €1500-€2500, plus installation, plus the pipes etc. The central control box has an ethernet port and MicroSD slot, which takes a ZIP downloaded from the manufacturer's site. I set this up, and was disappointed to see just how terrible the provided software is. There's no Android app, and the iPhone app costs a further €15 [2]. It has only the most basic functionality: see and change the target temperature in a room, and change which program runs (day/night/off/preset1/2/3). The most-needed thing — to change the preset timings without 100 presses of a 5-button LCD interface — isn't possible. The web interface is the iPhone app implemented as a Java applet making HTTP calls to the server. It's too big to fit on my laptop's screen. There's an 'authenticate' call, but it's optional — the app requires using it, and the call gives the correct pass/fail response, but there's no session handling so there's no need to make this call before reading or changing temperatures. The Java applet at least means it's not easy to do a Google search for the web interface, but I just found this site [3]. There are a few results, but from a long time ago. [1] http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarme-varianter--Roth-Komplet-Traadloes-Gulvvarmestyring-inkl-Pumpe-4-Kredse-611638.html http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarm... [2] https://itunes.apple.com/dk/app/roth-touchline/id498448526?mt=8 https://itunes.apple.com/dk/app/roth-touchline/id498448526?m... [3] http://www.base64online.com/hc.php http://www.base64online.com/hc.php
jdietrich 11y ago
The sort of webcams we're describing are very recent. For $50, you can buy a CCTV camera that includes a network interface and a web server. That has only been possible for a few years thanks to cheap smartphone-derived SoCs. The IoT is turning consumers into inadvertent sysadmins. For the first time in the history of computing, inexpensive consumer products are functioning as servers. These servers are often dreadfully insecure, e.g. internet-accessible root access with a default password. The market for a $50 IP camera is inherently different to the market for an $800 IP camera.
- deleted 11y ago
  [deleted]
- woodman 11y ago
  > That has only been possible for a few years... I had a Linksys WVC11B IP camera like 12 years ago, I don't remember how expensive it was but it was definitely cheap and targeted consumers for home use.

Online webcams are part of the IoS, and if webcams remain insecure after having been in use for 20 years, there's little hope for the rest of IoS to be any better.

Houshalter 11y ago
What does this have to do with ios?

oxide 11y ago

I think it's a perfect example of lackluster security oversight when it comes to the IoT. people want a webcam they can plug in and use, most people don't consider the features it offers nor do they secure it beyond what is enabled by default. webcams are a thing, like it or not, and they use the internet, like it or not. if you think a rascally teenager turning your webcam lights on in the middle of the night is bad, wait until he changes your e-fridge settings and all your food spoils.

paulojreis 11y ago

Maybe it is. But, on the other hand, it's a nice example because it makes you wonder: if companies who've been making webcams are failing so much in security, what should we expect from companies making products which aren't related to IT at all? How are the oven-making companies faring, security-wise, in this IoT thing?

Symbiote 11y ago
TLDR: the "authenticate" HTTP call on my heating system is optional, so you can change the temperature without the PIN. For one example, I recently moved into a newly refurbished apartment. It has underfloor heating, with a central control box and remote sensors/controllers in each room. [1] It cost something like €1500-€2500, plus installation, plus the pipes etc. The central control box has an ethernet port and MicroSD slot, which takes a ZIP downloaded from the manufacturer's site. I set this up, and was disappointed to see just how terrible the provided software is. There's no Android app, and the iPhone app costs a further €15 [2]. It has only the most basic functionality: see and change the target temperature in a room, and change which program runs (day/night/off/preset1/2/3). The most-needed thing — to change the preset timings without 100 presses of a 5-button LCD interface — isn't possible. The web interface is the iPhone app implemented as a Java applet making HTTP calls to the server. It's too big to fit on my laptop's screen. There's an 'authenticate' call, but it's optional — the app requires using it, and the call gives the correct pass/fail response, but there's no session handling so there's no need to make this call before reading or changing temperatures. The Java applet at least means it's not easy to do a Google search for the web interface, but I just found this site [3]. There are a few results, but from a long time ago. [1] http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarme-varianter--Roth-Komplet-Traadloes-Gulvvarmestyring-inkl-Pumpe-4-Kredse-611638.html http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarm... [2] https://itunes.apple.com/dk/app/roth-touchline/id498448526?mt=8 https://itunes.apple.com/dk/app/roth-touchline/id498448526?m... [3] http://www.base64online.com/hc.php http://www.base64online.com/hc.php

jdietrich 11y ago

The sort of webcams we're describing are very recent. For $50, you can buy a CCTV camera that includes a network interface and a web server. That has only been possible for a few years thanks to cheap smartphone-derived SoCs. The IoT is turning consumers into inadvertent sysadmins. For the first time in the history of computing, inexpensive consumer products are functioning as servers. These servers are often dreadfully insecure, e.g. internet-accessible root access with a default password. The market for a $50 IP camera is inherently different to the market for an $800 IP camera.

deleted 11y ago
[deleted]
woodman 11y ago
> That has only been possible for a few years... I had a Linksys WVC11B IP camera like 12 years ago, I don't remember how expensive it was but it was definitely cheap and targeted consumers for home use.