4 ms·

I've got a bunch of cheap Wifi cameras and I don't worry about this kind of thing at all. All of the cameras live on a separate Wifi network that is unable to

I've got a bunch of cheap Wifi cameras and I don't worry about this kind of thing at all. All of the cameras live on a separate Wifi network that is unable to connect to the internet. I use Zoneminder to handle all of the recording, motion detection, etc. For remote access, I've got a VPN server running. Fortunately, the cameras I use are perfectly happy to work without being able to talk to the manufacturer's servers (though they do try!). In a nutshell, I get almost all of the "benefits" of the cloud service (the only missing thing is off-site storage, but a fix for that is in the works) with almost none of the drawbacks. Of course, this is NOT easy for the average consumer to set up. They expect to be able to plug the camera in and have things Just Work, which is why we've got cameras that can open ports on routers/firewalls, register themselves with cloud services, etc, with minimal effort. As for IoT in general, my future plans are to use this separate WiFi network for all IoT-like devices that don't really need to connect to the internet. The Philips Hue is a good example - it has a bunch of cloud-enabled functionality, but I don't actually need any of it.

joblessjunkie 10y ago
It sounds like you actually worry about his kind of thing a great deal, considering the amount of effort you put in.
- Mister_Snuggles 10y ago
  Believe it or not, it was a whole bunch of little things that added up to this state. When I started with the cameras I was just using the motion detection and email features that were built into the firmware. I never bothered setting up the cloud stuff because I didn't need it. Slowly I transitioned to having the cameras dump images onto a local NAS via FTP. Eventually I started using the cameras for more than watching the cats, so I needed something with better motion detection and recording capabilities. I started with 'motion', then used a fork of 'motion' that seemed to work better, then finally ended up with ZoneMinder. On the VPN side, I decided many years ago that I wanted remote access to my "stuff" - file shares, etc. This started out with the PPTP VPN built into my router, which is terrible but sort of worked. The next step was writing a script that would run SSH and set up a couple dozen tunnels, which is differently terrible but sort of worked. Eventually I got tired of maintaining that and ended up with an IPSec VPN using racoon -- split DNS and split tunneling are truly amazing. The extra Wifi network actually started as a misguided attempt to prevent other stuff (Netflix, mainly) from interfering with the cameras. I figured that putting them on a separate Wifi network would isolate them and give them dedicated bandwidth. My first attempt involved using a Raspberry Pi as an AP. It worked, but not very well at all. The second attempt used the Virtual AP functionality on my router -- it wasn't until I set this up that I understood that Virtual APs don't quite work this way. Around this time I started to see articles about cloud-enabled cameras doing bad things and decided that this setup was worth keeping. The camera and VPN stuff both went on over the last 5-10 years or so, with the Wifi changes being something I did within the last year. You're right that there was a lot of effort, but as you can see it wasn't really driven by privacy/security until the end. Most of these things were driven by trying to find better ways to scratch various itches. The next planned change is to re-address my network so that it doesn't use the 192.168.1.0/24 range that every consumer router seems to use by default. This way I will be able to use VPN when I'm visiting friends without having to tether to my cell phone. Like everything else, it's just scratching an itch.
soylentcola 10y ago
Similar setup. Two IP cameras, one wired with PoE and one WiFi. Both connect to my NAS via their own network that has no direct access to the WAN but can be accessed from the LAN or via VPN. I guess there could be some level of attack surface if someone is dedicated enough to gain access to my "normal" network (the one for PCs and stuff that access the WAN) and through this, gain access to the cameras. But they don't announce themselves to the WAN and despite the fact that I may be naive, I don't think there is any reason I would be an attractive enough target for someone to try to gain roundabout access via a PC or phone on the WAN-enabled network. Same thing with the Hues. No "cloud" stuff enabled and still work fine in the house where I need them to work. I guess I like the idea of network-accessible devices (at least ones that make sense to control or access via the network) but there isn't much that I want accessing the WAN compared to the items that have the ability baked in. I've annoyed several friends by pleading with them not to buy those "just connect to your wifi and view on our iPhone app!" cameras because I've seen how easy it is to find and exploit these via Shodan and friends. Most people don't ever even open the web interface to set up a password since it clearly shows up on the phone app and "it's just so easy!"
- pixl97 10y ago
  If the iot devices are on your same subnet they could easily be scanned and compromise by any compromised device with Internet access. This stuff is bundled up in toolkits that require little to no interaction by your attacker
  - soylentcola 10y ago
    Yeah, I guess I ought to reassess things. With the automated stuff, the "least obvious target" thing sorta loses its effectiveness.
0xmohit 10y ago
So you keep your cameras devoid of the updates that the manufacturer might release? You also restrict your cameras from talking to other fellow cameras.
- Mister_Snuggles 10y ago
  The manufacturer's update process is to download the firmware image from their site, then connect to the camera with your browser and upload the image. This process works fine, it's just not automatic. I don't think the cameras themselves have any way to automatically update anyway. Yes, I restrict the cameras from talking to each other too. There's no need for one camera to talk to another in my setup.

joblessjunkie 10y ago

It sounds like you actually worry about his kind of thing a great deal, considering the amount of effort you put in.

Mister_Snuggles 10y ago
Believe it or not, it was a whole bunch of little things that added up to this state. When I started with the cameras I was just using the motion detection and email features that were built into the firmware. I never bothered setting up the cloud stuff because I didn't need it. Slowly I transitioned to having the cameras dump images onto a local NAS via FTP. Eventually I started using the cameras for more than watching the cats, so I needed something with better motion detection and recording capabilities. I started with 'motion', then used a fork of 'motion' that seemed to work better, then finally ended up with ZoneMinder. On the VPN side, I decided many years ago that I wanted remote access to my "stuff" - file shares, etc. This started out with the PPTP VPN built into my router, which is terrible but sort of worked. The next step was writing a script that would run SSH and set up a couple dozen tunnels, which is differently terrible but sort of worked. Eventually I got tired of maintaining that and ended up with an IPSec VPN using racoon -- split DNS and split tunneling are truly amazing. The extra Wifi network actually started as a misguided attempt to prevent other stuff (Netflix, mainly) from interfering with the cameras. I figured that putting them on a separate Wifi network would isolate them and give them dedicated bandwidth. My first attempt involved using a Raspberry Pi as an AP. It worked, but not very well at all. The second attempt used the Virtual AP functionality on my router -- it wasn't until I set this up that I understood that Virtual APs don't quite work this way. Around this time I started to see articles about cloud-enabled cameras doing bad things and decided that this setup was worth keeping. The camera and VPN stuff both went on over the last 5-10 years or so, with the Wifi changes being something I did within the last year. You're right that there was a lot of effort, but as you can see it wasn't really driven by privacy/security until the end. Most of these things were driven by trying to find better ways to scratch various itches. The next planned change is to re-address my network so that it doesn't use the 192.168.1.0/24 range that every consumer router seems to use by default. This way I will be able to use VPN when I'm visiting friends without having to tether to my cell phone. Like everything else, it's just scratching an itch.

soylentcola 10y ago

Similar setup. Two IP cameras, one wired with PoE and one WiFi. Both connect to my NAS via their own network that has no direct access to the WAN but can be accessed from the LAN or via VPN. I guess there could be some level of attack surface if someone is dedicated enough to gain access to my "normal" network (the one for PCs and stuff that access the WAN) and through this, gain access to the cameras. But they don't announce themselves to the WAN and despite the fact that I may be naive, I don't think there is any reason I would be an attractive enough target for someone to try to gain roundabout access via a PC or phone on the WAN-enabled network. Same thing with the Hues. No "cloud" stuff enabled and still work fine in the house where I need them to work. I guess I like the idea of network-accessible devices (at least ones that make sense to control or access via the network) but there isn't much that I want accessing the WAN compared to the items that have the ability baked in. I've annoyed several friends by pleading with them not to buy those "just connect to your wifi and view on our iPhone app!" cameras because I've seen how easy it is to find and exploit these via Shodan and friends. Most people don't ever even open the web interface to set up a password since it clearly shows up on the phone app and "it's just so easy!"

pixl97 10y ago
If the iot devices are on your same subnet they could easily be scanned and compromise by any compromised device with Internet access. This stuff is bundled up in toolkits that require little to no interaction by your attacker
- soylentcola 10y ago
  Yeah, I guess I ought to reassess things. With the automated stuff, the "least obvious target" thing sorta loses its effectiveness.

0xmohit 10y ago

So you keep your cameras devoid of the updates that the manufacturer might release? You also restrict your cameras from talking to other fellow cameras.

Mister_Snuggles 10y ago
The manufacturer's update process is to download the firmware image from their site, then connect to the camera with your browser and upload the image. This process works fine, it's just not automatic. I don't think the cameras themselves have any way to automatically update anyway. Yes, I restrict the cameras from talking to each other too. There's no need for one camera to talk to another in my setup.