17 ms·
Webcams used to attack Reddit and Twitter recalled
- zitterbewegung 10y agoIs this the first time that this has happened? A severely insecure device leading to a recall.
- rietta 10y agoI have the same question. I am not aware of a similar situation.
- a3n 10y agoJeeps. https://www.wired.com/2015/07/jeep-hack-chrysler-recalls-1-4m-vehicles-bug-fix/ https://www.wired.com/2015/07/jeep-hack-chrysler-recalls-1-4...
- brk 10y agoThe other company that was widely affected by this, Dahua (see my coverage here: https://ipvm.com/reports/dahua-ddos?code=hn https://ipvm.com/reports/dahua-ddos?code=hn) also issued a statement that they would offer a trade-in discount for affected devices. It wasn't a full recall, and you have to jump through some hoops (work with authorized dealer, etc.) in order to get it.
- rietta 10y agoIs this recall of IoT devices the first of a kind? While it is but a drop in the bucket of IoT insecurity, it has to be an expensive way for the Chinese firm Hangzhou Xiongmai to learn that having the same password on all devices is a security bad idea. Other manufacturers should take note.
- coldcode 10y agoAt least shaming the manufacturers into considering security is a good thing if it makes them avoid being shamed in the future by caring about security. But I doubt most people who bought and use these devices will care as long as they still work.
- mkertajaya 10y agoAgreed. This is a good business decision to issue a recall. It probably won't cost too much since very few people will actually return it.
- laggyluke 10y agoI can imagine having a vulnerable webcam is a huge privacy risk too.
- cwilkes 10y ago> "Security issues are a problem facing all mankind," it said. "Since industry giants have experienced them, Xiongmai is not afraid to experience them once, too." The courage to try something new. Oh wait it isn't new, this is being a copycat.
- codazoda 10y agoIt's probably just bad English but it really sounds like, "everyone gets hacked, we don't care".
- Scirra_Tom 10y agoThe company issued the recall, it could be hugely expensive for them and is the right thing to do. Looks like they do care to me!
- tremon 10y agoThe courage to own up to your mistakes without being forced to by a judge seems like an entirely new business concept to me.
- Thaxll 10y agoA recall where you could just upgrade the firmware?
- 24gttghh 10y agoThis is not always possible via remote methods; doubly so after the devices are hacked and cut off from the previous open methods manufacturers might have used which allowed the attacks in the first place.
- detaro 10y agoCan you still do so reliably on a compromised device?
- sp332 10y agoYes. The Mirai software runs in memory. You can clear the infection just by rebooting the device. But if it's connected to the internet, it will be reinfected again within minutes, unless you change the admin password.
- vanderZwan 10y ago> The web attack enrolled thousands of devices that make up the internet of things - smart devices used to oversee homes and which can be controlled remotely. It's almost poetic that the IoT devices in question are remote-controllable webcams, since constant surveillance is the other symbol of a dystopian Big Brother society.
- deleted 10y ago[deleted]
- cabalamat 10y agoWe need a new acronym: IoCT = the Internet of Crap Things.
- rakoo 10y agoI much prefer InternetOfShit (https://twitter.com/internetofshit https://twitter.com/internetofshit)
- Alex3917 10y agoSo by subsidizing each webcam by a dollar or two, China is able to deploy millions of pieces of hardware to the U.S. that can be used to map and destroy our infrastructure for a total cost of a few hundred thousand dollars. If done purposefully, this has to be one of the most efficient military spends in history.
- throwaway729 10y agoIn the short term. Such a strategy, if proven, would be devastating to China.
- Cozumel 10y agoIt can never be proven and that's the ingenuity of it, meanwhile the company does a token PR effort to fix the issue still leaving millions of weaponisable devices employed. It's not the first time China has been 'caught' doing something like this either https://intelligence.house.gov/sites/intelligence.house.gov/files/documents/Huawei-ZTE%20Investigative%20Report%20(FINAL).pdf https://intelligence.house.gov/sites/intelligence.house.gov/...
- kuschku 10y agoAnd most amazingly, it’s a strategy the NSA devised and used in the first place, now employed against them. Poetic justice.
- Cozumel 10y agoI made that same point the other day too, it's ingenious!
- tdkl 10y agoYou forgot the part where people are voluntarily buying those, because they cost less. Of course those made in California would be totally safe, but damn shame about that globalism.
- 10y ago
- creeble 10y agoThis article doesn't mention the brand names of cameras manufactures by Hangzhou Xiongmai. Anyone know any?
- agalarza 10y agoIt appears that on Amazon they're sold under the name "XM". https://www.amazon.com/Surveillance-Infrared-Recording-Wireless-included/dp/B01DNHFC2C https://www.amazon.com/Surveillance-Infrared-Recording-Wirel... If you sort by the seller there you can see they make dashcams and webcams.
- criddell 10y agoThat's been my big complaint about the reporting on the DDOS attacks. The specifics of the devices should be listed.
- perch56 10y agoA significant number of these cameras were bought on Aliexpress and EBay. How are they going to do the recall when they don't even know the end customer?
- icebraining 10y agoAliexpress and Ebay don't ship the products, the sellers do know who the buyers are, at least their name and address.
- perch56 10y agoOk when I said "they" I meant the manufacturer(s). Look at Samsung and their inability to do a proper recall for the Note 7. A lot of the stores from Aliexpress disappear after one year of existence. I think the proper thing to do immediately is to reverse Mirai and force a password reset on the affected devices.
- martin-adams 10y agoI've been concerned about the security of IoT devices for a while as the low cost devices generally do have security as an after-thought. However, these being used for a DDoS attack puts a spotlight on the issue. While I don't know the solution, I feel it will become harder for manufacturers to shrug this off.
- 0xmohit 10y agoIt's common to see people frown upon seeing curl ... | sh Sad that we happily allow a black box to connect to our internet without any inkling of the fact that it might be used to attack someone, spy upon someone (ourselves?), ...
- qbrass 10y agoYou say that like the people frowning about curl|sh are the same ones plugging random crap into the internet. I doubt there's much overlap between the two groups of people.
- knodi123 10y agoahem... well, there's, uh... me... I'm afraid that you would find the number of people who failed to consider blackbox internet appliances as attack vectors to be disappointingly large. Luckily, I already had a paranoid router setup, so I think I'm probably okay.
- a3n 10y agoThe crowd raises their styrofoam coffee cups and says "Hi knodi123."
- a3n 10y agoCertainly not the majority, but probably more than you think.
- 0xmohit 10y agoI didn't say that "people frowning about curl|sh are the same ones plugging random crap into the internet". That said, I wouldn't be terribly surprised to see a fair bit of overlap.
- graedus 10y agoThe set of those who frown upon curl ... | sh and the set of those who happily allow a black box to connect to their internet and potentially spy on them must be pretty close to disjoint, no?
- Too 10y agoWow, with more and more crap entering the market and more and more people connecting things, it seems like in the future it would be nearly impossible to prevent these types of attacks. Who could you hold responsible? The user for not setting a password or the manufacturer for accidentally creating a backdoor? Neither is really reasonable nor feasible. Filtering the attack is also extremely hard due to the scale of distribution. Will this lead to a more locked down internet?
- apendleton 10y agoThe manufacturer, obviously, just like any other defective product. Devices don't need to be perfect, but if companies are going to say "we're going to sell a potentially imperfect thing," they need to either have a mechanism to update it to address defects, or they need to prepare to issue recalls. As for the password: reputable companies now set a random password and print it on a sticker on the device or a slip of paper inside the box. Having a global default is broken by design; we know users won't change it.
- elcct 10y agoIt is like blaming knife manufacturer for murder. In case of cameras, default password was not a defect and anyone with common sense could change it. Obviously a lot of people didn't do that, so that is their fault. Maybe manufacturers should put a red sticker warning about potential consequences of not changing the password, just like knife maker could put a red sticker that you should be careful cause you can cut yourself...
- detaro 10y agoIt's generally recommended best practice to force the user to change the password on setup, and/or to ship with a randomized password. At some point not making your product conforming to established best practices means you share some of the responsibility. (And customers have more lee-way in being uneducated than manufacturers). One would hope best practices don't have to be turned into laws (because they quickly become outdated and are easily miss-applied), but there is going to be a push to do that.
- lgleason 10y agowhat about the routers and other cheap devices. This is a drop in the bucket. Until regulations (and strong enforcement) of devices requiring device security to sell them in countries like the US, UK, EU etc. happen this will continue to be a problem.
- _pmf_ 10y ago> it has to be an expensive way for the Chinese firm Hangzhou Xiongmai to learn that having the same password on all devices is a security bad idea Yes, god forbid that any customer be kept to a minuscule amount of due diligence. People at the age of 11 or 12 are able to change a router password. Is it really, really too much to expect from a gun slinging, SUV driving 200 pound US-American to take 5 minutes to set up a device?
- fao_ 10y agoPeople at the age of 11 or 12 are generally not intimidated by things they don't understand, because they have not learned that behaviour.
- pjc50 10y ago> generally not intimidated by things they don't understand Lots of educators would disagree with you on that one.
- fao_ 10y agoYou forgot the other part: > because they have not learned that behaviour Children can pick up all sorts of behaviour from their parents, albeit I have only anecdotal evidence, but: I have met many, many people of the ages 11 to 12, the majority were intensely curious. In all the cases where they were not curious, their parents (or tutors, etc.) either did not think learning to be a joy, actively discouraged them for curiousity, or scorned them for asking questions (especially about things that were 'unrelated'). In other words, the young people were taught that it was a bad thing to be curious or otherwise learn about things, and especially a bad thing to learn in a non-prescibed way.
- BlickSilly 10y ago>Is it really, really too much to expect from any consumer to take 5 minutes to set up a device? yup
- jasonwatkinspdx 10y ago
- Lagged2Death 10y agoWebcams used to attack Reddit and Twitter recalled I think it's kind of troubling that "the vast variety of information services that comprise the internet" apparently means "Reddit, Twitter, and Facebook" to laymen now.
- jdc0589 10y agothe title was just a really terrible summation of the attack. TONS of websites were affected. Some huge like reddit and twitter, and some tiny ones.
- phonon 10y agoUnderwriter's Laboratories should start including basic security hardening in their tests.
- pjc50 10y agoVulnerabilities can be surprisingly hard to find: http://mjg59.dreamwidth.org/45098.html http://mjg59.dreamwidth.org/45098.html (Matthew is an absolute expert at breaking into cheap IoT devices)
- criddell 10y agoThey should be hard to find. Basic UL testing could establish that the most common problems are at least tested for.
- hash-set 10y agoI the small electronics market, price is everything. Thus any compliance that raises costs is likely to be routed around, especially by Chinese companies. Do most products coming from China even get UL listed?
- bitmage 10y agoHas anyone seen an explanation of how the telnet port on these devices is getting exposed to the internet to be exploited? I would think that most home users are behind a NAT device. Even with UPnP, why would the manufacturer have that port set to be forwarded?
- drzaiusapelord 10y agoTo lower support costs. Its a lot easier to use upnp than explain to consumers why their app or web browser won't connect to their home device because of how NAT and firewalling works. Or to implement hosted servers, which also cost money, to be the go-between.
- redwards510 10y ago> why would the manufacturer have that port set to be forwarded? Because remote management, and the default state is to have everything opened up to facilitate pain-free setup and config.
- empath75 10y agoThere are lots of ways to get inside a network besides going through open nat ports. If there's a web interface, you could pop that, or go through an infected pc, etc. Once you're in the network, you can hit all the ports you want inside it.
- dimino 10y agoBut that's not how it's happening. These IoT devices are being granted IP addresses, somehow. Mirai is scanning the web and blindly trying telnet, and if it works, it tries these password combos. It doesn't do anything even remotely sophisticated to navigate a network.
- glennos 10y agoAgree, seems bizarre but sounds like sloppy device config. https://news.ycombinator.com/item?id=12765265 https://news.ycombinator.com/item?id=12765265
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- user5994461 10y agoHow many devices are recalled? What percentage of the DDoS were they responsible for? Not enough information.
- dammitcoetzee 10y agoSo... if a company does all due diligence to perform a recall, but very few people actually send back their five dollar web camera. Is the company pretty much off-the-hook then if that customer's kept webcam gets hacked and is used to brick a nun's IoT pacemaker?
- sirshoelace 10y agoI would imagine they are off the hook for liability if they issue a recall, and I would also imagine there are going to be probably less than 5% of devices actually returned. How many end users of these products have any idea that they were part of this attack and how many end users will care enough about some cheap chinese electronic device to send it back and wait for a refund/replacement?
- Tempest1981 10y agoExactly. What percent of users are willing to go through the recall effort, especially for cameras mounted outdoors, and hardwired via PoE? Not to mention shipping (overseas?), and being without security for weeks.
- piker 10y agoForgive me if I overlooked it in the article, but if this recall is being conducted at Hangzhou Xiongmai's own initiative, it should be applauded. No doubt it'll be expensive to fix these up, and it's not clear that the organization has any real liability for the security faults. People are suggesting that we should "name and shame", and I somewhat agree, but I think we should also applaud efforts of those who are taking the expensive steps of fixing the problem with no direct incentive to do so. Because the DDOS's costs are borne externally to the consumer, consumers can't really be counted on to mandate security fixes. On the other hand, establishing liability for a company adding to a preexisting botnet through security faults seems tenuous. One solution seems to be regulation (self or third-party), and it's exciting to see a manufacturer take this issue seriously and start us down the path of self-policing. [edit: for clarity]
- drzaiusapelord 10y ago>but if this recall is being conducted at Hangzhou Xiongmai's own initiative I imagine there were a lot of angry calls from Washington and Beijing over this. I don't think companies are magnanimous like this without external pressure. >but I think we should also applaud efforts of those who are taking the expensive steps of fixing the problem with no direct incentive to do so. Applaud what exactly? That all these companies ship devices that happily take IP addresses and go on the public internet or punch through firewalls with upnp and do not force a first-time password change and do not have an auto-updater installed? Even the cheapest Netgear comes with a sticker on the side for a semi-random password instead of shipping everything with 'admin/password.' Or using antiquated and non-encrypted transports like telnet. These 1990's habits need to die and it won't happen because of corporate good graces, because those haven't worked historically. If it happens, it'll happen via external pressure via governments and lawsuits. Market forces are rarely a fix all here.
- CountSessine 10y agoI imagine there were a lot of angry calls from Washington and Beijing over this. I don't think companies are magnanimous like this without external pressure. No one in Washington or Beijing with diplomatic credentials and contact with the other side even knows what DNS is or that there was an attack on Friday. A lot of Chinese companies are both privately owned and awash in money, and that gives them the latitude to behave in ways that aren't strictly about achieving maximum Pareto efficiency. These guys are doing the right thing. Please don't try to minimize that.
- alex1 10y agoThere should be recalls from more manufacturers. Someone I know purchased a surveillance camera with a major brand name (Samsung) from Costco [0] just a few weeks ago that gave me a root shell by simply telneting in as root with no password and no way to reliably set a root password or disable telnet. It was returned the following day. Last I checked, Costco is still selling it. This problem isn't confined to cheap Chinese cameras you can buy online. Vulnerable devices are being sold at major American retailers and they are still on the shelves. [0] http://www.costco.com/Samsung-SmartCam-HD-Plus-1080p-Wi-Fi-IP-Monitoring-Camera-Bundle-SNH-V6414BN.product.100234327.html http://www.costco.com/Samsung-SmartCam-HD-Plus-1080p-Wi-Fi-I...
- rietta 10y agoYeah, this is one reason I still don't have security cameras setup on my home network. If I decide to get them, I am going for a dedicated ethernet network just for cameras and no internet connection. I may allow a VPN to a inside the house server to see footage. According to the Wirecutter, Nest cameras are some of the better commercial one but I've still not bought one or done any review myself.
- exhilaration 10y agoWhen we were shopping for a baby cam to keep an eye on the baby, I opted to get a simple RF cam [1] instead of the more popular IP cameras that allow you to use your smartphone and monitor from anywhere. The lower tech approach means you can park a van in my driveway and probably pick up the signal but that's a lot harder (and more obvious) than scanning an IP range from anywhere in world and finding vulnerable devices. [1] https://www.amazon.com/Foscam-FBM3501-Wireless-Digital-Monitor/dp/B00DNBA82S https://www.amazon.com/Foscam-FBM3501-Wireless-Digital-Monit...
- thomaskcr 10y agoI got a Wansview camera and assigned it a static IP and just don't allow any traffic not originating from the chromecasts or tablet -- it's nice because all the TVs do picture in picture with the baby camera. Still pretty weird seeing the constant log entries trying to reach a couple servers - I've been doing traffic capture since I'd like to see what it's trying to do. One is obviously the plug-n-play stuff, but it's crazy that those packets apparently get broadcast outside the network (? - I haven't really looked into how that PnP IP/port is handled but it's getting caught at my firewall).
- dalore 10y ago> If your webcam is hijacked you have effectively let an intruder enter your home Except it's not. They can't touch me, hurt me physically, take things away. All they can do is see me. So what they see some guy in front of a computer. I'm more worried about the hacks that can take over my keyboard, and can access financial data. But even then it's the banks problem and insurance that will take care of it.
- geofft 10y agoIf they can see some guy in front of a computer, can't they see some guy in front of a computer typing a password into a financial website?
- harrisonmalone 10y agoThis is extremely disconcerting
- deleted 10y ago[deleted]
- jordache 10y agothere needs to be a regulation body, similar to NHTSA that regulates security of digital products.
- greggman 10y agoBecareful what you ask for. How is any software nowadays different? If I setup a raspberry pi with camera and there are exploitable bugs in the software is the creator of the software liable? Does every piece of software open source and closed source need to be approved by a regulation body before your allowed to run it? Distribute it? Put it on GitHub? There's nothing unique about IoT devices. They're just computers. If you regulate one you arguably have to regulate the other
- jordache 10y agoI'm not saying iOT devices specifically. We can define the regulation threshold at mass consumer digital and connected products. Yes, digital/software is inherently less tangible and trickier to regulate than a physical product sold at smaller volumes, but we need to start somewhere. Poorly made digital+connected products distributed in large volumes can have tremendous impact to the world population.
- Tempest1981 10y agoOr perhaps just the equivalent of Benson Leung from Google, who tests and rates USB-C cables on Amazon.
- brk 10y agoAnd at the same time, the company recalling those products is issuing threats against anyone who is defaming their "goodwill": https://news.ycombinator.com/item?id=12778954 https://news.ycombinator.com/item?id=12778954
- deleted 10y ago[deleted]
- beamatronic 10y agoWas it possible to take control of these cameras even if they were behind a consumer firewall? Is the issue that consumers were connecting them directly to the Internet, not behind a firewall?
- dghughes 10y agoI'm designing a weapon on mass disruption IoT confetti. Bow to my demands or I will send you an exploding yey tasteful confetti card with 50,000 confetti all trying to access your wifi network.
- cbr 10y agoGood for them! A recall is the responsible option at this point, and I hope other manufacturers do the same.
- keysersosa 10y agoThough I'm happy we got top billing in the headline, Reddit wasn't actually impacted directly (though of course many of the sites we linked to were).
- donatj 10y agoDoes anyone know if Foscam's were affected at all? I unplugged mine to be safe.
- scottmf 10y agoApple made a good call with its "strict" requirements for HomeKit devices. http://www.forbes.com/sites/aarontilley/2015/07/21/whats-the-hold-up-for-apples-homekit/#39031ee4322b http://www.forbes.com/sites/aarontilley/2015/07/21/whats-the...
- dmritard96 10y agoits easy to be secure when virtually nobody has your devices...
- scottmf 10y agoI'm not sure what point you're making. Which devices are those?
- dmritard96 10y agomy point was simply that homekit has been incredibly slow to gain any adoption and is pretty limited in terms of who can make things (mfi program), what hardware needs to be in your product (special auth chips..) etc. As a general strategy, if your iot strategy requires iot device makers include special chips and use specific factories, its a rather closed way to approach the market.
- scottmf 10y agoMFi isn't too limited. You must just apply and meet certain standards. The benefit is you have access to a huge market (iOS users). What's wrong with this approach? Imagine the PR disaster if this DDoS attack was caused by HomeKit devices. As a potential future user of HomeKit it's reassuring to know security is a real concern here. I'm glad I won't have to probe the device to check it isn't running a telnet server with no root password, for example. When we're talking about an internet-connected camera or a front door lock, yeah I'm going to want high standards for security. If that slows down HK adoption so be it. If I wanted a convenient-but-insecure lock compatible with my existing devices today I'd just leave my door unlocked.
- davidf18 10y agoAs someone who was a VLSI design engineer for 4 years, as well has extensive software experience, much of the disruption happened because of poor engineering. There should always be redundancies in critical systems. The groups such as Twitter, Reddit and Spotify did not use redundant DNS providers relying only on Dyn. Moreover, DNS should be designed so that the systems are more resilient to attacks. The initial design of the internet was meant to withstand nuclear attacks after all. There is absolutely no way that we can protect all devices on the internet from being bots, etc. Just as it is almost pointless blaming hackers when in most cases the hacks were because breeches from failure to update software, to put in proper security software, and to hire top level consultants to implement secure systems. Put another way, we can't possibly jail everyone who would want to steal money. That is why we use safes.
- jjawssd 10y agoFair point, but how do you decide how much redundancy is excessive? I can always construct a scenario which will require more redundancy and more cost.
- davidf18 10y agoIt would depend on how critical the element is to the system. I would expect at least one backup system. That is there should be a least one major backup DNS provider for example. Some systems on airliners have two backups.
- DenisM 10y agoOne down, one million to go. Thee is no way these horses can be put back into the barn, there are too many of them. As long as consumers make their decision based on price there is every incentive for the manufacturers to continue cutting corners - the ones that put extra work into security will be at disadvantage compared to those playing fast and lose. Can we talk about BGP flowspec instead? Filtering offensive traffic early and often can end DDoS once and for all.
- ra1n85 10y ago>Can we talk about BGP flowspec instead? Filtering offensive traffic early and often can end DDoS once and for all. What about spoofing? Until broadband providers get serious about BCP 38, this is just cat and mouse.
- dmix 10y agoIf they are connected to the internet, why not push out an update to fix the default password issue? A hardware recall seems silly when it's clearly a software issue. Unless they didn't include any firmware updating system... which is likely the elephant in the room not being addressed with most insecure IoT devices. Android faced this problem as well and has recently made progress addressing it. Although a lot of phone companies get in the way and manufacturers have very short support lifespans.
- dmritard96 10y agoThis. We build IoT devices and frankly, we are late shipping while we are doing heavy duty testing on FOTA. Happy to ship late to avoid being part of a botnet and to make sure we can improve our products over time. Depending on the complexity of the product, FOTA can be rather complex and I don't expect budget device makers that aren't particularly branded to bother.
- arzeth 10y agoSo there must be a law: 1. Any device with internet access must be able to automatically update all its software. 2. Because a manufacturer can either go out of business (some devices are used for >10 years) or not care about its users, all its software must be open source. A code, which needs to be secret, can be stored on a hardware level. 3. But if a software is open source, it doesn't mean there would be people who'll fix the bugs, therefore there should be the list of OSes approved (by a regulator and EFF?) to be used on IoT-devices. The development of these OSes should be public (on GitHub, etc.). By having ~10 different OSes instead of a million, solving bugs would be possible and much easier. 4. By having such list of approved OSes, we also solve the problem of having a vulnerabilities in the updating process, e.g. missing signatures, using RSA-1024 or even RSA-512 for signatures. 5. By having such list of approved OSes, it'll be easy to maintain the live kernel patching service (in the future it'll be hard to imagine an OS without it). 6. By having such list of approved OSes, community would quickly fix the problem of using default passwords. Without such law, expect 10 Tbit/s attacks in a year, and >500 Tbit/s attack in 2022 (if popularity of IoT would increase as fast as mobile phones did).
- dimino 10y agoLaws won't fix this, recalls won't fix this, what we need to do is find a technical solution to the DDoS problem. You can't un-ring this bell, and it might actually be harmful to try. A free and open Internet is more important than DDoS attacks.
- abc_lisper 10y agoI think I see a opportunity for something new here. Why isn't there a uber secure OS written in a high level language that would prevent easy privilege escalations, vulnerabilities caused by buffer overruns etc? It would be nice to have a standard security approving body (like FCC) that gives out graded standards. It is like every generation forgets the mistakes of the past and repeats them. When $5 Raspberry Pi is powerful enough to run desktop OS, I see no reason to not adopt a high-level language that prevents basic security violations at the roots.
- _audakel 10y agoSecurity-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies, including United States Department of Defense–style mandatory access controls
- jjawssd 10y agoI think this method requires too much effort and attention to detail to be realistic, although I do agree this would be an ideal solution. It makes more practical and economic sense to put an electronic network "condom" around a dirty, likely misconfigured and insecure IoT device.
- fryan 10y agoIs the denial of service attack on DNS servers still going on? Major sites are still much slower than last week.
- socmag 10y agoYou guys are crazy. A probably small creative team simply made an error while building a camera in good faith that was abused by criminals. Who is the victim here? What's all this crap about simple fun web cameras as "Bad Actors"... In fact the use of the term "Actor" as applied to a pretty dumb piece of electronics is pretty creepy in itself. What are we trying to do here? The term "State Actor" is fairly new in terms of popular usage. Thanks to CNN and media, we are being trained to know this word in a particular context. Now, we are being trained to place dumb pieces of electronics in the same bucket as Russia and China. LOL I'm sure there wasn't a meeting where the camera manufacturer execs set around a table and said let's make these things blow up the world. And you know, even if there was, the shame lies on the fact that we don't have better edge level security that can detect and shut down abnormal traffic patterns close to source. There is some fairly low hanging fruit here. Routers and gateways with pretty damn simple algorithms could detect and prevent these types of attacks if they were available. The network should protect itself against "Bad Actors", because... trillions of devices are a coming, and we can't expect them all to be certified to protect the network. The concept itself is completely absurd. Fat better to improve the infrastructure than to impose per device level policies. It's the IETF that needs to step up. Not the guys in a garage who couldn't code. Sure maybe they could have done a better job, but from the level of programming we are currently at it is an absolute certainty that this will happen again whether we like it or not.
- SrslyJosh 10y ago> A probably small creative team simply made an error while building a camera in good faith that was abused by criminals. Who is the victim here? Everyone who's been affected by the DDOS. Manufacturers are responsible for the security of their devices. If you ship something that's vulnerable, it's you to fix it. If there are damages, those come out of your pocket. > It's the IETF that needs to step up. Not the guys in a garage who couldn't code. No. If you're a guy in a garage who can't code, you shouldn't be writing code, let alone shipping devices. Are you for real, or some kind of astroturf account?
- weaksauce 10y ago> Routers and gateways with pretty damn simple algorithms could detect and prevent these types of attacks I am not sure it's that simple really. the whole point of ddos is that it's distributed so that each node doesn't need to do a whole lot of traffic(and filtering out the traffic at the other side is really hard because of the distributed nature of it). the main reason this stuff happens is that security is not a feature that most people care about and won't pay for it because they are ignorant of how the system works. The managers decide not to make security a priority.
- socmag 10y agoYou guys are crazy. A probably small creative team simply made a camera in good faith that was abused by criminals. Who is the victim here? What's all this crap about simple fun web cameras as "Bad Actors"... In fact the use of the term "Actor" as applied to a very simple piece of electronics is pretty creepy in itself. What are we trying to do here? The term "State Actor" is fairly new in terms of popular usage. Thanks to CNN and media, we are being trained to know this word in a particular context. Now, we are being trained to place dumb pieces of electronics in the same bucket as Russia and China. LOL I'm sure there wasn't a meeting where the camera manufacturer execs sat around a table and said let's make these things blow up the world. And you know, even if there was, the shame lies on the fact that we don't have better edge level security that can detect and shut down abnormal traffic patterns close to source. There is some fairly low hanging fruit here. Routers and gateways with pretty damn simple algorithms could detect and prevent these types of attacks if they were available. The network should protect itself against "Bad Actors", because... trillions of devices are a coming, and we can't expect them all to be certified to protect the network. The concept itself is completely absurd. Far better to improve the infrastructure than to impose per device level policies. It's the IETF that needs to step up. Not the guys in a garage who couldn't code. Sure maybe they could have done a better job, but from the level of programming we are currently at it is an absolute certainty that this will happen again whether we like it or not.
- glennos 10y agoIt's disappointing the article doesn't give any actionable detail of the recall. From what I can see, Hangzhou Xiongmai is a components manufacturer, not a retail brand, so there's no practical way to identify an affected device with the information here.
- nickjackson 10y agoWould it not make sense for broadband router manufacturers to step up here, especially ISPs who provide routers to customers. First of all, IoT devices really need to be connected on isolated vlans with very strictly controlled WAN capabilities. Obviously this already exists, but not in the fashion a layman, who wants to put their fridge on the wifi will understand. The average home routers need cleaner interfaces and clearer abstractions rather than the cruft that exists now. Does your fridge really need to access the internet, and if it does, perhaps you could setup your router to only allow access at certain times, to a single host and with circuit breaker protections in case traffic has a signature that matches that of a DDoS attack. This circuit breaker pattern could be extended to all traffic running through the router, and provide the user with reports of potential infected devices and traffic hungry users.
- rabboRubble 10y agoWhat a stupid, inaccurate, article title. Shame on the beeb. Edit: Better? "Webcams used to attack a DNS provider recalled."
- ge96 10y agoI wonder if when you hit show parent (yesterday) it wouldn't load...
- gjolund 10y agoInherent flaw with IoT devices that we have been talking about for years. This makes Heartbleed look benign.
- rjblackman 10y agoI'm surprised we haven't seen anything exploiting rompager yet. This is a very widely used web server in home routers https://www.shodan.io/search?query=rompager https://www.shodan.io/search?query=rompager http://www.pcworld.com/article/2861232/vulnerability-in-embedded-web-server-exposes-millions-of-routers-to-hacking.html http://www.pcworld.com/article/2861232/vulnerability-in-embe...
- ausjke 10y agoIt's not webcams technically, they're the ip surveillance cameras which run a customized linux with some scripts and a RTSP server, and definitely not designed for public IPs.
- zaroth 10y agoI think the real problem here lies in the lack of auto-update. Devices will always have vulnerabilities, constantly being discovered, which once weaponized will be just as trivial to own a large swath of devices as telneting for root was here. The UCC provides an implied warranty for suitability for intended purpose. The FTC defines unfair and deceptive business practices to require a baseline level of security commensurate with the sensitivity of the data that could be exposed or the potential damages that can be inflicted. As in most cases, new laws tend to make things worse, we just need to do better with the old laws. It's not that it's illegal to sell someone a Io(S)T device that can be owned for running a DDoS, but I am willing to bet it is illegal or at least creates significant liability for the manufacturer to sell such a device that also has no way to be fixed after that flaw is discovered. What would be nice is a simple industry standard labeling that indicates a device has auto-update functionality, along with a large numeral indicating the number of years from date of purchase that updates will be provided. The same decal could be used on computers, phones, routers, and IoT. Just like we trained consumers to look for the WiFi Alliance logo to know the router or card they are buying will "just work" I think we are missing a label which would drive consumer confidence and encourage good behavior by the manufacturers. Probably an industry consortium already exists for something like this, but I just haven't heard of it... Because there's no such thing as a new idea, right?
- cdw2 10y agoSo, do there exist any IP cameras that are simple, secure and don't open a crazy number of ports for bizarre, unnecessary protocols whilst including a steaming pile of PHP (or similar) to provide a buggy, over-engineered, exploit-ridden web interface? I could do with some for a farm project at the moment, but as far as I can tell, they're uniformly awful. Are there any that are reflashable with something more respectable, even? Ideally what I want is a video stream over TCP with power-over-ethernet support - and no other services.