4 ms·

Wow, with more and more crap entering the market and more and more people connecting things, it seems like in the future it would be nearly impossible to preven

by Too 10y ago

Wow, with more and more crap entering the market and more and more people connecting things, it seems like in the future it would be nearly impossible to prevent these types of attacks. Who could you hold responsible? The user for not setting a password or the manufacturer for accidentally creating a backdoor? Neither is really reasonable nor feasible. Filtering the attack is also extremely hard due to the scale of distribution. Will this lead to a more locked down internet?

apendleton 10y ago
The manufacturer, obviously, just like any other defective product. Devices don't need to be perfect, but if companies are going to say "we're going to sell a potentially imperfect thing," they need to either have a mechanism to update it to address defects, or they need to prepare to issue recalls. As for the password: reputable companies now set a random password and print it on a sticker on the device or a slip of paper inside the box. Having a global default is broken by design; we know users won't change it.
- elcct 10y ago
  It is like blaming knife manufacturer for murder. In case of cameras, default password was not a defect and anyone with common sense could change it. Obviously a lot of people didn't do that, so that is their fault. Maybe manufacturers should put a red sticker warning about potential consequences of not changing the password, just like knife maker could put a red sticker that you should be careful cause you can cut yourself...
  - detaro 10y ago
    It's generally recommended best practice to force the user to change the password on setup, and/or to ship with a randomized password. At some point not making your product conforming to established best practices means you share some of the responsibility. (And customers have more lee-way in being uneducated than manufacturers). One would hope best practices don't have to be turned into laws (because they quickly become outdated and are easily miss-applied), but there is going to be a push to do that.
    - olliej 10y ago
      In this case the password is hard coded in the firmware (and the web interface isn't aware of the telnet interface). They actually designed something where the password literally cannot be changed by the user :-/
      - elcct 10y ago
        Oh...
    - elcct 10y ago
      > but there is going to be a push to do that. That's obvious - nobody wants to be blamed for its own ignorance and then if at the same time you can make money on it, the law is just a matter of time, especially in the left wing climate supporting bureaucracy and over regulation and eventually making people more ignorant and irresponsible. Vicious circle.
  - deleted 10y ago
    [deleted]
  - Tenhundfeld 10y ago
    From what I read, part of the issue here is the these specific cameras cannot have their password changed, at least not through the normal web admin UI. So, they're shipping a default password that people cannot update.
skywhopper 10y ago
Hopefully it will lead to some regulation of these devices. That's a dirty word to many, but the fact is that Internet-connected devices are part of a global community, and need to behave safely, and being open to hijacking by criminals is not safe. The proposal I like best is that the industry should get out in front of this, and build a self-regulator organization now which issues recommendations and certifications of Internet-connected products. Then governments could simply require compliance with the industry norms, established and vetted by the industry, and we can keep political institutions out of micromanaging the electronics industry. The model to follow here is Underwriters Laboratory, which sets standards and grants certifications for electrical and industrial supplies and equipment. Then, for example, city governments can just specify that everyone installing, say, outdoor lighting at their home must purchase lights and outlets rated for wet outdoor usage by the UL.
- kefka 10y ago
  Egress filtering, or filtering packets not of the source network, would go a long way here. It wouldn't fix everything, but it would be a definite start.

by Too 10y ago

apendleton 10y ago

The manufacturer, obviously, just like any other defective product. Devices don't need to be perfect, but if companies are going to say "we're going to sell a potentially imperfect thing," they need to either have a mechanism to update it to address defects, or they need to prepare to issue recalls. As for the password: reputable companies now set a random password and print it on a sticker on the device or a slip of paper inside the box. Having a global default is broken by design; we know users won't change it.

elcct 10y ago
It is like blaming knife manufacturer for murder. In case of cameras, default password was not a defect and anyone with common sense could change it. Obviously a lot of people didn't do that, so that is their fault. Maybe manufacturers should put a red sticker warning about potential consequences of not changing the password, just like knife maker could put a red sticker that you should be careful cause you can cut yourself...
- detaro 10y ago
  It's generally recommended best practice to force the user to change the password on setup, and/or to ship with a randomized password. At some point not making your product conforming to established best practices means you share some of the responsibility. (And customers have more lee-way in being uneducated than manufacturers). One would hope best practices don't have to be turned into laws (because they quickly become outdated and are easily miss-applied), but there is going to be a push to do that.
  - olliej 10y ago
    In this case the password is hard coded in the firmware (and the web interface isn't aware of the telnet interface). They actually designed something where the password literally cannot be changed by the user :-/
    - elcct 10y ago
      Oh...
  - elcct 10y ago
    > but there is going to be a push to do that. That's obvious - nobody wants to be blamed for its own ignorance and then if at the same time you can make money on it, the law is just a matter of time, especially in the left wing climate supporting bureaucracy and over regulation and eventually making people more ignorant and irresponsible. Vicious circle.
- deleted 10y ago
  [deleted]
- Tenhundfeld 10y ago
  From what I read, part of the issue here is the these specific cameras cannot have their password changed, at least not through the normal web admin UI. So, they're shipping a default password that people cannot update.

skywhopper 10y ago

Hopefully it will lead to some regulation of these devices. That's a dirty word to many, but the fact is that Internet-connected devices are part of a global community, and need to behave safely, and being open to hijacking by criminals is not safe. The proposal I like best is that the industry should get out in front of this, and build a self-regulator organization now which issues recommendations and certifications of Internet-connected products. Then governments could simply require compliance with the industry norms, established and vetted by the industry, and we can keep political institutions out of micromanaging the electronics industry. The model to follow here is Underwriters Laboratory, which sets standards and grants certifications for electrical and industrial supplies and equipment. Then, for example, city governments can just specify that everyone installing, say, outdoor lighting at their home must purchase lights and outlets rated for wet outdoor usage by the UL.

kefka 10y ago
Egress filtering, or filtering packets not of the source network, would go a long way here. It wouldn't fix everything, but it would be a definite start.