12 ms·
New security camera compromised by worm within minutes of installation
- Eun 10y agoWhy is this on the frontpage? :o
- vincnetas 10y agoHave you read followup tweets?
- p0la 10y agothose tweets are very cool. It's very funny to see it happening.
- woliveirajr 10y agoTL;DR: Guy bought a webcam, installed it, and within one and a half minute it was already infected and even kicked him off his telnet connection. The twitter stream narrates what he configured before turning the webcam on, and give details on how things unfolded.
- jandrese 10y agoIt's like the old days of installing XP from a CD and then putting it online to get patches. You would have half a dozen viruses on the box before you finished connecting to Windows Update.
- libria 10y agoThis is why the appliance market - Dropcam in this case - is often safe from the DIY enthusiast market. Setting these up is one hurdle. After that's done there's any combination of: network maintenance, security patches, updates, hosting a local server, DNS, troubleshooting etc. For some people, it's just worth $150 + 10/mo to not have something else to think about.
- maxerickson 10y agoSo is Dropcam reasonably secure then?
- 59nadir 10y agoSetting one of these up is considered "DIY"? Wouldn't actually making the backend for it, at the very least, be DIY?
- Desustorm 10y agoThis is absolutely fascinating - and stunning that it only took ~90 seconds to be infected. Turns out the source code is... open source: https://github.com/jgamblin/Mirai-Source-Code/blob/6a5941be681b839eeff8ece1de8b245bcd5ffb02/mirai/bot/scanner.c https://github.com/jgamblin/Mirai-Source-Code/blob/6a5941be6...
- arkadiyt 10y agoJust to clarify it's not published by the author - the author got hacked and their source leaked.
- stcredzero 10y agoWell, crap, you had the same thing when RedHat 7 was new. new RedHat 6 installs that went online were getting pwned in just a few minutes. The exploit scripts were open source even then.
- hellofunk 10y agoI don't understand how the bot net found his camera so instantly when he turned it on or installed it. Within moments/seconds, it was attempting to infiltrate a brand new device.
- woliveirajr 10y agoThere aren't so many IPv4 addresses and connections are fast enough even for residential users. If considering a botnet, even faster. There is even services that scan the whole ipv4 in less than 5 minutes: https://zmap.io/ https://zmap.io/ And a list of how to do it: http://www.securitynewspaper.com/2015/10/15/how-to-scan-whole-internet-3-7-billion-ip-addresses-in-few-minutes/ http://www.securitynewspaper.com/2015/10/15/how-to-scan-whol...
- thyrsus 10y agoI don't get it: how does the attacker initiate contact with a 192.168.0.0/16 address? Is part of the installation instructions "On your WAN router, DNAT your external address and a port to your internal address and telnet port."?
- fuzzy2 10y agoNo, but that’s what a novice would do to access the camera remotely.
- gvb 10y agoYes, except it is all automated by UPNP https://nakedsecurity.sophos.com/2013/01/29/what-if-your-security-camera-were-an-insecurity-camera/ https://nakedsecurity.sophos.com/2013/01/29/what-if-your-sec... https://en.wikipedia.org/wiki/Universal_Plug_and_Play#Problems_with_UPnP https://en.wikipedia.org/wiki/Universal_Plug_and_Play#Proble...
- thyrsus 10y agoThank you. Now I know that the first thing to do with any router I have is to disable Internet Gateway Device Protocol.
- digi_owl 10y agoNote that this was a deliberate setup. The safest thing to do for home routers is to kill UPNP, so that random devices on the inside can't open listening ports to the outside.
- coldpie 10y agoHmm, what do you mean by "deliberate setup"? Reading through it, it looks like the behavior any naive user would do while setting up the camera.
- neaden 10y agoI think they mean that he didn't take reasonable precautions to prevent it being hacked, but as you said that's because most users won't take those precautions either. The intention was for this to get hacked though.
- pawadu 10y agoPossibly stupid question: How can I verify that upnp is really disabled? (I don't trust my router to do it correctly) edit: https://www.grc.com/su/UPnP-Rejected.htm https://www.grc.com/su/UPnP-Rejected.htm
- tener 10y agoProbably sniffing the packets should work. But even if you do that properly there is always a high chance your router will be compromised and you won't be able to fix it. To be extra sure just treat it as such and put a firewall between it and your LAN. That requires time to configure, but may satisfy the paranoid.
- countingteeth 10y agoWhat? Put a firewall in front of your firewall, because more firewalls is better? How about use a firewall that's not shit to begin with.
- homero 10y agoSo you're saying these get instantly infected when anyone plugs them in? That's insane
- lobo_tuerto 10y agoDoes anyone have a recommendation on a secure brand/type of security camera to get?
- jenamety 10y agoNest was acquired by google. They've got a lot of reputation to lose if they get breached/hacked.
- sickbeard 10y agoWhy do people connect their security camera to the internet? You shouldn't connect security anything to the internet
- ceejayoz 10y agoThey do it so they can view the camera remotely, like when they're on vacation.
- rograndom 10y agoThis, and with the camera it looks like it automatically opened up firewall ports by itself using UPNP
- Melown 10y agoPeople need to VPN home to see their fucking cameras lol.
- TheGrumpyBrit 10y agoPeople don't care. They don't think anybody else is going to be interested in watching their cameras, and it doesn't even cross their mind that a camera could be vulnerable to an exploit. They don't even know what an exploit is. Once they can see their camera from their phone, they don't care what else is happening.
- verbify 10y agoAlso to have an external backup of the video feed. Otherwise, if you get robbed, and they happen to steal your NAS, you've lost the main reason to have a security camera in the first place - to identify the perp.
- forinti 10y agoI purchased a TP-LINK camera and didn't want to use their cloud, so I made it ftp images to a Raspberry Pi and then forward them to me via a Telegram Bot. I've been pondering getting OpenWRT on the camera and then running the bot directly on it; I'm not sure it's feasible.
- bsenftner 10y agoAs a person just starting to explore ip cameras, can anyone suggest any resources to tell if my cameras are already infected? If so, what to do? If they are only accessible locally, within the home's local intranet, it that safer?
- devy 10y agoYes, this is a great idea! We need a Has it been pwned database (just like https://haveibeenpwned.com/ https://haveibeenpwned.com/ for IoT devices)!
- jlgaddis 10y agoWatch the traffic coming out of it.
- notheguyouthink 10y agoAny tips on how to do this (for those of us not educated in monitoring traffic)? I'm writing personal home automation stuff and will be wiring up a handful of IoT SmartPlugs. With all this IoT stuff i'm starting to wonder if buying a 2nd router to isolate the IoT, or perhaps a "really good" router with features designed for monitoring IoT. Regardless, this is a problem i won't be able to ignore. So any advice is appreciated :)
- nitrogen 10y agoBridge two network interfaces on a computer, then run Wireshark on the bridged interface. Connect one side of the bridge to the main network, the other side to the IoT network. Or, if you have a non-switching hub, you can use that instead of a PC with two NICs.
- rasz_pl 10y ago1 is the camera chinese? did you buy in on ebay/amazon? yes its already hacked 2 are they? have you scanned yourself? even something from the kooky Gibson should be enough https://www.grc.com/shieldsup https://www.grc.com/shieldsup
- awqrre 10y agoYou can have the same problem with any OS that you install that is connected to the Internet before the updates are applied (ie: getting a compromised computer in a a few minutes, being Windows or Linux)
- witty_username 10y agoI thought that is only with old (like 1 year or older) OS versions? Aren't remote exploits quite rare?
- DashRattlesnake 10y agoI don't think a rule of thumb like that is really valid. Someone could be scanning for hosts with zero days right now.
- witty_username 10y agoYes, but aren't zero day remote exploits very rare?
- awqrre 10y agonot for a stock OS that hasn't been updated yet (let's say you install from a CD or re-install from an hidden partition)
- DashRattlesnake 10y agoEvery security bug, at some point, could have been a zero day.
- justinsaccount 10y agoExcept that these devices do not have updates and are impossible to fix.
- awqrre 10y ago
- mbrookes 10y agoSlightly off topic, but could anyone suggest how my laptop on my home network could get portscanned by my router? I've had the same router (D-Link DSL) with the same config for a few years and never had that happen... can the be infected?!
- icebraining 10y agoHow do you know your laptop is being portscanned?
- mbrookes 10y agoSymantec Endpoint Protection has portscan detection & blocking, but this is a managed instance on a corporate laptop, so I don't have access to the logs to drill in to what was intercepted. Having traffic from the router blocked was a PITA though!
- k_sze 10y agoAnd that's why I'd rather build my own security camera using an RPi and its infrared camera module. I can even make it weather-resistant by picking/3D-printing the correct enclosure.
- draw_down 10y agoReminds me of Windows XP!
- kdragon 10y agoSo I'm in the business of wheeling and dealing in these things. It's common knowledge in the industry that all of these devices likely have government backdoors or (likely deliberate) critical security flaws at any moment. Virtually all CCTV hardware comes from ruthless and unregulated Chinese markets where the goal is to obfuscate the price (and source) as much as possible, to prevent price discovery by the end user and allow 2-4x markups on the equipment by the integrator. Usually these manufacturers will sell to separate companies for their name brand, off-brand, and offer custom branding to distributors. Due to the obfuscstion of manufacturing source, and at the same time a desire to "stand out" amonst the rest, the industry is rife with knockoffs, third-shift products, stolen technology, unauthorized distribution, you name it. As an example: Every single Hikvision camera on amazon.com is an illegal sale and void of any official support from Hikvision. Go ahead and try to call them with a serial number for a product you bought on amazon and see what happens. It doesn't matter that the company selling the product on amazon is also named Hikvision (its an imposter). Point being, the surveillance camera market is so rife with corruption that you generally accept that everything is compromised. But none of it matters, because as long as the features work and the equipment is reliable, you simply throw it all behind an isolated network and call it a day.