17 ms·
Triple Flaw in Nest's Dropcam
- eridius 10y agoI know this is the original title, but it's kind of misleading. I clicked this article thinking that somehow the vulnerability literally opened your door to burglars (e.g. if you have a smart door lock).
- StavrosK 10y agoYeah, less "opens the door" and more "stops the cameras from recording, maybe".
- mschuster91 10y agoIf I were a burglar and would see Nest or other smart-home stuff in the Bluetooth device list... well here's someone who fancies technology and might be worth a try. To make stuff even better: forcing the Dropcam to disassociate with the owner's wifi network and reassociate with my own? Take a RPi, a 3G dongle, a battery pack and throw it into a nearby bush... perfect to stalk out when the home owners are not there, and thanks to the 3g connectivity no one will even have to look around and arouse suspicion with neighbors.
- kasey_junk 10y agoActually if you were a burglar you'd likely be a teenager out for the thrills or a drug addict and the most you'd do is see if anyone or a dog was home before kicking in the door. Burglary rates have cratered not because of security systems but because people don't have things that are easy to trade for cash. Unless it's jewelry, cash or guns it has virtually no value sold hot.
- scurvy 10y agoStolen documents are a goldmine to identity thieves.
- edoceo 10y agoEasier ways than a B&E
- scurvy 10y agoDepends on whose documents you're after
- tedunangst 10y agoWhat percentage of identity theft is the result of burgled documents?
- redtexture 10y agoThe lost credit card number, whether from a wallet or a web site.
- scurvy 10y agoNot sure, but a stolen (some say give away by disgruntled postal carrier) USPS key was used to break into dozens of mailboxes in a very affluent zip code in San Francisco (Nob Hill and Russian Hill). It must have been very lucrative for the pair of thieves. Also scary that a single key works across an entire zip code.
- xj9 10y agobeing a drug addict isn't mutually exclusive with having other skills. I wouldn't have been above something like this if my salary (software engineer) hadn't been able to cover my habits.
- kasey_junk 10y agoGranted. This wasn't a commentary on who is likely to have the skills, it was a commentary on the value of time. If you can pull of electronic surveillance you can make a lot more money doing that than B&E's.
- M_Grey 10y agoTeenager and "person who would hack your security camera" strikes me as having lots of overlap.
- Buge 10y agoI don't know much about Nests, but does simply being on the same wifi allow you to see what the camera sees? I thought they uploaded stuff to the cloud (I assume over https) so you would have to compromise the cloud account to see anything.
- mdani 10y agoI have a Nest camera. You're right, being in same VLAN does not give you access to video feed (at least via http). You need to view it online from their cloud.
- robryk 10y agoCan you check if it is uploading a fixed or variable bitrate video? (Ie. does the bitrate change if there's no activity within the camera's FOV?)
- toomuchtodo 10y agoYes, the bit rate changes based on how much motion is in the cameras field of view. It maxes out at about 1.5Mbps (1080p high motion)
- angry_octet 10y agoSomehow having to access it from a Nest server, and hence have it be copied by Nest, does not inspire confidence. I'd be much more worried about someone looking at me via Nest than a burglar subverting my Nest camera.
- dmourati 10y agoI think it was a pun.
- vogt 10y agoI own several dropcams but don't understand most of the language in this article - are there any precautions I should be taking that I may not be already?
- eridius 10y agoIt sounds like all you can do is wait for an update to be released and install it once it is.
- deleted 10y ago[deleted]
- ChuckMcM 10y agoAdd some security cameras that do local storage. Which is of course completely counter to the 'win' of cloud based video storage. The bug is that a sophisticated burglar can cause your cameras to stop recording.
- pfarnsworth 10y agoMost burglars don't care about alarms or cameras. They wear a mask, go to the back door between 11am and 3pm when most people are gone, kick it in, rummage for anything for 3 mins and then run away. It's very low probability of catching criminals with a simple workflow like this.
- otterley 10y agoDoes this statement come from statistics? If so, can you cite the study, please?
- pfarnsworth 10y agoFeel free to google it for yourself if you're interested.
- coldcode 10y agoThe first two are simply embarrassing. Google paid 3 Billion for this stuff? Does anyone do QA any more? Especially for a device you use for a security purpose, you'd think bugs like this would be not only found, but designed to not happen in the first place.
- stevenwoo 10y agoI live near the Nest main office on Foothill Expressway. There used to be a signficant amount of cars there on the weekends. That is no longer true.
- yuhong 10y agoThis reminds me of these Twitter threads: https://twitter.com/yuhong2/status/829072680389267456 https://twitter.com/yuhong2/status/829072680389267456 https://twitter.com/yuhong2/status/832053404553744385 https://twitter.com/yuhong2/status/832053404553744385 https://twitter.com/yuhong2/status/844049570640285696 https://twitter.com/yuhong2/status/844049570640285696 (Ryan Hurst joined Google around the time they split Nest into Alphabet)
- tblair 10y agoI know you're implying that they don't care anymore, but I think over-working leads to fatigue and rush jobs/corner cutting, which is a great way to end up with security flaws.
- bitmapbrother 10y agoThat's because Tony Fadell made them work on the weekends. If you're forcing your employees to work on the weekends, on a regular basis, then something is very wrong - which probably explains why he's no longer at Nest.
- icantdrive55 10y agoThe money being thrown around is amazing. I remember the president of Honeywell was interviewed. I belive about the buyout of Nest? He said something like, 'They could have bought our company for this amount?' He was truely stunned. It was that look of true amazement. Personally, the one that still sticks with me is the sale of Beats Headphones. I don't even want to look it up, but I couldn't figure out why anyone would pay so much. There's probally something I'm missing? Initially I thought they were trying to capture a new market/demographics, but really don't have a clue.
- xutopia 10y agoAm I really supposed to be scared of a burglar who has the skills to hack a security system though? If he has those skills maybe he can find a good paying job easily enough.
- deleted 10y ago[deleted]
- detaro 10y agoYou'd think that with malware also, and that has turned into a business model by now: the people writing the code often are not the ones using it, selling exploitkits instead. Even offering it as SaaS or subscriptions nowadays. Not sure if disabling Nest cameras is interesting enough, but there could be a black-market business somewhere in interrupting IoT devices. (E.g. sell an android phone preloaded with an app to unlock remote controlled locks)
- closeparen 10y agoYep. I remember reading that sophisticated car remote entry hacks were encapsulated in little mircrocontroller-based push-and-go boxes and sold via the criminal underworld to people who would actually be willing to take the risk of using them.
- tonmoy 10y agoOr just make an app that can disable nest cams with some ads in it
- pfarnsworth 10y agoI'm sure it will be productized into a simple Cydia app that can be bought and used instantly.
- patwolf 10y agoWhat amazes me is that the vulnerabilities have been known for many months yet haven't been patched. Maybe I shouldn't be too surprised. I bought a Dropcam two years ago before Nest/Google acquired them. It worked fine for a while, but since being acquired the app and reliability has gotten worse and worse to the point that I no longer use it because it's too flaky. Based on that and everything else I read about the company, it seems that they're severely mismanaged.
- seanp2k2 10y agoNest hasn't done anything significant since the smoke alarm. I'm really not sure how their leadership maintains employment. They launched that in October 2013. What company can go for 3 1/2 years, 3 of those with Google money, and do so little? There are tons of opportunities for them to launch e.g. A real home security system with window sensors, locks, a 24x7 monitoring service, more smart home devices / integrations... The smoke alarm wasn't even a good idea. A smoke alarm is a device you hope to never have to use. It's like making a smart fire extinguisher, or a AED with Siri integration. Really unimpressed with Nest as a company.
- detaro 10y ago> The smoke alarm wasn't even a good idea. A smoke alarm is a device you hope to never have to use. Why does that make a smoke alarm a bad idea as a product?
- dawnerd 10y agoTo add to what you said, you should be using your alarms regularly to make sure they still work...
- tacomonstrous 10y agoMy Nest smoke alarm actually justified its value a couple of weeks ago: We were out in town when it let me know that there was CO in the house. We were able to rush back and turn off the leaking gas stove before things got out of hand. I think the peace of mind that this now gives me is extremely valuable.
- kartan 10y agoThis kind of cameras are just to scare non-sophisticated burglars. Alarm systems work on the premise that burglars will decide to choose another target as the "protected" one is slightly more inconvenient to rob. It is really hard to stop a highly motivated thief. That doesn't justify the camera flaws, thou.
- bbcbasic 10y agoYes it's a pretty sophisticated burger that jams wifi and Bluetooth
- seanp2k2 10y agoOr cuts the power / cable line with the same bolt cutters they use to cut locks.
- heartbreak 10y agoI'd encourage any burglar who wants to cut my mains with bolt cutters to do so at any time.
- asafira 10y agoSuffice it to say, I'm guessing NY's Museum of Modern Art doesn't use Dropcam. =)
- caleblloyd 10y agoGuess what the burglar could also cut the cable line coming into the house to completely disable the internet. Works on every DIY camera with no local storage that only uses home networking.
- koolba 10y agoThat'd also cut off 911 service for VOIP landlines and possibly cell phones with wifi calling enabled.
- throwaway91111 10y agoOn T-Mobile at least, I've never been unable to call when my internet connection between router and internet is bad but I'm connected fine to the wifi.
- DrScump 10y agoIf your cell phone is disconnected from Wifi, wouldn't it just place the 911 call via the cellular radio(s)?
- koolba 10y agoWifi would be connected. Underlying internet would be dead. So your cell would try to route through the Internet (via the wifi) to no avail. Try it if you have wifi calling enabled. Just pull the plug on the router and see how long it takes your cell to disable wifi calling.
- richardwhiuk 10y agoEmergency calls normally default to cellular, instead of defaulting to WiFi, as it provides more consistent location information. Even if it tries wifi first, it should fallback to cellular within 30 seconds if a call attempt is made.
- koolba 10y ago
- 27182818284 10y ago>buffer overflow in the camera I'm pretty ignorant in the embedded/hardware area of tech, but I would have guessed by now C or other buffer-overrun-prone languages would have been replaced by the majority of companies making new-ish products. Is something like managed C# not an option still despite hardware gains? Or, I keep hearing about Rust on Hacker News as a possible fix to this. Is it a problem with the education pipeline, like students learn that devices like this need C so they code C for them out of school?
- seanp2k2 10y agoAhahahahahaha, that would assume anyone actually learns from decades of industry mistakes. They do not. Most micro-controllers still use C and the vendor applications are only "secure" in that no one has poked around for a few minutes to discover the numerous security holes. Every year at Defcon, there are at least a few presentations about striking security flaws in security devices or IoT gear.
- dreamcompiler 10y agoI suspect it has to do with not only the availability of Rust compilers for embedded microcontrollers, but also Rust IDEs for them. Embedded IDEs tend to be heavily C-centric and have been for decades. Much infrastructure will have to be redone for this to change.
- tedunangst 10y agoDid you try to use rust in 2013?
- deleted 10y ago[deleted]
- pjmlp 10y agoPascal, Ada, Oberon, Basic compilers have existed for micro-controllers for decades. Even C++ would be a better option, given its improved type safety over plain C. However the culture in embedded systems industry makes it very hard to use anything else besides Assembly and C. As an example, I recently saw talks that some BMW and Sony units only now in 2017 are moving away from C into C++11.
- Thriptic 10y agoDoes anyone have recommendations for IP cameras that (in theory) are relatively secure?
- kawsper 10y agoI bought a Ubiquiti Micro[0] camera, and sat up a local server that runs their NVR software, that saves the recordings and controls the cameras. It was important to me not to get a cloud enabled camera. Sadly they are out of stock most places, but a new version have been rumoured. [0] https://www.ubnt.com/unifi-video/unifi-video-camera-micro/ https://www.ubnt.com/unifi-video/unifi-video-camera-micro/
- Johnny555 10y agoI can second the Unifi cameras if you don't mind setting up a server to monitor them. I'm using their outdoor cameras to watch my front/back doors at home, and I have about a dozen of the dome cameras at work. The NVR software has been working flawlessly in both places. I was less impressed with the image quality of the Micro camera, it's adequate, but the Nest cam is better.
- zaroth 10y agoI think your only chance is buying a USB camera and connecting it to your own local storage. "IP Camera" almost certainly means insecure camera.
- starky 10y agoPretty much all the larger non-Chinese companies sell pretty secure cameras. The safest way to use IP cameras is to isolate them so they aren't connected to the internet. IPVM also keeps a public up to date list on known vulnerabilities[1] [1] https://ipvm.com/reports/security-exploits#post_111311 https://ipvm.com/reports/security-exploits#post_111311
- angry_octet 10y agoRe-purpose one of your older unused android phones. WardenCam is pretty good, can upload snapshots to google drive etc (create a google account specific to the phone(s) so you are not leaving a phone logged into you main account sitting around).
- intern4tional 10y agoIMO only the last of the three flaws is something that would be practically exploitable by a burglar. The rest, while poor coding practices and do illustrate some flaws with the system are not likely that a burglar would exploit. This is FUD causing article.
- iampims 10y agoLeaving a Bluetooth service available, visible and unauthenticated seems to be the crux of the issue.
- deleted 10y ago[deleted]
- mavhc 10y agoOn the other hand no one's remotely hacked the Nest Thermostat, so their own code was fine, dangers of acquiring code and then not auditing it. Seeing as you could just jam all wifi anyway, not that great a problem
- tyingq 10y agoTrue, but this does show a buffer overflow, which is one path to get to a remote hack. Well, remote as in wifi distance remote.
- mavhc 10y agoBut dropcam is a company they acquired, I'm guessing they didn't rewrite all the software. The stuff they wrote themselves for the thermostat is apparently more secure than at least 99% of things.
- mancerayder 10y agoThe first vulnerability involves using the camera’s Bluetooth Low Energy (BLE) – always on by default – and pinging Wi-Fi SSID with a really long parameter. This causes a buffer overflow in the camera and prompts the device to crash and reboot. The second vulnerability also involves a buffer overflow crash, but this time caused by an overly long Wi-Fi password. If a burglar can do that, he can definitely make better money elsewhere. His burgling career can officially be retired. Because the smart camera has no offline footage storage capabilities, this attack would give a burglar a window of opportunity to sneak into the house. Considering the attack could be repeated indefinitely, the burglar would have a lot more than 90 seconds to move about the house, without fear of being recorded. Technical aspects aside, the scenarios painted in the article are almost comically far-fetched. In 2017, a spy scenario might even be less so.
- edejong 10y agoAs the exploit for this vulnerability is at (below?) beginner script-kiddie level, it is not far-fetched for a more sophisticated burglar. Every lock's life ends with someone uttering the words: "I never thought they would do that."
- shagie 10y ago> If a burglar can do that, he can definitely make better money elsewhere. His burgling career can officially be retired. True. Such as making $100 "nest cam defeaters" that are battery powered and backed by a raspberry pi zero or something similar. This also goes to the question of "what is being protected?" Its one thing to burgle a house and get a few thousand worth of jewelry and electronics. Its another thing for a local small museum that doesn't have the budget for a good security camera system.
- Johnny555 10y agoIf a museum with anything of value is using Wifi cameras, then they are incompetent and the camera is likely not the worst of their flaws. Wifi disassociation attacks affect every Wifi camera.
- timdierks 10y agoNest cameras work over WiFi (as far as I know). Presumably you can defeat them with a spark gap or a microwave you've jimmied to run with the door open. Vulnerabilities against technical hackers sending hand-crafted artisanal Bluetooth packets are laughably irrelevant.
- bigiain 10y agoOr a hoodie and a ski mask... Like crooks have been doing since the invention of videotape...
- angry_octet 10y agoA spark gap (aka noise jammer) is laughably broad and would also cause interference with everyone in the neighbourhood. But a frequency selective Wifi noise jammer is very effective, especially if aimed at the base station with a directional antenna. I wouldn't recommend disassembling a microwave oven to get at its magnetron, because you will probably electrocute yourself at best, and if you manage to turn it on (e.g. by jamming the door closed sensors), literally cooking your eyeballs.
- bigiain 10y agoI have a cheapo Chinese 2.4GHz video transmitter which quite effectively jams 2.4GHz wifi for hundreds of feet in every direction (as my neighbours let me know...) I've got a friend who claims you can force a DJI drone to autoland from well over 1km with some microwave oven guts duct taped to a satellite tv dish.
- derefr 10y ago> with some microwave oven guts duct taped to a satellite tv dish The word you're looking for is "maser."
- adrianratnapala 10y agoI think microwave ovens usually use mangetrons rather than masers: https://en.wikipedia.org/wiki/Cavity_magnetron https://en.wikipedia.org/wiki/Cavity_magnetron It's true though that both of them are coherent microwave sources. And the magnetron is arguabbly more "laser-like" than a maser.
- evan_ 10y agoSomeone should package this exploit in an iPhone app and market it as an anti-peeping product for Airbnb customers.
- TazeTSchnitzel 10y ago> “the smart camera has no offline footage storage capabilities” How on earth did this get approved to go to market? A security camera that can't record when the internet goes down!
- 762236 10y agoPerhaps because it would become a significantly more expensive product?
- srssays 10y agoYou can store hours of video on an SD card.
- gnicholas 10y agoyep, and although thieves could steal the SD cards, it wouldn't be hard for Google to make the system redundant, so that if the internet goes down, each cam sends its motion-activated footage to all the other local cams, for storage on the SD cards. That way, the thieves have to physically access all of the cameras in order to remove the SD cards.
- TazeTSchnitzel 10y agoWould it? It doesn't need to store all the footage offline, just enough to tolerate a lost internet connection for a little while.
- Spooky23 10y agoThe focus was on developing a service based business model, common sense be damned.
- ajross 10y agoEven more cynical: the focus was on making a buck selling a security theater product to the paranoid and gadget-obsessed, not to produce a product focused on providing prosecution evidence. I mean seriously: cloud storage of the video may not be "secure", but it's undeniably cool and provides the visceral feedback that the marks want. It doesn't have to be actually useful to have value to its subscribers. People who are actually worried about break-ins just buy safes and insurance policies. Or move. This is for the nuts.
- TACIXAT 10y agoIs the main use case for these security? I've been considering getting some. I mainly want to watch my dogs and see how they're doing when I'm out. My dogs can't buffer overflow so I think I'm still OK to purchase.
- greedo 10y agoAnd in a follow up article, it was discovered that burglars could disable a Nest Cam by using an aerosol deployed enamel compound that occluded its lens. Press officials for Rustoleum were unavailable for comment.