10 ms·
Romanian Hackers Infiltrated 65% of DC Outdoor Surveillance Cameras
- deleted 9y ago[deleted]
- sorinn 9y agoHacking aside, it's great to see the perfect diversity score: 50% male/female. Silicon Valley should take note.
- announcerman 9y agoThis is what makes me skeptical of the diversity movements in America. In Romania and even Russia it seems women are very well represented in tech and there are no movements there. It seems to me that these movements are mostly used for political maneuvering and are not helpful at all.
- pm90 9y agoEh, what? Russia still faces a lot of violence and discrimination against women: http://www.bbc.com/news/world-europe-21474931 http://www.bbc.com/news/world-europe-21474931. I'm not sure for the increased participation of women in tech though. Maybe better education? Maybe less of a "computer lovers are all nerds" culture? I honestly don't know.
- g09980 9y agoAs someone from Eastern Europe, all of the women (three generations) in my family are/were in scientific/engineering roles and it didn't seem like a big deal 30 years ago or now. It was just the way things are. I have an aunt who knows COBOL. Not being familiar enough with history of this in US/Silicon Valley, want to ask: were things always "unequal", or did things go wrong somewhere along the way?
- pavel_lishin 9y agoSame here - my grandmother was a programmer, and my mother was an electrical engineer.
- virgilp 9y agoI'm from Romania. The general balance is pretty far from 50/50, and there are some not-so-nice jokes about women in CS (e.g. "mamma had 2 girls; one was smart & beautiful, the other one went on to study computer science"). Still, from what I saw (I work in a US company) - I suspect it's far better than US, and maybe even western europe[1]. There's no expectation that if you're a girl you must suck at math (or science/engineering in general), and in general I'd say programmers want/ like to have girls around. But it's still a fairly masculine environment, with some fair level of "bro" culture, so it must be somewhat tougher for a girl. It's double-edged though... the US "positive discrimination" culture is making inroads here, so on some aspects it's easier to be a girl in tech (I suspect it's actually easier to get a job compared to an equally-qualified guy). The thing is - positive discrimination doesn't solve the problem, because it comes from school. You need to encourage girls to take science classes - it has to be expected of them that they do so (rather than go towards, e.g., humanities). That, I don't think is actively happening in the US or even some parts of western europe.... by the time you're dealing with graduates, it's already too late to fix the gender-imbalance problem. [1] My little daughter's godfathers are German (she grew up in Romania, but he didn't). She told me that among german women, it's a thing of pride to be bad at math. And that her daughter was praised in school that "you're pretty good, for a girl". With that sort of attitudes during childhood... it's bound to be hard to get gender balance later (that "praise" would be perceived as insult here)
- simion314 9y agoAt my University in Timisoara Romania, in my class in pure Mathematics 75% were women, I think the men were attracted more to the computer engineering at the other university but I do not have numbers, anyway girls still loved Math when I was at university 15 years ago
- rdtsc 9y ago> There's no expectation that if you're a girl you must suck at math (or science/engineering in general), When I was going to school girls were usually better at math. I remember getting help from them with some calculus problems. My CS teacher in high school was a woman as well and before teaching she worked as a programmer. She was a great role model for girls I'd imagine. Well she was a great role model for me too because she was a great teacher.
- ccrmalite 9y agoThere is a big movement in the US! Many organizations akin to girlswhocode.com. However, with the right wing in control right now, there's a real effort to suppress the legitimacy of that movement.
- deleted 9y ago[deleted]
- pavel_lishin 9y agoWhat it says to me is that women are just as capable of men in the engineering fields, and America has a unique problem that keeps women out here. So yes, it makes sense to have a movement for diversity here, because something is pushing women out of these fields, so we have to push back.
- deleted 9y ago[deleted]
- willvarfar 9y agoIn Eastern Europe women in engineering has tradition. Its all about role models and social norms. Here's a recent article about it: http://www.bbc.com/news/business-39579321 http://www.bbc.com/news/business-39579321 In the west, the woman is traditionally the housewife.
- nnq 9y agoIt's also a side-effect of the "communist cultural heritage"... Engineers were quite respected in communist societies (at least in EE & Rusia), and women were also welcomed/forced to join the industrial workforce (because industry was inefficient and required tons of labor). Hence, a smart woman wanting high social status kind of had two options: become an engineer or a doctor. First option was easier and also less painful (doctors were also subjected to nasty shit like having to relocate to unpleasant places without choice because there was a demand for their services there, some areas like surgery were also much less women friendly etc.). Also, dunno about Rusia, but in Eastern Europe, even now, there is a good "girls in math" story. Maybe less in physics or computer-science, but in pure and applied math there's lots of girls. Probably most of the smart ones jump ship more towards finance than tech though, when they realize they can't really get a nice paying job with a math degree alone.
- pcf 9y agoI'm gonna assume this Eveline Cismaru is not the hacker mentioned in the article: https://www.starnow.co.uk/evelinecismaru https://www.starnow.co.uk/evelinecismaru
- dang 9y agoPlease don't do this here.
- wybiral 9y agoDVR devices are insane. I do regular surveys of random IP addresses and find these devices everywhere. They're easily identified by the headers that the embedded servers respond with. Typically they're cheap devices from China using the same tech just with slightly different branding. They usually have default passwords like admin:admin that users aren't required to change and often have vulnerabilities that grant access to the rest of the network. And people expose the ports for these things to the entire internet. Maybe people just assume nobody will happen upon their IP address? The irony, of course, is that people install these for security. Remember when wifi devices rarely had passwords and you could use your neighbors internet? What caused the change to the modern practice of unique strong passwords by default? Was it consumer driven or was there some other factors? Whatever happened, we need that for IoT devices too.
- deleted 9y ago[deleted]
- johncolanduoni 9y agoA big factor might have been ISP-provided routers coming with random passwords printed on the underside of the router instead of uniform defaults. The same tactic would work with many IoT devices but the incentive isn't there.
- wybiral 9y agoWhat incentive pushed the manufacturers of those routers in that direction though?
- johncolanduoni 9y agoI suspect it was the ISPs who made the decision, not the manufacturers. Removing the common excuse of "my network is open, who knows who did it!" for torrenting may be the reason. Another could be to make open/easily accessible networks rarer as they started selling Wi-Fi via the provided routers.
- 3pt14159 9y agoWhen I was an irresponsible high school grey hat (2001) I was part of a small group of people that shared exploits. We weren't that talented, but one of the guys in our group was still able to get into the cameras in the parking lot of the CIA. This is the problem with cyber security: Even if you're the most knowledgeable organization on earth you still fuck it up. Any one person can fuck up any one thing and if it isn't part of your predetermined threat vector analysis then it gets through and you lose everything. The guy took steps to hide his identity then reported it to the CIA. They emailed back with a job offer. Back then we assumed it was trap to get him to travel to the USA from Canada, but these days, based on what I've seen, I think it was legitimate. Sometimes I like to let thoughts simmer: In 2001 a shitty high school hacker had a reasonably credible offer from the CIA.
- draugadrotten 9y ago> . We weren't that talented, but one of the guys in our group was still able to get into the cameras in the parking lot of the CIA. Well, by now, 16 years later perhaps you will have learned about the concept of honeypots.
- d33 9y agoHow do you imagine a camera honeypot at the CIA parking lot? They'd still be leaking a lot of information if the image was true.
- chrisper 9y agoI think he meant the job offer.
- TeMPOraL 9y agoDid they go there in person and verify it's an actual CIA parking lot?
- 3pt14159 9y agoIIRC, which isn’t garunteed due to the years involved, it was on an IP that when he did a reverse lookup for others on the subnet associated with a cia.gov subdomain or something like that. Plus it just looked American. But we could have misinterpreted it. And it could have just been a recruiting tool or honey pot. I get lost in forests of mirrors.
- amigoingtodie 9y agoIt is 65% of outdoor cameras operated by the DC city police, not 65% of all outdoor cameras in DC. That would have been impressive, Person of Interest style.
- juiyout 9y agoYes 65% is a soundbite. Cameras are notoriously easy to break into. I would venture to say those 123 cameras has the same manufacturer and share the same reset instruction.
- bhk 9y agoA false soundbite. The first sentence of the article has more detail but is still false. Then the second sentence of the article contradicts the first sentence, adding the phrase "of the DC city police". Shall we believe that version?
- brk 9y agoCyber security issues are only recently becoming a point of awareness in the surveillance industry. Some manufacturers have hard-coded backdoors/authentication bypasses, any vulnerable devices spread across the US, and the rest of the world. Here is an example of one vulnerability from one larger manufacturer (Hikvision): https://ipvm.com/reports/hik-hack-map https://ipvm.com/reports/hik-hack-map
- ausjke 9y agoToo many cameras exploits in the wild these days indeed. Need a OSS system for the cameras, just like OSS firmware such as Openwrt to replace vendor firmwares. Camera itself does not have enough resource to deal with DDOS or brutal-force attach or updating-with-CVE-quickly if they'are exposed to the public internet _directly_, they should sit behind some firewall. I hope those important cameras, or privacy-concerned cameras, are at least not installed with a public IP, not sure if that is true though, otherwise more exploits will keep coming.
- paulie_a 9y agoDoesn't open wrt have a pretty shoddy security track record
- ausjke 9y agoany source? openwrt can't fix kernel security bugs, or OpenSSL issues, but it can provide a fast fix after those exploits are announced at least. i have not hearded wide spread problem with openwrt yet.
- fencepost 9y agoThat may be based on vendor implementations - I think there are a bunch of consumer routers or there that are based on reskinned old versions of OpenWRT.
- ausjke 9y agoyes the key is OSS openwrt instead of vendor-specific openwrt, which is normally lagging behind still, probably slightly better than closed vendor firmware, but not that much better. true OSS openwrt has the fastest updates and security fixes, and it's solid.
- nottorp 9y agoAre there any actually secure ip cameras? Somehow I don't think this is a badge of honor for the "romanian hackers". They probably just scanned for default passwords and known vulnerabilities.
- deleted 9y ago[deleted]
- gumby 9y agoMuch kudos to submitter for using the text-only cnn.io version. Instead of loading a megabyte of executable crud, moving images etc for three paragraphs of text I got...three paragraphs of text!
- QAPereo 9y agoThanks, but all credit goes back to HN for turning me onto cnn.io in the first place.
- DarronWyke 9y agoI'd like to take this time to remind everyone of the Internet of Shit project: https://twitter.com/internetofshit https://twitter.com/internetofshit Welcome to the IoT age. It's not going to get better, only get worse.
- pavel_lishin 9y ago> They were traced through their registered email addresses, one of which roughly translates into "selling souls" in Romanian, according to the affidavit. I wonder if it's a reference to Dead Souls (https://en.wikipedia.org/wiki/Dead_Souls https://en.wikipedia.org/wiki/Dead_Souls).