11 ms·

When baby monitors fail to be smart

46 points by kushti 9y ago

stuaxo 9y ago
Haven't RTFA yet, but read a lot of internet of shit. When I bought a baby monitor I made sure it was dumb, because why would I trust some random company with data from a camera in my house?
- book_mentioned 9y ago
  Are there any thoroughly documented examples demonstrating use of an RTL-SDR to view these wireless cameras?
  - lathiat 9y ago
    I was literally about to say.. sometimes the dumb ones are actually worse as many of them are transmitting the sound and video over the air with no encryption either :) I imagine probably 99% of them are but I don't have any research to actually back that up.
    - Xylakant 9y ago
      Many use the DECT Standard that was developed for mobile handsets. It’s not high security, but it’s also not plain text. They’re also not networked, so an adversary would have to get into range, making a potential attack much more complicated. It certainly won’t defend you from a targeted attack, but it will keep $random_person_on_the_internet reliably away and I don’t have to rely on $companies server/network security.
      - lathiat 9y ago
        Well thats comforting :)
        kurthr 9y ago
        Exactly... there are many things for which not being connected to the 'net increase security a lot. You decrease the pool of crazies and crooks. However, once a stalker is interested in spying on your house... physical proximity isn't so much of a barrier. "We begin by coveting what we see every day... Clarice"
        Xylakant 9y ago
        I live on the fourth floor and the reception from my (audio only unidirectional) baby monitor doesn’t reach to the ground floor. So the stalker would need to be in one of the adjacent flats. Not an insurmountable barrier, but one that I feel comfortable with, since all I need protecting is baby babble.
        danielvf 9y ago
        Or just a better antenna. :)
        Xylakant 9y ago
        Maybe. It’s still just baby babble.
        crpatino 9y ago
        If you have reason to believe people that know about anthennas are after you, why have you not rig a Faraday cage in your home frame already???
    - dragonwriter 9y ago
      > I was literally about to say.. sometimes the dumb ones are actually worse as many of them are transmitting the sound and video over the air with no encryption either Many of the smart ones both broadcast like the dumb ones and, separately, send a signal on wifi to a central server for online viewing, so they fully incorporate the problems of the dumb ones.
      - shaftoe 9y ago
        This is a common problem in areas with multiple new parents: turning on your video baby monitor and watching your neighbor's cam.
    - Klathmon 9y ago
      This is why I went with an IoT network in my house, that doesn't have access to the outside world (ingress or egress) except through a carefully controlled firewall. And as of right now, the only 2 things that go through that firewall are the nest thermostat (yeah, it's pretty and hasn't given me any trouble, so i'm happy with the tradeoff here), and the google homes (again, another tradeoff myself and my family are comfortable making). Everything else is on that network without access to the "internet" directly, with WPA2 encryption for protection against local eavesdropping, and pushed through an open-source home-automation controller called "Home Assistant" running on an intel NUC served up over HTTPS to our devices. I don't have any baby monitors yet (no babies!) but we do have cameras and with this system they work great and I sleep pretty well at night knowing it's all secure enough that i'm happy buying cheap devices knowing the security is garbage.
      - Xylakant 9y ago
        The problem with these devices is that they want to communicate via a vendors server, so a firewalled network will certainly improve security, but will massively reduce usability.
        Klathmon 9y ago
        Sometimes, but often the only proprietary part of these things is the app they want you to use. Most of them will output standard formats and streams that you can hook into in my experience (but i might be inadvertently selecting for those)
        Xylakant 9y ago
        If I understood the article correctly, the devices that this article mentions communicate exclusively via the vendors server.
        tinymollusk 9y ago
        I wonder if a proxy device with some smarts regarding data transmission patterns (learned from when a device is newly added to the network) could provide some security. Get a new device, plug it in to a locked-down network that passes all packets through a deep packet inspector connected to some ML. Add in proxy features so if the vendor turns off their service, your personal network MitM can mimic the server on the other side. I doubt this is feasible due to the fact that consumers clearly value "it just works" (implying simplicity/less security) over secure/private. (And probably a bunch of other factors I'm not thinking of.)
    - deleted 9y ago
      [deleted]
  - taneq 9y ago
    https://duckduckgo.com/?q=baby+monitor+video+hacked https://duckduckgo.com/?q=baby+monitor+video+hacked
  - jandrese 9y ago
    I didn't document it, but the baby monitor we used just transmitted raw FM audio at ~900Mhz. You could listen to it with SDR# no problem. It wasn't one of those fancy video kinds though, just an old fashioned audio only monitor. https://www.amazon.com/Sony-BabyCall-Receivers-Discontinued-Manufacturer/dp/B0017T2RYU https://www.amazon.com/Sony-BabyCall-Receivers-Discontinued-...
- nugi 9y ago
  As a kid, i used to use my ancient portable phone to walk down the street and tune into other phones, and baby monitors. I remember one mother always singing itailian sounding songs to quiet her child and found it touching. Then I realized I was basically peering in to the private lives of those around me to a weird level. Things later went digital, more consumer spectrum opened up, and these 'hacks' largely stopped working. I had moved on to computers by that time.
_pmf_ 9y ago
A baby monitor having accessible UART ports on the board has the same security implications as a PC having a CD-ROM drive. Actually, considerably less.
- sokoloff 9y ago
  Agreed on a stand-alone basis, but couple that with client certificate based auth and all client certificates being the same worldwide, and it makes the UART a convenient step in the chain of attack. (Agree that the problem isn’t the UART pads though.)
thinkMOAR 9y ago
So how does this differ from other camera security concerns/complaints that get posted regularly? Because its called a baby monitor?
- a2tech 9y ago
  The security on this is actually a lot better than most cameras--all the traffic is SSL using trusted client certs. To get into the traffic they had to tear the device apart and extract the cert. After that they could MITM the traffic between the camera and the remote server and observe some bad security. Unfortunately they also published the extracted certificate on their blog which is not cool.
  - matthberg 9y ago
    They unfortunately did not have to tear the device apart and extract the cert, they state that each device uses the same one, valid until 2038, which was exposed in a previous exploit (and was likely previously available online as a result). Though it was definitely a bad idea to post it again on their site.
JeanMarcS 9y ago
> trading privacy for convenience That’s the important sentence to me. That’s where we all gone wrong in my opinion.
kwhitefoot 9y ago
Just don't use a baby monitor.
- gumby 9y ago
  this comment could come off as flip, but it's an important one. Sure: baby monitor security is important too: if you can get it right for a baby monitor you've probably got the framework (technical, social, regulatory, etc) to get it right for a bunch of other things. But are baby monitors themselves solving a problem or causing one? The alternative is to either have the baby in the room with you (distracting: they're like a campfire!) while you do your chores or talk to your visitor or whatnot, or learn to be able to be in another room from your baby. Sounds luddite, but it helps lay the foundation for a healthy, non-helicoptering relationship with your kid and doesn't slip tolerance for pervasive surveillance into your home.
  - untog 9y ago
    > it helps lay the foundation for a healthy, non-helicoptering relationship with your kid I think that's a pretty big exaggeration. "helicopter parenting" usually characterises parents who refuse to/cannot step back from their child's life and let them make decisions on their own. A sleeping newborn child cannot make decision on it's own - the only acceptable form of parenting is helicopter parenting when your child isn't capable of doing anything for itself! Sudden Infant Death Syndrome exists. You can hardly blame people for wanting to protect their child from it.
    - xkcd-sucks 9y ago
      Can a "sudden death syndrome" actually be reversed, or does monitoring just provide better estimates of death time?
      - EADGBE 9y ago
        Our first daughter stopped breathing, turned purple and didn't come-to for what seemed like an eternity. I can't imagine what would have happened if she was alone during this time. She was alert when the paramedics showed up, but the subsequent tests at the hospital proved nothing. The cardiologist, nurses, and other doctors all seemed to agree that it was "nearly a SIDS thing" and that we just got lucky. After that night, and for every night since (2 more kids since then) we've used a breathing monitor. Occasionally I've noticed the kids will go in a "deep sleep", and the monitor will go off a few times during the night, you'll have to reposition them; they'll wince (in their sleep) and carry on. If that's what it takes, then that's what it takes. From my research after that event, it seems like SIDS is all-encompassing, and the amount of time allowed for an infant to slip into death may play a factor in it's "suddeness".
tzs 9y ago
What are some good solutions to authentication for IoT devices? There's nothing wrong in principle with using a certificate (other than it being overly complicated...there's a reason we aren't all using client certificates to authenticate with our email server, Twitter, Facebook, etc). Just as there is nothing wrong in principle with using a user/password scheme. Both certificates and user/passwords suffer from the same serious problem: how do you change them on the device? If you don't have a way to change them, all someone has to do is learn the factory default and game over. (Even if you provide a way to change them there is the issue of how to make sure people actually change them, which is a whole other problem). IoT devices often do not have a good interface on the device itself that you could use to change a user/password (let alone enter a new certificate!). You could include Bluetooth in the device, and provide a configuration application that the user runs on their phone. If the device does not otherwise need Bluetooth that is going to raise the cost a little, and if the device does not otherwise need a mobile app making people get one just to set the thing up is going to seriously annoy many. What I would like to see is this: 1. Every IoT device (and every non-IoT device, for that matter, for reasons given below) should have at least one of: (A) A USB port that you can plug a thumb drive into, (B) A USB port that you can use to connect the device to a computer, or (C) some type of SD card port. I think that USB is cheap enough now that it would not cost much to add it. 2. If you plug a FAT or FAT32 formatted thumb drive or SD card into the device, it reads and applies configuration information from a file on the drive or card. There should be a convention established for the naming and location of configuration files so that multiple devices from multiple vendors can all have configuration files on the same drive. 3. If you plug the device into a computer via USB, the device shows up as a FAT or FAT32 formatted drive with its current configuration in files on that drive. You can edit them to change the configuration. 4. When you connect a thumb drive or insert an SD card and there is a "DOCS" directory on it, the device makes a subdirectory in that named after itself, and in that directory writes a copy of its user manual and other documentation. If there is a "LOGS" directory, it should do a similar thing, but with any logs it keeps. If there is an "INFO" directory, do a similar thing but with information about the device, such as model number, serial number, and other such stuff useful to have if you need to contact customer service. 5. This mechanism could also be used to provide firmware updates to the device. (#4 and #5 are why I want this everywhere, not just IoT). Another issue with IoT devices, once you have figured out how to change authentication information, is how to keep that safe? For instance, I'm making a motion detecting bird camera to take photos of the birds that stop by for the food I leave out. If I want it to use my home wifi to upload photos...it needs my home wifi credentials. But it will be outside. If someone steals it, they have my credentials! (I'm currently using a Raspberry Pi, so they could just steal the SD card...or if they came prepared they could just borrow it, copy it, and put it back, and I might not even find out about it). My current thoughts are to have the thing come up after boot offering its own wifi network. I can connect to that from my computer, and start the bird cam software, which can ask for my wifi credentials. It can then stop offering a wifi network and join mine, keeping the credentials only in RAM. Still vulnerable, but it would then take an attack more sophisticated than simply stealing it, or cloning the SD card.
kees99 9y ago
I have a problem with those two "vulnerabilities" listed: - Available Serial Interface (referring to easy-to-solder console port pads on PCB, accessible once you tear device apart); - Weak Default Credentials (referring to weak root password that is only ever accepted via serial console). Life-span of a baby monitor is couple of years, by definition. After that, this hardware could either become a cool easy-to-tinker Linux device, or e-waste. Researchers at sec-consult seem to think e-waste option is better, or at least it's a necessary evil to deter those pesky hackers who sneak near your child's crib, armed to their teeth with soldering irons and screwdrivers.
- ken 9y ago
  > Life-span of a baby monitor is couple of years, by definition. Unless you have more than one baby. Or friends/family with babies. My nephews are using products that weren't even new when I played with them, decades ago.
  - Waterluvian 9y ago
    I have a four year old monitor that's on baby #1 in my household. It's a dead simple device and just works. I overhwelmingly care about its reliability to work or tell me when it's not working and I'll easily sacrifice any hackability to achieve that. Ever have an infant crying for 45 mins because the monitor failed and you thought he was still sleeping? Really really upsetting.
  - EADGBE 9y ago
    Run-of-the-mill alarm-based (SIDS-reducing) baby monitor owner here. Originally bought in 2012, going strong on baby #3. Honestly, the static re-assures me it's still listening to my child. Probably similar reasons why the light switches in my home will remain analog. I need it to work 100% of the time. I can't trust a computer for that.
- Spooky23 9y ago
  This is typical infosec handwaving nonsense. People who have covert spy teams entering their home hacking serial interfaces on baby monitors probably shouldn't be buying this thing. The vendor in this case seems to have build a pretty decent solution considering the pricepoint and purpose. The only vulnerability here is the consumer vulnerability for buying something as trivial as a baby monitor that is dependent on some random consumer company's cloud service for a core function. It would be better to have a fallback to a multicast DNS service so it could function on the local network.
jasonmaydie 9y ago
why does a baby monitor have to go through the cloud? you aren't supposed to be more 0-50 feet from your baby.
- giobox 9y ago
  I suspect there’s a market for those parents who travel with work or are otherwise away from home for a time wanting to “drop in” and see the kid. Much the same logic as the market for indoor security cameras from Canary/Nest/Arlo et al, and those seem to sell well enough. I know several colleagues who use a Nest in this way, for families and pets.
ateesdalejr 9y ago
> it is possible to identify the following very weak 4-digit default credentials And we all know what the password is... "1234"

46 points by kushti 9y ago

Haven't RTFA yet, but read a lot of internet of shit. When I bought a baby monitor I made sure it was dumb, because why would I trust some random company with data from a camera in my house?

book_mentioned 9y ago
Are there any thoroughly documented examples demonstrating use of an RTL-SDR to view these wireless cameras?
- lathiat 9y ago
  I was literally about to say.. sometimes the dumb ones are actually worse as many of them are transmitting the sound and video over the air with no encryption either :) I imagine probably 99% of them are but I don't have any research to actually back that up.
  - Xylakant 9y ago
    Many use the DECT Standard that was developed for mobile handsets. It’s not high security, but it’s also not plain text. They’re also not networked, so an adversary would have to get into range, making a potential attack much more complicated. It certainly won’t defend you from a targeted attack, but it will keep $random_person_on_the_internet reliably away and I don’t have to rely on $companies server/network security.
    - lathiat 9y ago
      Well thats comforting :)
      - kurthr 9y ago
        Exactly... there are many things for which not being connected to the 'net increase security a lot. You decrease the pool of crazies and crooks. However, once a stalker is interested in spying on your house... physical proximity isn't so much of a barrier. "We begin by coveting what we see every day... Clarice"
        Xylakant 9y ago
        I live on the fourth floor and the reception from my (audio only unidirectional) baby monitor doesn’t reach to the ground floor. So the stalker would need to be in one of the adjacent flats. Not an insurmountable barrier, but one that I feel comfortable with, since all I need protecting is baby babble.
        danielvf 9y ago
        Or just a better antenna. :)
        Xylakant 9y ago
        Maybe. It’s still just baby babble.
        crpatino 9y ago
        If you have reason to believe people that know about anthennas are after you, why have you not rig a Faraday cage in your home frame already???
  - dragonwriter 9y ago
    > I was literally about to say.. sometimes the dumb ones are actually worse as many of them are transmitting the sound and video over the air with no encryption either Many of the smart ones both broadcast like the dumb ones and, separately, send a signal on wifi to a central server for online viewing, so they fully incorporate the problems of the dumb ones.
    - shaftoe 9y ago
      This is a common problem in areas with multiple new parents: turning on your video baby monitor and watching your neighbor's cam.
  - Klathmon 9y ago
    This is why I went with an IoT network in my house, that doesn't have access to the outside world (ingress or egress) except through a carefully controlled firewall. And as of right now, the only 2 things that go through that firewall are the nest thermostat (yeah, it's pretty and hasn't given me any trouble, so i'm happy with the tradeoff here), and the google homes (again, another tradeoff myself and my family are comfortable making). Everything else is on that network without access to the "internet" directly, with WPA2 encryption for protection against local eavesdropping, and pushed through an open-source home-automation controller called "Home Assistant" running on an intel NUC served up over HTTPS to our devices. I don't have any baby monitors yet (no babies!) but we do have cameras and with this system they work great and I sleep pretty well at night knowing it's all secure enough that i'm happy buying cheap devices knowing the security is garbage.
    - Xylakant 9y ago
      The problem with these devices is that they want to communicate via a vendors server, so a firewalled network will certainly improve security, but will massively reduce usability.
      - Klathmon 9y ago
        Sometimes, but often the only proprietary part of these things is the app they want you to use. Most of them will output standard formats and streams that you can hook into in my experience (but i might be inadvertently selecting for those)
        Xylakant 9y ago
        If I understood the article correctly, the devices that this article mentions communicate exclusively via the vendors server.
      - tinymollusk 9y ago
        I wonder if a proxy device with some smarts regarding data transmission patterns (learned from when a device is newly added to the network) could provide some security. Get a new device, plug it in to a locked-down network that passes all packets through a deep packet inspector connected to some ML. Add in proxy features so if the vendor turns off their service, your personal network MitM can mimic the server on the other side. I doubt this is feasible due to the fact that consumers clearly value "it just works" (implying simplicity/less security) over secure/private. (And probably a bunch of other factors I'm not thinking of.)
  - deleted 9y ago
    [deleted]
- taneq 9y ago
  https://duckduckgo.com/?q=baby+monitor+video+hacked https://duckduckgo.com/?q=baby+monitor+video+hacked
- jandrese 9y ago
  I didn't document it, but the baby monitor we used just transmitted raw FM audio at ~900Mhz. You could listen to it with SDR# no problem. It wasn't one of those fancy video kinds though, just an old fashioned audio only monitor. https://www.amazon.com/Sony-BabyCall-Receivers-Discontinued-Manufacturer/dp/B0017T2RYU https://www.amazon.com/Sony-BabyCall-Receivers-Discontinued-...
nugi 9y ago
As a kid, i used to use my ancient portable phone to walk down the street and tune into other phones, and baby monitors. I remember one mother always singing itailian sounding songs to quiet her child and found it touching. Then I realized I was basically peering in to the private lives of those around me to a weird level. Things later went digital, more consumer spectrum opened up, and these 'hacks' largely stopped working. I had moved on to computers by that time.

_pmf_ 9y ago

A baby monitor having accessible UART ports on the board has the same security implications as a PC having a CD-ROM drive. Actually, considerably less.

sokoloff 9y ago
Agreed on a stand-alone basis, but couple that with client certificate based auth and all client certificates being the same worldwide, and it makes the UART a convenient step in the chain of attack. (Agree that the problem isn’t the UART pads though.)

thinkMOAR 9y ago

So how does this differ from other camera security concerns/complaints that get posted regularly? Because its called a baby monitor?

a2tech 9y ago
The security on this is actually a lot better than most cameras--all the traffic is SSL using trusted client certs. To get into the traffic they had to tear the device apart and extract the cert. After that they could MITM the traffic between the camera and the remote server and observe some bad security. Unfortunately they also published the extracted certificate on their blog which is not cool.
- matthberg 9y ago
  They unfortunately did not have to tear the device apart and extract the cert, they state that each device uses the same one, valid until 2038, which was exposed in a previous exploit (and was likely previously available online as a result). Though it was definitely a bad idea to post it again on their site.

JeanMarcS 9y ago

> trading privacy for convenience That’s the important sentence to me. That’s where we all gone wrong in my opinion.

kwhitefoot 9y ago

Just don't use a baby monitor.

gumby 9y ago
this comment could come off as flip, but it's an important one. Sure: baby monitor security is important too: if you can get it right for a baby monitor you've probably got the framework (technical, social, regulatory, etc) to get it right for a bunch of other things. But are baby monitors themselves solving a problem or causing one? The alternative is to either have the baby in the room with you (distracting: they're like a campfire!) while you do your chores or talk to your visitor or whatnot, or learn to be able to be in another room from your baby. Sounds luddite, but it helps lay the foundation for a healthy, non-helicoptering relationship with your kid and doesn't slip tolerance for pervasive surveillance into your home.
- untog 9y ago
  > it helps lay the foundation for a healthy, non-helicoptering relationship with your kid I think that's a pretty big exaggeration. "helicopter parenting" usually characterises parents who refuse to/cannot step back from their child's life and let them make decisions on their own. A sleeping newborn child cannot make decision on it's own - the only acceptable form of parenting is helicopter parenting when your child isn't capable of doing anything for itself! Sudden Infant Death Syndrome exists. You can hardly blame people for wanting to protect their child from it.
  - xkcd-sucks 9y ago
    Can a "sudden death syndrome" actually be reversed, or does monitoring just provide better estimates of death time?
    - EADGBE 9y ago
      Our first daughter stopped breathing, turned purple and didn't come-to for what seemed like an eternity. I can't imagine what would have happened if she was alone during this time. She was alert when the paramedics showed up, but the subsequent tests at the hospital proved nothing. The cardiologist, nurses, and other doctors all seemed to agree that it was "nearly a SIDS thing" and that we just got lucky. After that night, and for every night since (2 more kids since then) we've used a breathing monitor. Occasionally I've noticed the kids will go in a "deep sleep", and the monitor will go off a few times during the night, you'll have to reposition them; they'll wince (in their sleep) and carry on. If that's what it takes, then that's what it takes. From my research after that event, it seems like SIDS is all-encompassing, and the amount of time allowed for an infant to slip into death may play a factor in it's "suddeness".

tzs 9y ago

What are some good solutions to authentication for IoT devices? There's nothing wrong in principle with using a certificate (other than it being overly complicated...there's a reason we aren't all using client certificates to authenticate with our email server, Twitter, Facebook, etc). Just as there is nothing wrong in principle with using a user/password scheme. Both certificates and user/passwords suffer from the same serious problem: how do you change them on the device? If you don't have a way to change them, all someone has to do is learn the factory default and game over. (Even if you provide a way to change them there is the issue of how to make sure people actually change them, which is a whole other problem). IoT devices often do not have a good interface on the device itself that you could use to change a user/password (let alone enter a new certificate!). You could include Bluetooth in the device, and provide a configuration application that the user runs on their phone. If the device does not otherwise need Bluetooth that is going to raise the cost a little, and if the device does not otherwise need a mobile app making people get one just to set the thing up is going to seriously annoy many. What I would like to see is this: 1. Every IoT device (and every non-IoT device, for that matter, for reasons given below) should have at least one of: (A) A USB port that you can plug a thumb drive into, (B) A USB port that you can use to connect the device to a computer, or (C) some type of SD card port. I think that USB is cheap enough now that it would not cost much to add it. 2. If you plug a FAT or FAT32 formatted thumb drive or SD card into the device, it reads and applies configuration information from a file on the drive or card. There should be a convention established for the naming and location of configuration files so that multiple devices from multiple vendors can all have configuration files on the same drive. 3. If you plug the device into a computer via USB, the device shows up as a FAT or FAT32 formatted drive with its current configuration in files on that drive. You can edit them to change the configuration. 4. When you connect a thumb drive or insert an SD card and there is a "DOCS" directory on it, the device makes a subdirectory in that named after itself, and in that directory writes a copy of its user manual and other documentation. If there is a "LOGS" directory, it should do a similar thing, but with any logs it keeps. If there is an "INFO" directory, do a similar thing but with information about the device, such as model number, serial number, and other such stuff useful to have if you need to contact customer service. 5. This mechanism could also be used to provide firmware updates to the device. (#4 and #5 are why I want this everywhere, not just IoT). Another issue with IoT devices, once you have figured out how to change authentication information, is how to keep that safe? For instance, I'm making a motion detecting bird camera to take photos of the birds that stop by for the food I leave out. If I want it to use my home wifi to upload photos...it needs my home wifi credentials. But it will be outside. If someone steals it, they have my credentials! (I'm currently using a Raspberry Pi, so they could just steal the SD card...or if they came prepared they could just borrow it, copy it, and put it back, and I might not even find out about it). My current thoughts are to have the thing come up after boot offering its own wifi network. I can connect to that from my computer, and start the bird cam software, which can ask for my wifi credentials. It can then stop offering a wifi network and join mine, keeping the credentials only in RAM. Still vulnerable, but it would then take an attack more sophisticated than simply stealing it, or cloning the SD card.

kees99 9y ago

I have a problem with those two "vulnerabilities" listed: - Available Serial Interface (referring to easy-to-solder console port pads on PCB, accessible once you tear device apart); - Weak Default Credentials (referring to weak root password that is only ever accepted via serial console). Life-span of a baby monitor is couple of years, by definition. After that, this hardware could either become a cool easy-to-tinker Linux device, or e-waste. Researchers at sec-consult seem to think e-waste option is better, or at least it's a necessary evil to deter those pesky hackers who sneak near your child's crib, armed to their teeth with soldering irons and screwdrivers.

ken 9y ago
> Life-span of a baby monitor is couple of years, by definition. Unless you have more than one baby. Or friends/family with babies. My nephews are using products that weren't even new when I played with them, decades ago.
- Waterluvian 9y ago
  I have a four year old monitor that's on baby #1 in my household. It's a dead simple device and just works. I overhwelmingly care about its reliability to work or tell me when it's not working and I'll easily sacrifice any hackability to achieve that. Ever have an infant crying for 45 mins because the monitor failed and you thought he was still sleeping? Really really upsetting.
- EADGBE 9y ago
  Run-of-the-mill alarm-based (SIDS-reducing) baby monitor owner here. Originally bought in 2012, going strong on baby #3. Honestly, the static re-assures me it's still listening to my child. Probably similar reasons why the light switches in my home will remain analog. I need it to work 100% of the time. I can't trust a computer for that.
Spooky23 9y ago
This is typical infosec handwaving nonsense. People who have covert spy teams entering their home hacking serial interfaces on baby monitors probably shouldn't be buying this thing. The vendor in this case seems to have build a pretty decent solution considering the pricepoint and purpose. The only vulnerability here is the consumer vulnerability for buying something as trivial as a baby monitor that is dependent on some random consumer company's cloud service for a core function. It would be better to have a fallback to a multicast DNS service so it could function on the local network.

jasonmaydie 9y ago

why does a baby monitor have to go through the cloud? you aren't supposed to be more 0-50 feet from your baby.

giobox 9y ago
I suspect there’s a market for those parents who travel with work or are otherwise away from home for a time wanting to “drop in” and see the kid. Much the same logic as the market for indoor security cameras from Canary/Nest/Arlo et al, and those seem to sell well enough. I know several colleagues who use a Nest in this way, for families and pets.

ateesdalejr 9y ago

> it is possible to identify the following very weak 4-digit default credentials And we all know what the password is... "1234"