3 ms·

Is unplugging the power of the router in an AirBNB a good basic security step? Presumably some cameras depend on flash storage rather than Internet connection

Is unplugging the power of the router in an AirBNB a good basic security step? Presumably some cameras depend on flash storage rather than Internet connection but many cameras do use Internet connection to function?

acct1771 8y ago
I just cut the power to the house when I arrive.
- ackfoo 8y ago
  "Today engineers will succeed in restoring water and power to your area, leaving you with hours of hard sledgehammer work to get it back the way you like it." --The Onion
- thisisweirdok 8y ago
  I burn it down and camp on the ashes.
- smacktoward 8y ago
  Nuke it from orbit. It’s the only way to be sure.
theoh 8y ago
How do you know you're not unplugging a decoy router, with the secure surveillance router concealed somewhere you wouldn't think to look?
- ndiscussion 8y ago
  This seems highly unlikely, but like all security, this is just one layer of defense.
  - theoh 8y ago
    It could be very inconvenient to unplug the router. The real issue is what level of threat you hope to counter. An unexpected extra clock or an extra coffee machine in the room, as mentioned in the article, would not represent a very high-level surveillance tactic. I mean, to try something as blatant as that would be very unimaginative, or at best, evidence of working with very limited options. Is there really a two-bit Airbnb surveillance problem?
    - ndiscussion 8y ago
      I doubt that a sleazy airbnb host would be sophisticated enough to place a decoy router, and if they were, there's probably nothing I could do to stop them. My threat model would be the host trying to blackmail me and/or get their kicks from watching me. A corporate or national actor isn't part of this model, because: - I'm a low-priority target - Prevent highly sophisticated attacks borders on impossible/maddening - The likelihood of the creep is probably 10,000x more I'm not sure unplugging the router would help, but I probably wouldn't find it very inconvenient either (depending on location). Overall it's probably worth a quick try to locate and unplug it - if you can't find it, hedge your bets and try some other opsec techniques. Just my own approach.
    - variable11 8y ago
      > Is there really a two-bit Airbnb surveillance problem? Yes, because the average person is far more likely to be targeted by a two-bit jealous spouse, perverted Airbnb owner, or paranoid neighbor than a sophisticated international spy ring.
  - jarfil 8y ago
    I keep a small (and cheap) separate router for my IoT devices. If I wanted to spy on someone, I'd definitely use one of those, with a USB powerbank acting as a UPS.
- randcraw 8y ago
  Check your smartphone while you unplug the router (or you block 99% of its signal by 1) wrapping it in aluminum foil or 2) taping a metal box or mylar sheet over it). If one of the wifi presences discovered by your phone disappears thereafter, then the router you blocked was live and very unlikely to be a decoy. (I can't believe most casual spies would install a live decoy router in the room.) Since all of the spy devices in the room almost certainly operate via that wifi router, disabling or blocking it is probably the most effective single act you can do to disable all of the room's surveillance devices.
  - theoh 8y ago
    I assume that the decoy router is the active router. So you'll know you've turned it off by e.g. the absence of the Netflix service you were planning to enjoy while staying in the AirBnB apartment. How do you know that one of the remaining WiFi networks that you can detect (after unplugging the visible one) isn't providing connectivity for surveillance devices? I can't think of any easy way to do this. There could be a surveillance server+router in a crawl space or an attic, but you have to find it. Better to treat whatever you say and do in the AirBnB apartment as compromised, if you are inclined to worry about this. I'm not actually that curious to hear what 'compromised' implies in the typical AirBnB surveillance scenario. Is it just the possibility of creepy observation, or identity theft, blackmail, worse? It's easy to come up with potential horror stories. The higher the stakes, the more incentive for the surveillance to be undetectable (where detectability would impair the attack).
_underfl0w_ 8y ago
I've seen other commenters mentioning that they now consider at least scanning the network to be a mandatory step in their check-in process. Personally I try to avoid connecting my devices to others' WiFi on principal - especially if they're... less than tech savvy.
- andrewstuart 8y ago
  The most powerful advice in the linked post seems to be infrared scanning for heat. Presuming most cameras generate some sort of heat this would be a good way to locate them.
  - jarfil 8y ago
    Microphones can be hidden completely out of sight. A long enough lens barrel can put the heat generating electronics far enough from any visible surfaces that the heat signature may become unnoticeable. Also the heat camera is the most expensive method.
- dorfsmay 8y ago
  Assuming you don't accept bad certs, don't ssh if there's an issue with the host key, don't use http, relent and other plaintext protocols, why?
  - alasdair_ 8y ago
    Right gue CAs and a lack of cert pinning?
    - eps 8y ago
      And how would a rogue CA cert get into your cert store? The only issue with random access points when using properly secured connections is the metadata leak - DNS queries, etc. They will now whom you are connecting to, basically. That's it.
      - 8y ago

acct1771 8y ago

I just cut the power to the house when I arrive.

ackfoo 8y ago
"Today engineers will succeed in restoring water and power to your area, leaving you with hours of hard sledgehammer work to get it back the way you like it." --The Onion
thisisweirdok 8y ago
I burn it down and camp on the ashes.
smacktoward 8y ago
Nuke it from orbit. It’s the only way to be sure.

theoh 8y ago

How do you know you're not unplugging a decoy router, with the secure surveillance router concealed somewhere you wouldn't think to look?

ndiscussion 8y ago
This seems highly unlikely, but like all security, this is just one layer of defense.
- theoh 8y ago
  It could be very inconvenient to unplug the router. The real issue is what level of threat you hope to counter. An unexpected extra clock or an extra coffee machine in the room, as mentioned in the article, would not represent a very high-level surveillance tactic. I mean, to try something as blatant as that would be very unimaginative, or at best, evidence of working with very limited options. Is there really a two-bit Airbnb surveillance problem?
  - ndiscussion 8y ago
    I doubt that a sleazy airbnb host would be sophisticated enough to place a decoy router, and if they were, there's probably nothing I could do to stop them. My threat model would be the host trying to blackmail me and/or get their kicks from watching me. A corporate or national actor isn't part of this model, because: - I'm a low-priority target - Prevent highly sophisticated attacks borders on impossible/maddening - The likelihood of the creep is probably 10,000x more I'm not sure unplugging the router would help, but I probably wouldn't find it very inconvenient either (depending on location). Overall it's probably worth a quick try to locate and unplug it - if you can't find it, hedge your bets and try some other opsec techniques. Just my own approach.
  - variable11 8y ago
    > Is there really a two-bit Airbnb surveillance problem? Yes, because the average person is far more likely to be targeted by a two-bit jealous spouse, perverted Airbnb owner, or paranoid neighbor than a sophisticated international spy ring.
- jarfil 8y ago
  I keep a small (and cheap) separate router for my IoT devices. If I wanted to spy on someone, I'd definitely use one of those, with a USB powerbank acting as a UPS.
randcraw 8y ago
Check your smartphone while you unplug the router (or you block 99% of its signal by 1) wrapping it in aluminum foil or 2) taping a metal box or mylar sheet over it). If one of the wifi presences discovered by your phone disappears thereafter, then the router you blocked was live and very unlikely to be a decoy. (I can't believe most casual spies would install a live decoy router in the room.) Since all of the spy devices in the room almost certainly operate via that wifi router, disabling or blocking it is probably the most effective single act you can do to disable all of the room's surveillance devices.
- theoh 8y ago
  I assume that the decoy router is the active router. So you'll know you've turned it off by e.g. the absence of the Netflix service you were planning to enjoy while staying in the AirBnB apartment. How do you know that one of the remaining WiFi networks that you can detect (after unplugging the visible one) isn't providing connectivity for surveillance devices? I can't think of any easy way to do this. There could be a surveillance server+router in a crawl space or an attic, but you have to find it. Better to treat whatever you say and do in the AirBnB apartment as compromised, if you are inclined to worry about this. I'm not actually that curious to hear what 'compromised' implies in the typical AirBnB surveillance scenario. Is it just the possibility of creepy observation, or identity theft, blackmail, worse? It's easy to come up with potential horror stories. The higher the stakes, the more incentive for the surveillance to be undetectable (where detectability would impair the attack).

_underfl0w_ 8y ago

I've seen other commenters mentioning that they now consider at least scanning the network to be a mandatory step in their check-in process. Personally I try to avoid connecting my devices to others' WiFi on principal - especially if they're... less than tech savvy.

andrewstuart 8y ago
The most powerful advice in the linked post seems to be infrared scanning for heat. Presuming most cameras generate some sort of heat this would be a good way to locate them.
- jarfil 8y ago
  Microphones can be hidden completely out of sight. A long enough lens barrel can put the heat generating electronics far enough from any visible surfaces that the heat signature may become unnoticeable. Also the heat camera is the most expensive method.
dorfsmay 8y ago
Assuming you don't accept bad certs, don't ssh if there's an issue with the host key, don't use http, relent and other plaintext protocols, why?
- alasdair_ 8y ago
  Right gue CAs and a lack of cert pinning?
  - eps 8y ago
    And how would a rogue CA cert get into your cert store? The only issue with random access points when using properly secured connections is the metadata leak - DNS queries, etc. They will now whom you are connecting to, basically. That's it.
    - 8y ago