6 ms·

About the March 8 and 9, 2021 Verkada camera hack

87 points by jgrahamc 6y ago

ThePhysicist 6y ago
I mean good for them but maybe it would be even better to not have cloud-connected cameras in the office in the first place. Regarding their zero-trust approach to networking I'm wondering what they're using to secure non-HTTP services. I know they have a product that forwards TCP traffic but I don't think you could use that for arbitrary traffic between endpoints?
- judge2020 6y ago
  They do have a process for securing other services behind Access, including arbitrary traffic and custom protocols like SSH, RDP, and SMB (although I'm not sure how much dogfooding is going on; @jgrahamc might be able to comment on that): https://developers.cloudflare.com/cloudflare-one/applications/non-HTTP https://developers.cloudflare.com/cloudflare-one/application...
- yunohn 6y ago
  >> cloud-connected cameras in the office While Verkada may have not been the best choice, I fail to understand why remote-accessible cameras are bad? In fact, I'd say they are crucial at the level of security & monitoring needed by a company like Cloudflare.
  - pmlnr 6y ago
    > why remote-accessible cameras are bad Because that access is not as limited as it sounds, that's why.
    - ALittleLight 6y ago
      You have to think about the trade off between not having remote accessible cameras versus having them. If you can make systems more secure by eliminating them, you can become very secure and simultaneously not very useful. Not having remote accessible cameras would seemingly make using the cameras take longer or be less efficient. In turn, that might make detecting or tracking physical intrusions less efficient and/or less successful. Should Cloudflare take that trade off? I think it depends on their threat model.
- nmldiegues 6y ago
  Besides the sibling pointing out to Cloudflare Access, there is also a new way that allows for arbitrary TCP traffic to be routed through Cloudflare network in a Zero Trust fashion: https://developers.cloudflare.com/cloudflare-one/tutorials/warp-to-tunnel https://developers.cloudflare.com/cloudflare-one/tutorials/w...
tedunangst 6y ago
Rule of thumb for claim evaluation: if it's not necessary to elaborate or speculate about something, it's not necessary to announce it either.
ggreer 6y ago
Related HN threads: https://news.ycombinator.com/item?id=26406969 https://news.ycombinator.com/item?id=26406969 https://news.ycombinator.com/item?id=26405056 https://news.ycombinator.com/item?id=26405056 Cloudflare's post doesn't mention it, but the Twitter account that claimed credit for the hack (and made all kinds of ridiculous boasts like "we could have owned half the internet") has been suspended.[1] Before that the owner of the account posted plenty of personal information, including selfies.[2] A Mastodon instance is where they're posting stuff now.[3] It really seems like this person is mentally ill and it's only a matter of time before they get in trouble with law enforcement. I mean, it's standard opsec to avoid posting your mailing address on your l33t h4x0r account.[4] I realize the address is a PO box, but this is practically begging the authorities to intervene. 1. https://twitter.com/nyancrimew https://twitter.com/nyancrimew 2. https://archive.is/8IJ8G https://archive.is/8IJ8G 3. https://notbird.site/@deletescape https://notbird.site/@deletescape 4. https://notbird.site/@deletescape/105548475573915843 https://notbird.site/@deletescape/105548475573915843
- ocdtrekkie 6y ago
  I would presume there's some protection in the fact that they went to the press, rather than trying to cause damage, ask for ransom money, etc. but it certainly wasn't an example of responsible disclosure either. It looked like they generally obscured faces in leaked shots.
- bredren 6y ago
  Was there a AWS security incident relatively recently where the perpetrator also seemingly wanted their identity to be known? I suppose any attention getting action can also be a cry for help. It is of note of a pattern emerges in conjunction with hacks of political intent / hacktivism.
- _e21c 6y ago
  While I agree that the opsec here is bad if nyancrimew doesn’t want to get arrested, I think you should disclose here, as you do in your twitter bio, that you work at Okta. Accusing the person who just breached your company of having a mental illness is not great form.
didibus 6y ago
> The fact that the attacker had access to a machine inside the corporate network is no better than the kind of access they’d have had if they’d connected to our corporate WiFi network. I appreciate that they have a zero trust model, but arguably, once you have access to the network, you are one step closer to using any zero-day to get further inside. It's good on CloudFlare that they had security beyond that which protected their customers, but it is still very bad for Verkada and CloudFlare needs to decide if they are okay continuing with a camera setup that can provide easy access to hackers to their corporate network or not, and that wasn't touched upon in the article unfortunately.
- evgen 6y ago
  Zero trust is a good start, but claiming that it is a panacea is about as dumb as claiming that you are safe from hackers because you have strong perimeter protection. It is not just the potential for a zero-day, but the fact that direct access lets you see traffic flows and even an encrypted protocol is going to leak metadata that will tell you where to pivot and suggest potential attack vectors.
  - lupire 6y ago
    You are arguing for security through obscurity?
    - evgen 6y ago
      As the only security? No. OTOH you should never volunteer information to an attacker, even that which seems trivial, innocuous, or obscured.
- jeffbee 6y ago
  I thought the point of zero trust is there is not an inside nor an outside of the network. There are services, and those services are accessible from anywhere, so everyone is always "inside".
  - 6y ago
deft 6y ago
I love how pwned corporations can now use their loss as a marketing story. "We got hacked but our product saved us! Here's how you can get hacked and live to tell the tale too, first step is just Trust Us." EDIT: reading the comments here now, and CF is astroturfing the thread. LOL.
- bredren 6y ago
  I also thought this rode the line a little bit on the marketing side and maybe a tad light on the security incident response side. It’s okay to name the products and why they are used but the posts lacks some subtlety. Reminds me of podcasts where the guest gets into talking about their product / company way too early instead of focusing discussion on the problem space in general.
  - lupire 6y ago
    CF's blog post is terrible because they are saying "hacking our junky outsourced cameras doesn't give you access to anything else" without addressing the risk that all the rest of their stuff may be as junky as the cameras that they completely failed to audit the security of.
- nlh 6y ago
  I honestly don't see how CloudFlare is a "pwned corporation" in this situation. Their security vendor got pwned. Nothing from CloudFlare was accessed other than security footage (from the vendor). You don't get to say you robbed a bank because you were able to walk into the lobby after hours.
  - mike_d 6y ago
    > You don't get to say you robbed a bank because you were able to walk into the lobby after hours. This was absolutely a breach of a device on their corporate network and should be treated as such. Just because the network wasn't interesting, doesn't mean the breach didn't happen. I have sympathy for their IR team because this would just be a random Tuesday had it not made it to the press.
stefan_ 6y ago
I guess its really "zero trust" for everyone but the security cameras from a 3rd party vendor that are on a network which can be leveraged into remote shell access to the cameras. Like.. you forgot to zero trust the cameras? Maybe before selling us on the product, try Verkada? They seem to have a need.
- lupire 6y ago
  "zero trust" is a terrible misnomer. It just means "non-network-location+based trust" The cameras trusted the Verkada password that Verkada gave to a couple of random teenagers on the internet.

87 points by jgrahamc 6y ago

I mean good for them but maybe it would be even better to not have cloud-connected cameras in the office in the first place. Regarding their zero-trust approach to networking I'm wondering what they're using to secure non-HTTP services. I know they have a product that forwards TCP traffic but I don't think you could use that for arbitrary traffic between endpoints?

judge2020 6y ago
They do have a process for securing other services behind Access, including arbitrary traffic and custom protocols like SSH, RDP, and SMB (although I'm not sure how much dogfooding is going on; @jgrahamc might be able to comment on that): https://developers.cloudflare.com/cloudflare-one/applications/non-HTTP https://developers.cloudflare.com/cloudflare-one/application...
yunohn 6y ago
>> cloud-connected cameras in the office While Verkada may have not been the best choice, I fail to understand why remote-accessible cameras are bad? In fact, I'd say they are crucial at the level of security & monitoring needed by a company like Cloudflare.
- pmlnr 6y ago
  > why remote-accessible cameras are bad Because that access is not as limited as it sounds, that's why.
  - ALittleLight 6y ago
    You have to think about the trade off between not having remote accessible cameras versus having them. If you can make systems more secure by eliminating them, you can become very secure and simultaneously not very useful. Not having remote accessible cameras would seemingly make using the cameras take longer or be less efficient. In turn, that might make detecting or tracking physical intrusions less efficient and/or less successful. Should Cloudflare take that trade off? I think it depends on their threat model.
nmldiegues 6y ago
Besides the sibling pointing out to Cloudflare Access, there is also a new way that allows for arbitrary TCP traffic to be routed through Cloudflare network in a Zero Trust fashion: https://developers.cloudflare.com/cloudflare-one/tutorials/warp-to-tunnel https://developers.cloudflare.com/cloudflare-one/tutorials/w...

tedunangst 6y ago

Rule of thumb for claim evaluation: if it's not necessary to elaborate or speculate about something, it's not necessary to announce it either.

ggreer 6y ago

Related HN threads: https://news.ycombinator.com/item?id=26406969 https://news.ycombinator.com/item?id=26406969 https://news.ycombinator.com/item?id=26405056 https://news.ycombinator.com/item?id=26405056 Cloudflare's post doesn't mention it, but the Twitter account that claimed credit for the hack (and made all kinds of ridiculous boasts like "we could have owned half the internet") has been suspended.[1] Before that the owner of the account posted plenty of personal information, including selfies.[2] A Mastodon instance is where they're posting stuff now.[3] It really seems like this person is mentally ill and it's only a matter of time before they get in trouble with law enforcement. I mean, it's standard opsec to avoid posting your mailing address on your l33t h4x0r account.[4] I realize the address is a PO box, but this is practically begging the authorities to intervene. 1. https://twitter.com/nyancrimew https://twitter.com/nyancrimew 2. https://archive.is/8IJ8G https://archive.is/8IJ8G 3. https://notbird.site/@deletescape https://notbird.site/@deletescape 4. https://notbird.site/@deletescape/105548475573915843 https://notbird.site/@deletescape/105548475573915843

ocdtrekkie 6y ago
I would presume there's some protection in the fact that they went to the press, rather than trying to cause damage, ask for ransom money, etc. but it certainly wasn't an example of responsible disclosure either. It looked like they generally obscured faces in leaked shots.
bredren 6y ago
Was there a AWS security incident relatively recently where the perpetrator also seemingly wanted their identity to be known? I suppose any attention getting action can also be a cry for help. It is of note of a pattern emerges in conjunction with hacks of political intent / hacktivism.
_e21c 6y ago
While I agree that the opsec here is bad if nyancrimew doesn’t want to get arrested, I think you should disclose here, as you do in your twitter bio, that you work at Okta. Accusing the person who just breached your company of having a mental illness is not great form.

didibus 6y ago

> The fact that the attacker had access to a machine inside the corporate network is no better than the kind of access they’d have had if they’d connected to our corporate WiFi network. I appreciate that they have a zero trust model, but arguably, once you have access to the network, you are one step closer to using any zero-day to get further inside. It's good on CloudFlare that they had security beyond that which protected their customers, but it is still very bad for Verkada and CloudFlare needs to decide if they are okay continuing with a camera setup that can provide easy access to hackers to their corporate network or not, and that wasn't touched upon in the article unfortunately.

evgen 6y ago
Zero trust is a good start, but claiming that it is a panacea is about as dumb as claiming that you are safe from hackers because you have strong perimeter protection. It is not just the potential for a zero-day, but the fact that direct access lets you see traffic flows and even an encrypted protocol is going to leak metadata that will tell you where to pivot and suggest potential attack vectors.
- lupire 6y ago
  You are arguing for security through obscurity?
  - evgen 6y ago
    As the only security? No. OTOH you should never volunteer information to an attacker, even that which seems trivial, innocuous, or obscured.
jeffbee 6y ago
I thought the point of zero trust is there is not an inside nor an outside of the network. There are services, and those services are accessible from anywhere, so everyone is always "inside".
- 6y ago

deft 6y ago

I love how pwned corporations can now use their loss as a marketing story. "We got hacked but our product saved us! Here's how you can get hacked and live to tell the tale too, first step is just Trust Us." EDIT: reading the comments here now, and CF is astroturfing the thread. LOL.

bredren 6y ago
I also thought this rode the line a little bit on the marketing side and maybe a tad light on the security incident response side. It’s okay to name the products and why they are used but the posts lacks some subtlety. Reminds me of podcasts where the guest gets into talking about their product / company way too early instead of focusing discussion on the problem space in general.
- lupire 6y ago
  CF's blog post is terrible because they are saying "hacking our junky outsourced cameras doesn't give you access to anything else" without addressing the risk that all the rest of their stuff may be as junky as the cameras that they completely failed to audit the security of.
nlh 6y ago
I honestly don't see how CloudFlare is a "pwned corporation" in this situation. Their security vendor got pwned. Nothing from CloudFlare was accessed other than security footage (from the vendor). You don't get to say you robbed a bank because you were able to walk into the lobby after hours.
- mike_d 6y ago
  > You don't get to say you robbed a bank because you were able to walk into the lobby after hours. This was absolutely a breach of a device on their corporate network and should be treated as such. Just because the network wasn't interesting, doesn't mean the breach didn't happen. I have sympathy for their IR team because this would just be a random Tuesday had it not made it to the press.

stefan_ 6y ago

I guess its really "zero trust" for everyone but the security cameras from a 3rd party vendor that are on a network which can be leveraged into remote shell access to the cameras. Like.. you forgot to zero trust the cameras? Maybe before selling us on the product, try Verkada? They seem to have a need.

lupire 6y ago
"zero trust" is a terrible misnomer. It just means "non-network-location+based trust" The cameras trusted the Verkada password that Verkada gave to a couple of random teenagers on the internet.