8 ms·

I went with the wired network route. I'm sure to most people it seems like the more secure route, but it's important to realize that for outside cameras, you n

I went with the wired network route. I'm sure to most people it seems like the more secure route, but it's important to realize that for outside cameras, you now have ethernet connections accessible from outside. Jamming WiFi is a denies you the ability to record, but external ethernet gives them access to your network. I went with building an isolated network, but I think that's outside the relm of what most consumers can do. A WiFi camera, while not perfect, really does give you the best bang for the buck. I'm sure we all know that most residential locks can be picked with relative ease, but criminals rarely go through the trouble. The one time a person did "break in" to my house, they just opened an unlocked door. Usually I keep that door locked, a large piece of plywood in front of it, and a table saw braced up against that. Just so happened I worked on a project that day and just forgot to lock the door. Lucky break for her, but trying enough doorknobs she was bound for find some. She had gotten into two other houses that night. She was also tripped out on meth and couldn't have operated a WiFi jammer if she wanted to. So, yea, a WiFi camera isn't great, but it's still going to get 99% of criminals out there. Next we just need WiFi jammer alarms.

jmuguy 4y ago
Wouldn't you, ya know, see a baddie disconnecting/destroying your camera and connecting their CP downloading device or whatever they're planning to do on your network?
leoh 4y ago
Certainly there are protocols that require authentication over ethernet like https://en.wikipedia.org/wiki/IEEE_802.1X https://en.wikipedia.org/wiki/IEEE_802.1X
- stonepresto 4y ago
  I don't think that prevents MAC spoofing
- _flux 4y ago
  But how many cameras support them?
- yCloser 4y ago
  or simply set up another vlan for the cameras (and this does not require any configuration on the cameras, just on the switch)
  - chinathrow 4y ago
    That's what OP did and said: "... but I think that's outside the relm of what most consumers can do."
  - autoexec 4y ago
    Why not a physically separate network? If all you care about is catching outside problems like porch pirates, car thieves, and dogs owners who don't clean up after their pets just run cables from each camera to a switch that's connected to a single machine that isn't on your network or the internet. Cameras inside the house get internet access, so intruders can't just walk off with your footage, but external camera feeds are fine to be stored locally. That'd take very little skill to set up, prevents anyone from using those external connections to get at the rest of your network or abuse your internet connection,you don't have to worry about jammers, the police won't be accessing your feed whenever they feel like it, and Amazon won't be keeping detailed logs of everyone who comes to your door, how often you have company over, what your daily/weekly schedule is like, how often you get food delivered, what kinds of clothing you and your guests are wearing, how many children are in your home, how many pets, how often you go out on the weekends vs staying inside, how often you vacation and for how long, how many friends you have, how often you have non-amazon packages delivered, what kind of car you drive, etc
    - bsenftner 4y ago
      This is the way to go. Any other way is just lazy.
      - ryandrake 4y ago
        I take the lazy VLAN route, then. Ideally, I can plan all this out during construction, and run conduit through all walls, have electrical outlets near each ideal switch location, and so on. But in most homes that are not previously owned by tech-geeks, re-wiring properly means busting down drywall. If you own the home, it's a major pain, and if you rent, it's impossible. Typically the things on my home network that need to be isolated and/or revoked Internet access are not in physical proximity with one another, so using a separate switch for them means a lot more wiring. It is much simpler to just run devices to the nearest already existing switch and do the isolation in software. This also cuts down on the number of switches which means fewer points of failure.
Gigachad 4y ago
What use is getting access to the network these day anyway? Everything has moved to a model of not trusting the network or anything else on it. I guess they could cast something to your chrome cast?
- feanaro 4y ago
  Are you sure everything has? Smart appliances in particular are typically terrible with security, so having access to their network certainly gives you an edge.
  - sydd 4y ago
    So what would a robber do with them? Turn off your refrigerator? Cancel your scheduled washing program? Install some malware? Usually it's meth heads trying to steal something that is easy to grab not the CIA.
- gorgoiler 4y ago
  The attack I worry about is neighbourhood teenagers using my internet connection for lolz. I imagine them downloading movies and images that get me into trouble with the wife / LEAs / both.
  - sebzim4500 4y ago
    How is your wife going to find out what has been downloaded over your network?
    - iinnPP 4y ago
      knock knock knock I'm Dick with the FBI. Is your husband home?
      - gorgoiler 4y ago
        Yes you are both right to correct me. I will get in trouble with my wife because the feds will rat me out to her for something stupid these hypothetical kids end up doing.
aarobot 4y ago
Aren't wired cameras fine as long as you use a virtual LAN network for them and don't place them inside?
- arminiusreturns 4y ago
  I suggest a physically separate network for ip based security systems. The GPs concerns are also why most wired CCTV at the higher end is often not ethernet, but there are ways to secure ethernet even externally (camera housings that are basically safes, very high placement that would require a ladder to get to, etc)
  - walterbell 4y ago
    What's a good search term for makers/retailers of "camera housings that are basically safes"?
    - arminiusreturns 4y ago
      The term you are looking for is "high-security", which covers the private industry side, DoD has others at play. Also dont forget the value of having custom welding done.
      - walterbell 4y ago
        Thanks, my initial search found cameras for oil rigs, which minimized sparks :) I've used carriage bolts to reinforce steel enclosures, with single-use wire rope seals for tamper detection on covers, minimizing exposure of the clamping point. Axis P1204 has a small camera sensor separated from the camera body by a 25' cable, which makes it easier to enclose and secure the camera body. Not seen that elsewhere, must be a proprietary protocol on that cable, e.g. RPi camera sensor cables can only be a few cm.
    - jhoelzel 4y ago
      i just bought a reolink RLC-823A Smart 8MP PTZ PoE Camera with Spotlights It is build like a tank and fully aluminium. If you mount it right you easily can hold a person from it. I bascially made a hole through the wall for the cables and mounted it directly to the outside wall. For now im quite confident that nobody will be able to remove it without much fuzz
feanaro 4y ago
> I went with building an isolated network, but I think that's outside the relm of what most consumers can do. A bit off topic, but can we please stop calling people "consumers"? It's such a weird and patronising term, not to mention completely unnecessary when "people" does a better job.
- tomcam 4y ago
  I would wager most of us consumers don’t care
- NavinF 4y ago
  It's an accurate term. "Consumer" as opposed to prosumer, enthusiast, and professional.
- x-complexity 4y ago
  > can we please stop calling people "consumers"? It's such a weird and patronising term, not to mention completely unnecessary when "people" does a better job. "Consumer" IS the technically more accurate term, as outside of the consumption of tech/services as designed for them, they do not venture beyond that realm & try to understand how the tech works. Similar analogies include: - Not caring about how a car works internally, & leaving its repair & maintenance to a mechanic. - Not caring about how their dishes were made, & leaving that to cooks/chefs. - Not caring about the minutiae of the law, & leaving that to the legal system & its lawyers & judges. - Not caring about sewer maintenance, & leaving that for sewage workers. - Not caring about recyclables processing, & leaving that for recycling plants. - Not caring about Y, and leaving that for (workers/entities that work with Y). All of us are consumers in some form or another: We require the services of others that require the services of others that require the services of others ad infinitum.
- Out_of_Characte 4y ago
  I think consumer/customer is the right term in this situation. Even though I could build an isolated network with ethernet cables and security camera's, we're usually left with the other people, myself included, that wouldn't always be able to do research and come up with the best solution. That's why I want to outsource that by purchasing something. Which is why we're left with this freemarket of vulnerable devices and practises. People setting up security camera's usually do a good job. Consumers do not.
hutzlibu 4y ago
"She had gotten into two other houses that night. She was also tripped out on meth and couldn't have operated a WiFi jammer if she wanted to." You left out the dramatic details. So you stopped and confronted her directly yourself, or called the police who caught her(later)? (In general, it is not advisable to confront meth addicts, they might be armed and not restrained in any way.)
varispeed 4y ago
I had WiFi cameras until my friend showed me how his cameras were jammed when his neighbour had a broad daylight burglary. A van pulled up and a second later the video was completely jammed. Then five minutes later it comes back to normal, but neighbour doors were smashed in. So I got a wired network now, on a separate LAN and have two cameras on each perimeter, so if someone tries to cut the cable (unfortunately I was unable to run the cables inside the wall, so they run in PVC pipes attached to the wall), I very least should have that recorded. Also all my cameras are 4k. The cameras also record to built in SD card. There are also two servers hidden each is pulling the videos from DVR to back up and then one copy is uploaded to external server.
nikau 4y ago
Worth noting even the cheapest router chipsets normally support vlan tagging, so with a sub $100 router you can flash an opensource firmware on it like openwrt and then isolate network traffic on each port and filter it with iptables.
- dk775 4y ago
  Can you provide an easy guide for net gear Vlan? I am pretty good w computers but some reason can never figure out how to set up
  - nikau 4y ago
    Not sure how easy it is, but its documented pretty thoroughly on the openwrt dooco: https://openwrt.org/docs/guide-user/network/vlan/switch_configuration https://openwrt.org/docs/guide-user/network/vlan/switch_conf...
omegalulw 4y ago
I think you can encrypt ethernet comms too using 802.1x RADIUS. That's as secure as Wi-Fi and removes the need for an isolated network (which, when unencrypted isn't as secure as you think, e.g. MiTM). Ideally you connect via both but that's overkill for most use cases.
- da768 4y ago
  802.1x only authenticates devices, there's no encryption whatsoever past that point. You'd need MACsec or a VPN connection to prevent tapping.
donkeyd 4y ago
> So, yea, a WiFi camera isn't great, but it's still going to get 99% of criminals out there. Next we just need WiFi jammer alarms. All we need is onboard storage to record a couple hours of video locally which can then be synced when the connection is back again. Right? That doesn't fix real-time information transmission, but video is most often important for finding suspects after the fact.
- closeparen 4y ago
  Someone sophisticated enough to run a deauth attack is sophisticated enough to grab the memory card out of the camera.
  - joshjje 4y ago
    Put a very small/hidden backup camera somewhere, so they take out the main one and think they're all good.
  - wickedsight 4y ago
    Sophisticated criminals don't bring ladders to climb in order to fiddle with SD card slots. They want easy in and easy out. And they usually wear masks, so the video you do record are useless anyway.
- richrichardsson 4y ago
  > finding suspects after the fact Sounds like you think law enforcement actually give a shit about/can do anything toward solving burglary crime. Maybe it's better in other countries, but 5% solve rate sounds like they go and knock on the doors of the local known burglars to see if they still got the goods lying around. https://www.theguardian.com/uk-news/2018/jun/17/figures-less-than-5-of-burglaries-and-robberies-in-uk-solved https://www.theguardian.com/uk-news/2018/jun/17/figures-less...
  - donkeyd 4y ago
    I actually work in LE and video from domestic and commercial security cameras are always a major piece of information that we look for in every single investigation. So... Yes, LE gives a shit in many countries. However, also in many countries, like my own, police is very under staffed and burglaries are often on the bottom of the priorities list. Armed robberies, murders, shootings, stabbings, explosions, fires, domestic abuse, rape, to name a few, are the ones that get the highest priority. And those things take a lot of work to find suspects, prove what they're suspected of, write it down and get them convicted. A case, unfortunately, isn't finished when you catch a suspect. It's a crap load of work to get someone convicted and that gets massively underestimated by people who only read statistics and conclude that LE doesn't care... Most of us do, which is why we join the field.
ynbl_ 4y ago
so people should just keep using cameras that can be trivially disabled with some off the shelf device with one button? > Next we just need WiFi jammer alarms. i think youve taken a wrong turn somewhere...
rlpb 4y ago
> I went with building an isolated network, but I think that's outside the relm of what most consumers can do. An off-the-shelf consumer PVR that uses wired ethernet typically has its own integrated PoE switch on its own subnet. Maybe it will route to your LAN if you probe the private ranges, but it's also a fairly straightforward software issue to fix - nothing fundamental to the arrangement, and at no additional marginal cost.

jmuguy 4y ago

Wouldn't you, ya know, see a baddie disconnecting/destroying your camera and connecting their CP downloading device or whatever they're planning to do on your network?

leoh 4y ago

Certainly there are protocols that require authentication over ethernet like https://en.wikipedia.org/wiki/IEEE_802.1X https://en.wikipedia.org/wiki/IEEE_802.1X

stonepresto 4y ago
I don't think that prevents MAC spoofing
_flux 4y ago
But how many cameras support them?
yCloser 4y ago
or simply set up another vlan for the cameras (and this does not require any configuration on the cameras, just on the switch)
- chinathrow 4y ago
  That's what OP did and said: "... but I think that's outside the relm of what most consumers can do."
- autoexec 4y ago
  Why not a physically separate network? If all you care about is catching outside problems like porch pirates, car thieves, and dogs owners who don't clean up after their pets just run cables from each camera to a switch that's connected to a single machine that isn't on your network or the internet. Cameras inside the house get internet access, so intruders can't just walk off with your footage, but external camera feeds are fine to be stored locally. That'd take very little skill to set up, prevents anyone from using those external connections to get at the rest of your network or abuse your internet connection,you don't have to worry about jammers, the police won't be accessing your feed whenever they feel like it, and Amazon won't be keeping detailed logs of everyone who comes to your door, how often you have company over, what your daily/weekly schedule is like, how often you get food delivered, what kinds of clothing you and your guests are wearing, how many children are in your home, how many pets, how often you go out on the weekends vs staying inside, how often you vacation and for how long, how many friends you have, how often you have non-amazon packages delivered, what kind of car you drive, etc
  - bsenftner 4y ago
    This is the way to go. Any other way is just lazy.
    - ryandrake 4y ago
      I take the lazy VLAN route, then. Ideally, I can plan all this out during construction, and run conduit through all walls, have electrical outlets near each ideal switch location, and so on. But in most homes that are not previously owned by tech-geeks, re-wiring properly means busting down drywall. If you own the home, it's a major pain, and if you rent, it's impossible. Typically the things on my home network that need to be isolated and/or revoked Internet access are not in physical proximity with one another, so using a separate switch for them means a lot more wiring. It is much simpler to just run devices to the nearest already existing switch and do the isolation in software. This also cuts down on the number of switches which means fewer points of failure.

Gigachad 4y ago

What use is getting access to the network these day anyway? Everything has moved to a model of not trusting the network or anything else on it. I guess they could cast something to your chrome cast?

feanaro 4y ago
Are you sure everything has? Smart appliances in particular are typically terrible with security, so having access to their network certainly gives you an edge.
- sydd 4y ago
  So what would a robber do with them? Turn off your refrigerator? Cancel your scheduled washing program? Install some malware? Usually it's meth heads trying to steal something that is easy to grab not the CIA.
gorgoiler 4y ago
The attack I worry about is neighbourhood teenagers using my internet connection for lolz. I imagine them downloading movies and images that get me into trouble with the wife / LEAs / both.
- sebzim4500 4y ago
  How is your wife going to find out what has been downloaded over your network?
  - iinnPP 4y ago
    knock knock knock I'm Dick with the FBI. Is your husband home?
    - gorgoiler 4y ago
      Yes you are both right to correct me. I will get in trouble with my wife because the feds will rat me out to her for something stupid these hypothetical kids end up doing.

aarobot 4y ago

Aren't wired cameras fine as long as you use a virtual LAN network for them and don't place them inside?

arminiusreturns 4y ago
I suggest a physically separate network for ip based security systems. The GPs concerns are also why most wired CCTV at the higher end is often not ethernet, but there are ways to secure ethernet even externally (camera housings that are basically safes, very high placement that would require a ladder to get to, etc)
- walterbell 4y ago
  What's a good search term for makers/retailers of "camera housings that are basically safes"?
  - arminiusreturns 4y ago
    The term you are looking for is "high-security", which covers the private industry side, DoD has others at play. Also dont forget the value of having custom welding done.
    - walterbell 4y ago
      Thanks, my initial search found cameras for oil rigs, which minimized sparks :) I've used carriage bolts to reinforce steel enclosures, with single-use wire rope seals for tamper detection on covers, minimizing exposure of the clamping point. Axis P1204 has a small camera sensor separated from the camera body by a 25' cable, which makes it easier to enclose and secure the camera body. Not seen that elsewhere, must be a proprietary protocol on that cable, e.g. RPi camera sensor cables can only be a few cm.
  - jhoelzel 4y ago
    i just bought a reolink RLC-823A Smart 8MP PTZ PoE Camera with Spotlights It is build like a tank and fully aluminium. If you mount it right you easily can hold a person from it. I bascially made a hole through the wall for the cables and mounted it directly to the outside wall. For now im quite confident that nobody will be able to remove it without much fuzz

feanaro 4y ago

> I went with building an isolated network, but I think that's outside the relm of what most consumers can do. A bit off topic, but can we please stop calling people "consumers"? It's such a weird and patronising term, not to mention completely unnecessary when "people" does a better job.

tomcam 4y ago
I would wager most of us consumers don’t care
NavinF 4y ago
It's an accurate term. "Consumer" as opposed to prosumer, enthusiast, and professional.
x-complexity 4y ago
> can we please stop calling people "consumers"? It's such a weird and patronising term, not to mention completely unnecessary when "people" does a better job. "Consumer" IS the technically more accurate term, as outside of the consumption of tech/services as designed for them, they do not venture beyond that realm & try to understand how the tech works. Similar analogies include: - Not caring about how a car works internally, & leaving its repair & maintenance to a mechanic. - Not caring about how their dishes were made, & leaving that to cooks/chefs. - Not caring about the minutiae of the law, & leaving that to the legal system & its lawyers & judges. - Not caring about sewer maintenance, & leaving that for sewage workers. - Not caring about recyclables processing, & leaving that for recycling plants. - Not caring about Y, and leaving that for (workers/entities that work with Y). All of us are consumers in some form or another: We require the services of others that require the services of others that require the services of others ad infinitum.
Out_of_Characte 4y ago
I think consumer/customer is the right term in this situation. Even though I could build an isolated network with ethernet cables and security camera's, we're usually left with the other people, myself included, that wouldn't always be able to do research and come up with the best solution. That's why I want to outsource that by purchasing something. Which is why we're left with this freemarket of vulnerable devices and practises. People setting up security camera's usually do a good job. Consumers do not.

hutzlibu 4y ago

"She had gotten into two other houses that night. She was also tripped out on meth and couldn't have operated a WiFi jammer if she wanted to." You left out the dramatic details. So you stopped and confronted her directly yourself, or called the police who caught her(later)? (In general, it is not advisable to confront meth addicts, they might be armed and not restrained in any way.)

varispeed 4y ago

I had WiFi cameras until my friend showed me how his cameras were jammed when his neighbour had a broad daylight burglary. A van pulled up and a second later the video was completely jammed. Then five minutes later it comes back to normal, but neighbour doors were smashed in. So I got a wired network now, on a separate LAN and have two cameras on each perimeter, so if someone tries to cut the cable (unfortunately I was unable to run the cables inside the wall, so they run in PVC pipes attached to the wall), I very least should have that recorded. Also all my cameras are 4k. The cameras also record to built in SD card. There are also two servers hidden each is pulling the videos from DVR to back up and then one copy is uploaded to external server.

nikau 4y ago

Worth noting even the cheapest router chipsets normally support vlan tagging, so with a sub $100 router you can flash an opensource firmware on it like openwrt and then isolate network traffic on each port and filter it with iptables.

dk775 4y ago
Can you provide an easy guide for net gear Vlan? I am pretty good w computers but some reason can never figure out how to set up
- nikau 4y ago
  Not sure how easy it is, but its documented pretty thoroughly on the openwrt dooco: https://openwrt.org/docs/guide-user/network/vlan/switch_configuration https://openwrt.org/docs/guide-user/network/vlan/switch_conf...

omegalulw 4y ago

I think you can encrypt ethernet comms too using 802.1x RADIUS. That's as secure as Wi-Fi and removes the need for an isolated network (which, when unencrypted isn't as secure as you think, e.g. MiTM). Ideally you connect via both but that's overkill for most use cases.

da768 4y ago
802.1x only authenticates devices, there's no encryption whatsoever past that point. You'd need MACsec or a VPN connection to prevent tapping.

donkeyd 4y ago

> So, yea, a WiFi camera isn't great, but it's still going to get 99% of criminals out there. Next we just need WiFi jammer alarms. All we need is onboard storage to record a couple hours of video locally which can then be synced when the connection is back again. Right? That doesn't fix real-time information transmission, but video is most often important for finding suspects after the fact.

closeparen 4y ago
Someone sophisticated enough to run a deauth attack is sophisticated enough to grab the memory card out of the camera.
- joshjje 4y ago
  Put a very small/hidden backup camera somewhere, so they take out the main one and think they're all good.
- wickedsight 4y ago
  Sophisticated criminals don't bring ladders to climb in order to fiddle with SD card slots. They want easy in and easy out. And they usually wear masks, so the video you do record are useless anyway.
richrichardsson 4y ago
> finding suspects after the fact Sounds like you think law enforcement actually give a shit about/can do anything toward solving burglary crime. Maybe it's better in other countries, but 5% solve rate sounds like they go and knock on the doors of the local known burglars to see if they still got the goods lying around. https://www.theguardian.com/uk-news/2018/jun/17/figures-less-than-5-of-burglaries-and-robberies-in-uk-solved https://www.theguardian.com/uk-news/2018/jun/17/figures-less...
- donkeyd 4y ago
  I actually work in LE and video from domestic and commercial security cameras are always a major piece of information that we look for in every single investigation. So... Yes, LE gives a shit in many countries. However, also in many countries, like my own, police is very under staffed and burglaries are often on the bottom of the priorities list. Armed robberies, murders, shootings, stabbings, explosions, fires, domestic abuse, rape, to name a few, are the ones that get the highest priority. And those things take a lot of work to find suspects, prove what they're suspected of, write it down and get them convicted. A case, unfortunately, isn't finished when you catch a suspect. It's a crap load of work to get someone convicted and that gets massively underestimated by people who only read statistics and conclude that LE doesn't care... Most of us do, which is why we join the field.

ynbl_ 4y ago

so people should just keep using cameras that can be trivially disabled with some off the shelf device with one button? > Next we just need WiFi jammer alarms. i think youve taken a wrong turn somewhere...

rlpb 4y ago

> I went with building an isolated network, but I think that's outside the relm of what most consumers can do. An off-the-shelf consumer PVR that uses wired ethernet typically has its own integrated PoE switch on its own subnet. Maybe it will route to your LAN if you probe the private ranges, but it's also a fairly straightforward software issue to fix - nothing fundamental to the arrangement, and at no additional marginal cost.