7 ms·

Child pornography on sale from hacked Hikvision cameras using Hik-Connect app

51 points by fortran77 3y ago

fortran77 3y ago
[flagged]
- turnsout 3y ago
  And people wonder why I bought an old school baby monitor with no internet connection…
  - hgsgm 3y ago
    "old". My friend's were surprised when I bought a monitor that had video.
  - halJordan 3y ago
    No one is wondering why
    - pipeline_peak 3y ago
      He meant outside of HN…
  - jeffbee 3y ago
    I cannot think of one single way in which a baby monitor is “old school”.
    - deleted 3y ago
      [deleted]
    - nickthegreek 3y ago
      The first baby monitor was used in 1937. https://en.m.wikipedia.org/wiki/Baby_monitor https://en.m.wikipedia.org/wiki/Baby_monitor
      - jeffbee 3y ago
        In the history of ways of rearing babies that's the same as yesterday.
- starcraft2wol 3y ago
  The employer didn't know he was a killer until later. How is this relevant? Are you indicating the kinds of people who might be attracted to this work?
bell-cot 3y ago
Daydream: At some level of such child-safety f*uck-ups, the company's exec's get to spend the rest of their lives in brightly-lit plexiglass jail cells. Naked. Surrounded by publicly accessible web cams.
trompetenaccoun 3y ago
Surveillance is bad enough as it is, I'll never understand why some people install internet-connected CCTV inside their own homes. What's that even for, spying on your family members? Using a brand like Hikvision is the bizarre cherry on top.
- jayski 3y ago
  I have exactly those Hikconnect all over my house. I always felt unsafe about them. My house doesn't have a static IP, so obviously the only way for me to connect to them when I'm away is through an intermediary Having some technical networking knowledge I disconnected them from the Internet and set up a VPN where my wife and I first have to connect to prior to viewing the cameras. Why do I surveil my own home? Because I have small children, when my wife and I go out and they stay with a baby sitter it gives us peace of mind to have the ability to verify everything is good. Also although we trust the sitters, we trust them even more knowing they know there's cameras. Why did I get the cheap ass sketchy cameras? Cause I'm a cheap ass. The system I have cost about 2K with installation and spending 2 or 3x was outside our budget.
  - unforeseen9991 3y ago
    > My house doesn't have a static IP, so obviously the only way for me to connect to them when I'm away is through an intermediary Dynamic DNS record services have been around almost since the beginning of the public internet, and it's not the only way to deal with a remote location that has a changing IP address. It's far from "obviously the only way for you to connect" - you are just ignorant of your options
- scruple 3y ago
  We use ours when we're away from home but have people in our home to watch our pets. Otherwise, they're unplugged and sitting in a drawer in my home office.
- JumpCrisscross 3y ago
  > I'll never understand why some people install internet-connected CCTV inside their own homes. What's that even for, spying on your family members? In case someone breaks in. To keep an eye on the housekeeper. This past winter an ice dam sprung a leak in the roof. I was there and caught it promptly. But had I been away, the damage would have been severe. Cameras would have let me keep an eye on that. I don't think it's worth the tradeoff in terms of privacy. But I can understand someone else deciding differently.
shudza 3y ago
These ip cameras have 2-3 different backdoors, which are even easy to discover. Probably more not so easy ones. If you have this in your home disable outgoing connections at router level, and you're safe.
- formerly_proven 3y ago
  > If you have this in your home disable outgoing connections at router level, and you're safe. This is bad advice and people should stop posting it. An IP or MAC based rule does not prevent a malicious device from exfiltrating data and neither does it protect a vulnerable device from other devices in the network. IP cameras must be installed with a separate broadcast domain. Be that a separate switch or a port-based VLAN. The only connection if any should be through the trusted NVR/VMS.
  - shudza 3y ago
    > An IP or MAC based rule does not prevent a malicious device from exfiltrating data Care to elaborate?
    - formerly_proven 3y ago
      Who is filling those header fields in? The malicious device.
saetaes 3y ago
I bought some cheap IP cameras to monitor our cabin while we're not there, and every single time we arrive I unplug them. This makes me feel vindicated that I'm not just paranoid; the creeps really are one buggy firmware away from selling videos of your family on the Internet.
CCRpoundher 3y ago
Stuff like this is why I believe software engineering ought to start requiring a professional license.
- throw_m239339 3y ago
  > Stuff like this is why I believe software engineering ought to start requiring a professional license. So the developer goes to jail in case of negligence? Not the executives who actually forced bad decisions? Like in the car industry? No. The people here who are pushing for a license to deploy anything every time there is a hacking scandal somewhere just want to stifle innovation, and eliminate competition and create their own little "developer elite" with themselves as gatekeepers.
  - the_only_law 3y ago
    I just want to know what the certification examination that somehow is going to determine the worthiness of every developer across every domain look like.
- insanitybit 3y ago
  That's definitely a very spicy take but I think people need to be more willing to engage with the idea. There is a serious problem where software engineers are building systems that, when built poorly, are causing significant harm. If we don't engage with that problem we're going to get regulated in a way that we may not like. edit: Look at how many comments are just attacking a straw man policy. This is why we're going to end up getting regulated in some dumb way - people can't or won't even imagine a situation better than this one.
  - ryandrake 3y ago
    This is one of the few opinions which are consistently rejected by the HN peanut gallery, unsurprisingly since most of us are developers. OP is brave to outright say it! Any time you bring up the idea of accountability to “engineers” for defects in their software that cause serious, real life harm, you get a litany of excuses in response, instead of good faith debate. If an engineer signs off on a bridge and it collapses, injuring a dozen people, there will at the very least be questions asked, if not more accountability. But if a software engineer implements a shoddy system that gets hacked and results in this kind of very personal data getting exfiltrated, all you get is 1,000 versions of “it’s not the developers’ fault!” and “they were probably under an impossible deadline!” And “bad manager told them what to implement, they had no choice!” and “the market forces this, careful developers can’t compete!” and so on. Saying there should be licensure with revocation as a consequence in extreme cases? Now that’s crazy-talk here!
fareesh 3y ago
Is there a way to remotely control a Hikvision camera with open source software without using their cloud? I have a PTZ camera which works well but I rarely use it
- squarefoot 3y ago
  If the camera is ONVIF compatible, and most Hikvision are, it should work with Zoneminder and its mobile Open Source app zmninja. As for the cloud, if you have a public (not necessarily static) IP and your carrier doesn't filter incoming connections, you can use a dynamic DNS such as DuckDNS. It is however always advisable to put all cameras behind a firewall, so that whatever it could happen (compromised or not, it still runs a closed firmware) it can be restricted to a dedicated physical network with no access to any personal data. https://zoneminder.com/ https://zoneminder.com/ https://zmninja.zoneminder.com/ https://zmninja.zoneminder.com/ https://www.duckdns.org/ https://www.duckdns.org/
PaulAJ 3y ago
I use a Raspberry Pi, cheap USB webcam and https://raspberry-valley.azurewebsites.net/MotionEye-OS/ https://raspberry-valley.azurewebsites.net/MotionEye-OS/ Motion Eye to watch out for intruding cats coming through the cat flap. Entirely open source, completely under my control, and simple to set up. What's not to like?
- nbernard 3y ago
  Among the cheap USB webcams, any model you would recommend ?
kypro 3y ago
My autistic sense of morality is off a little with this. My guess is that this type of thing happens far more often to unsuspecting adult women simply using public changing rooms or public bathrooms, etc. My guess is that the child-incidents here are much fewer and far between and rarely ever publicly shared – and when they are shared (even if not publicly) it's taken extremely seriously by law enforcement (as it should be). On the other hand, I get the impression that it's relatively easy to find this type content featuring adult women on popular porn / social networks – at least I see stuff that looks suspicious quite often on sites like Reddit and 4chan. I really wish more focus was put on the "revenge porn" / "hidden camera" area generally. It's quite sad that so many women are victims to this and as a society we don't really seem to care unless a child is involved. In fact I'd argue our society and media almost normalises perving on adult women. Just search for any random famous celeb women and there's probably a dozen popular sites with nude or semi-nude photos of her taken by some perv spying on her during vacation. Anyone care to put some effort into stopping that? Why is that content even allowed on the public internet?
- TazeTSchnitzel 3y ago
  > Why is that content even allowed on the public internet? Consenting adults can do whatever they like, including creating consensual/fake hidden camera pornography, and there's quite some market for such content. In general, at a glance, there's no way to distinguish legitimate from illegitimate content, no matter the pornographic (or other) genre. So how do you know what's illegal and what's not? It's by no means easy to solve at the level of an individual piece, let alone at scale. Many of the proposed solutions amount to mass surveillance, invade the privacy of performers, or make it so onerous to upload pornography that they effectively amount to bans of it. It's no secret that the Christian Right are quietly supportive of certain “anti-exploitation” approaches because they would destroy the market for legal pornography, putting sex workers out of work. It's a very difficult balancing act and no position avoids harming someone.
- deleted 3y ago
  [deleted]
- htag 3y ago
  Society takes the child-incidents more seriously because of how much more vulnerable children are to predators and how much trauma a predator can inflict. We take a snip it in the bud approach with anyone involved in these crimes. I agree that what you are talking about is terrible, and if law enforcement had unlimited resources we would stop all of that activity too.
megraf 3y ago
I might be reading this different than most; I read this as: "these cameras are being used as a storage medium for Child Pornography, and content is being shared by leveraging Hik Connect" Not necessarily that the cameras were doing the capturing.
- jhonovich 3y ago
  The cameras are doing the capturing, I can confirm (IPVM employee).
gumballindie 3y ago
Never use cameras than rely on some dubious (or even on legit) cloud “providers”. Heck knows that employees do with the content. I bought a baby monitor off of amazon once only to discover it sends content somewhere in china. Never again. Went for a local radio based monitor and called it a day. Ring doorbells have their camera off when at home. Also they are pointed towards objects (door or parked car).
- Saris 3y ago
  Yup, my setup is local RTSP cameras with firewall rules to completely block traffic to/from them, local Frigate server that pulls the stream and runs object recognition and handles recording, and then a Wireguard VPN if I need access from outside the local network. It's been very reliable, has no fees, and I'm not worried about cameras being hacked or cloud storage issues.
  - gumballindie 3y ago
    Damn, that’s impressive! I am adopting your architecture - you should def blog about it in case you haven't already.

51 points by fortran77 3y ago

fortran77 3y ago

[flagged]

turnsout 3y ago
And people wonder why I bought an old school baby monitor with no internet connection…
- hgsgm 3y ago
  "old". My friend's were surprised when I bought a monitor that had video.
- halJordan 3y ago
  No one is wondering why
  - pipeline_peak 3y ago
    He meant outside of HN…
- jeffbee 3y ago
  I cannot think of one single way in which a baby monitor is “old school”.
  - deleted 3y ago
    [deleted]
  - nickthegreek 3y ago
    The first baby monitor was used in 1937. https://en.m.wikipedia.org/wiki/Baby_monitor https://en.m.wikipedia.org/wiki/Baby_monitor
    - jeffbee 3y ago
      In the history of ways of rearing babies that's the same as yesterday.
starcraft2wol 3y ago
The employer didn't know he was a killer until later. How is this relevant? Are you indicating the kinds of people who might be attracted to this work?

bell-cot 3y ago

Daydream: At some level of such child-safety f*uck-ups, the company's exec's get to spend the rest of their lives in brightly-lit plexiglass jail cells. Naked. Surrounded by publicly accessible web cams.

trompetenaccoun 3y ago

Surveillance is bad enough as it is, I'll never understand why some people install internet-connected CCTV inside their own homes. What's that even for, spying on your family members? Using a brand like Hikvision is the bizarre cherry on top.

jayski 3y ago
I have exactly those Hikconnect all over my house. I always felt unsafe about them. My house doesn't have a static IP, so obviously the only way for me to connect to them when I'm away is through an intermediary Having some technical networking knowledge I disconnected them from the Internet and set up a VPN where my wife and I first have to connect to prior to viewing the cameras. Why do I surveil my own home? Because I have small children, when my wife and I go out and they stay with a baby sitter it gives us peace of mind to have the ability to verify everything is good. Also although we trust the sitters, we trust them even more knowing they know there's cameras. Why did I get the cheap ass sketchy cameras? Cause I'm a cheap ass. The system I have cost about 2K with installation and spending 2 or 3x was outside our budget.
- unforeseen9991 3y ago
  > My house doesn't have a static IP, so obviously the only way for me to connect to them when I'm away is through an intermediary Dynamic DNS record services have been around almost since the beginning of the public internet, and it's not the only way to deal with a remote location that has a changing IP address. It's far from "obviously the only way for you to connect" - you are just ignorant of your options
scruple 3y ago
We use ours when we're away from home but have people in our home to watch our pets. Otherwise, they're unplugged and sitting in a drawer in my home office.
JumpCrisscross 3y ago
> I'll never understand why some people install internet-connected CCTV inside their own homes. What's that even for, spying on your family members? In case someone breaks in. To keep an eye on the housekeeper. This past winter an ice dam sprung a leak in the roof. I was there and caught it promptly. But had I been away, the damage would have been severe. Cameras would have let me keep an eye on that. I don't think it's worth the tradeoff in terms of privacy. But I can understand someone else deciding differently.

shudza 3y ago

These ip cameras have 2-3 different backdoors, which are even easy to discover. Probably more not so easy ones. If you have this in your home disable outgoing connections at router level, and you're safe.

formerly_proven 3y ago
> If you have this in your home disable outgoing connections at router level, and you're safe. This is bad advice and people should stop posting it. An IP or MAC based rule does not prevent a malicious device from exfiltrating data and neither does it protect a vulnerable device from other devices in the network. IP cameras must be installed with a separate broadcast domain. Be that a separate switch or a port-based VLAN. The only connection if any should be through the trusted NVR/VMS.
- shudza 3y ago
  > An IP or MAC based rule does not prevent a malicious device from exfiltrating data Care to elaborate?
  - formerly_proven 3y ago
    Who is filling those header fields in? The malicious device.

saetaes 3y ago

I bought some cheap IP cameras to monitor our cabin while we're not there, and every single time we arrive I unplug them. This makes me feel vindicated that I'm not just paranoid; the creeps really are one buggy firmware away from selling videos of your family on the Internet.

CCRpoundher 3y ago

Stuff like this is why I believe software engineering ought to start requiring a professional license.

throw_m239339 3y ago
> Stuff like this is why I believe software engineering ought to start requiring a professional license. So the developer goes to jail in case of negligence? Not the executives who actually forced bad decisions? Like in the car industry? No. The people here who are pushing for a license to deploy anything every time there is a hacking scandal somewhere just want to stifle innovation, and eliminate competition and create their own little "developer elite" with themselves as gatekeepers.
- the_only_law 3y ago
  I just want to know what the certification examination that somehow is going to determine the worthiness of every developer across every domain look like.
insanitybit 3y ago
That's definitely a very spicy take but I think people need to be more willing to engage with the idea. There is a serious problem where software engineers are building systems that, when built poorly, are causing significant harm. If we don't engage with that problem we're going to get regulated in a way that we may not like. edit: Look at how many comments are just attacking a straw man policy. This is why we're going to end up getting regulated in some dumb way - people can't or won't even imagine a situation better than this one.
- ryandrake 3y ago
  This is one of the few opinions which are consistently rejected by the HN peanut gallery, unsurprisingly since most of us are developers. OP is brave to outright say it! Any time you bring up the idea of accountability to “engineers” for defects in their software that cause serious, real life harm, you get a litany of excuses in response, instead of good faith debate. If an engineer signs off on a bridge and it collapses, injuring a dozen people, there will at the very least be questions asked, if not more accountability. But if a software engineer implements a shoddy system that gets hacked and results in this kind of very personal data getting exfiltrated, all you get is 1,000 versions of “it’s not the developers’ fault!” and “they were probably under an impossible deadline!” And “bad manager told them what to implement, they had no choice!” and “the market forces this, careful developers can’t compete!” and so on. Saying there should be licensure with revocation as a consequence in extreme cases? Now that’s crazy-talk here!

fareesh 3y ago

Is there a way to remotely control a Hikvision camera with open source software without using their cloud? I have a PTZ camera which works well but I rarely use it

squarefoot 3y ago
If the camera is ONVIF compatible, and most Hikvision are, it should work with Zoneminder and its mobile Open Source app zmninja. As for the cloud, if you have a public (not necessarily static) IP and your carrier doesn't filter incoming connections, you can use a dynamic DNS such as DuckDNS. It is however always advisable to put all cameras behind a firewall, so that whatever it could happen (compromised or not, it still runs a closed firmware) it can be restricted to a dedicated physical network with no access to any personal data. https://zoneminder.com/ https://zoneminder.com/ https://zmninja.zoneminder.com/ https://zmninja.zoneminder.com/ https://www.duckdns.org/ https://www.duckdns.org/

PaulAJ 3y ago

I use a Raspberry Pi, cheap USB webcam and https://raspberry-valley.azurewebsites.net/MotionEye-OS/ https://raspberry-valley.azurewebsites.net/MotionEye-OS/ Motion Eye to watch out for intruding cats coming through the cat flap. Entirely open source, completely under my control, and simple to set up. What's not to like?

nbernard 3y ago
Among the cheap USB webcams, any model you would recommend ?

kypro 3y ago

My autistic sense of morality is off a little with this. My guess is that this type of thing happens far more often to unsuspecting adult women simply using public changing rooms or public bathrooms, etc. My guess is that the child-incidents here are much fewer and far between and rarely ever publicly shared – and when they are shared (even if not publicly) it's taken extremely seriously by law enforcement (as it should be). On the other hand, I get the impression that it's relatively easy to find this type content featuring adult women on popular porn / social networks – at least I see stuff that looks suspicious quite often on sites like Reddit and 4chan. I really wish more focus was put on the "revenge porn" / "hidden camera" area generally. It's quite sad that so many women are victims to this and as a society we don't really seem to care unless a child is involved. In fact I'd argue our society and media almost normalises perving on adult women. Just search for any random famous celeb women and there's probably a dozen popular sites with nude or semi-nude photos of her taken by some perv spying on her during vacation. Anyone care to put some effort into stopping that? Why is that content even allowed on the public internet?

TazeTSchnitzel 3y ago
> Why is that content even allowed on the public internet? Consenting adults can do whatever they like, including creating consensual/fake hidden camera pornography, and there's quite some market for such content. In general, at a glance, there's no way to distinguish legitimate from illegitimate content, no matter the pornographic (or other) genre. So how do you know what's illegal and what's not? It's by no means easy to solve at the level of an individual piece, let alone at scale. Many of the proposed solutions amount to mass surveillance, invade the privacy of performers, or make it so onerous to upload pornography that they effectively amount to bans of it. It's no secret that the Christian Right are quietly supportive of certain “anti-exploitation” approaches because they would destroy the market for legal pornography, putting sex workers out of work. It's a very difficult balancing act and no position avoids harming someone.
deleted 3y ago
[deleted]
htag 3y ago
Society takes the child-incidents more seriously because of how much more vulnerable children are to predators and how much trauma a predator can inflict. We take a snip it in the bud approach with anyone involved in these crimes. I agree that what you are talking about is terrible, and if law enforcement had unlimited resources we would stop all of that activity too.

megraf 3y ago

I might be reading this different than most; I read this as: "these cameras are being used as a storage medium for Child Pornography, and content is being shared by leveraging Hik Connect" Not necessarily that the cameras were doing the capturing.

jhonovich 3y ago
The cameras are doing the capturing, I can confirm (IPVM employee).

gumballindie 3y ago

Never use cameras than rely on some dubious (or even on legit) cloud “providers”. Heck knows that employees do with the content. I bought a baby monitor off of amazon once only to discover it sends content somewhere in china. Never again. Went for a local radio based monitor and called it a day. Ring doorbells have their camera off when at home. Also they are pointed towards objects (door or parked car).

Saris 3y ago
Yup, my setup is local RTSP cameras with firewall rules to completely block traffic to/from them, local Frigate server that pulls the stream and runs object recognition and handles recording, and then a Wireguard VPN if I need access from outside the local network. It's been very reliable, has no fees, and I'm not worried about cameras being hacked or cloud storage issues.
- gumballindie 3y ago
  Damn, that’s impressive! I am adopting your architecture - you should def blog about it in case you haven't already.