3 ms·

There's no link to that post and I can't find it in other ways. I'm really not sure if this is real. There's also no mention how they're accessible. If it's not

There's no link to that post and I can't find it in other ways. I'm really not sure if this is real. There's also no mention how they're accessible. If it's not accessible from public networks... who cares?

jabroni_salad 1y ago
I think this is it: https://archive.is/l0web https://archive.is/l0web Maybe one of the reasons the poster did not want to link the article is because the audit this finding is from was conducted 11 years ago.
acuozzo 1y ago
> If it's not accessible from public networks... who cares? Thieves, especially if there's a path to the room in which the cameras are accessed which is poorly covered by the camera distribution.
lurking_swe 1y ago
This is security best practices 101 stuff. :) See the swiss cheese model, which applies here: https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model It’s not smart to rely on a single point of failure to protect everything 100%. Maybe if you’re protecting home movies lol. But at the Louvre? Sheesh… - What if the routers / modems have a security vulnerability? - What if there’s (accidentally) an exposed ethernet cable somewhere in the museum that would let someone immediately access a private VLAN? - What if someone breaks into the security room? either physically breaking the door down or stealing the keys to the room. That’s one of the first few passwords i’d guess as a thief.
- viraptor 1y ago
  Nobody said anything about a single point of failure. Just that we need more context to figure out how important this is. Kind of like the zeros for the US nuclear weapons https://www.zmescience.com/other/offbeat-other/us-nuclear-launch-code-00000000-repubz/ https://www.zmescience.com/other/offbeat-other/us-nuclear-la... > What if someone breaks into the security room? Normally a security / monitoring room has the cameras on the screen 24/7, so once you somehow get in and somehow there's nobody there and somehow nobody notices you breaking in... you just look at the screen.
  - lurking_swe 1y ago
    I agree it is hard to assess the impact just for that article alone. Regarding the security room - sure the feed is live on the screen. That makes sense. But I would definitely expect more “admin” related features to require a login though. Like deleting footage, disabling a specific camera, etc.

jabroni_salad 1y ago

I think this is it: https://archive.is/l0web https://archive.is/l0web Maybe one of the reasons the poster did not want to link the article is because the audit this finding is from was conducted 11 years ago.

acuozzo 1y ago

> If it's not accessible from public networks... who cares? Thieves, especially if there's a path to the room in which the cameras are accessed which is poorly covered by the camera distribution.

lurking_swe 1y ago

This is security best practices 101 stuff. :) See the swiss cheese model, which applies here: https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model It’s not smart to rely on a single point of failure to protect everything 100%. Maybe if you’re protecting home movies lol. But at the Louvre? Sheesh… - What if the routers / modems have a security vulnerability? - What if there’s (accidentally) an exposed ethernet cable somewhere in the museum that would let someone immediately access a private VLAN? - What if someone breaks into the security room? either physically breaking the door down or stealing the keys to the room. That’s one of the first few passwords i’d guess as a thief.

viraptor 1y ago
Nobody said anything about a single point of failure. Just that we need more context to figure out how important this is. Kind of like the zeros for the US nuclear weapons https://www.zmescience.com/other/offbeat-other/us-nuclear-launch-code-00000000-repubz/ https://www.zmescience.com/other/offbeat-other/us-nuclear-la... > What if someone breaks into the security room? Normally a security / monitoring room has the cameras on the screen 24/7, so once you somehow get in and somehow there's nobody there and somehow nobody notices you breaking in... you just look at the screen.
- lurking_swe 1y ago
  I agree it is hard to assess the impact just for that article alone. Regarding the security room - sure the feed is live on the screen. That makes sense. But I would definitely expect more “admin” related features to require a login though. Like deleting footage, disabling a specific camera, etc.