3 ms·

http://krebsonsecurity.com/2014/01/bug-exposes-ip-cameras-baby-monitors/ http://krebsonsecurity.com/2014/01/bug-exposes-ip-cameras-ba... "The issue came to lig

by ipsin 12y ago

http://krebsonsecurity.com/2014/01/bug-exposes-ip-cameras-baby-monitors/ http://krebsonsecurity.com/2014/01/bug-exposes-ip-cameras-ba... "The issue came to light on the company’s support forum after camera experts discovered that the Web interface for many Foscam cameras can be accessed simply by pressing “OK” in the dialog box when prompted for a username and password." I understand that using this security hole to yell at a baby makes you a terrible person, but I'm also appalled at the company that made that situation possible for so many of its customers.

primitivesuave 12y ago
It takes a reasonably intelligent programmer to identify a security hole, and an entire team of foolish programmers to let one through. It's quite evident that this company only has the latter.
- fleitz 12y ago
  It's not a team, all you need is one fucking idiot who sometime in the 80s once wrote some software that ended up on a satellite. After that everyone will believe whatever that idiot says. I once spent two hours arguing as to why using a single static AES key for encryption on an app used by millions of people rather than just use SSL was a bad idea, they talked about how secure it was, etc, etc. After that frustration I went drinking, when I came back, I discovered that their shitty encryption system had a 4 byte field for how big the message was, I sent 256 requests 20 byte requests to that system with message 'sizes' of 0xFFFFFF00-0xFFFFFFFF and watched as the server consumed about 64 GB of RAM before falling over. (It was a .NET app so a request of that size has to go into gen3, since the subsequent requests are larger they can't reuse the existing block) Then I openly mocked them in the next meeting, they still went with their shitty encryption system because it was 'good enough' and apparently faster than SSL.
  - hhsnopek 12y ago
    I hate when this occurs, people would rather go with their implementation rather than have their own pride suffer.
    - jacquesm 12y ago
      http://en.wikipedia.org/wiki/Not_invented_here http://en.wikipedia.org/wiki/Not_invented_here
- r00fus 12y ago
  While this is the case, I think it's pretty obvious that until this sort of thing happens, security is still seen as a "tack on", and treated like any feature (i.e., might be tested, might simply be released and let users find the bugs). Similarly, I had a previous experience with a Software VPN provider that simply let my Mac client login without any credentials. I was completely unsurprised.
- kjs3 12y ago
  They probably don't have any programmers except one or two guys who brand the code with their messages and logo and such. Products like this are very often OEM'ed from another shop, who may OEM the code from one or more other shops. It's like sausage, and they might not have a clue what's in there. Someone's a shitty coder, but who knows for sure who this far down the supply chain.
- PeterisP 12y ago
  If the definition of a "team of foolish programmers" is letting a security hole through, then 100% of teams consist of foolish programmers. Practical evidence shows that a baby monitoring webcam created by a team of the world best security experts will still have security holes and stupid errors; for examples see any security software ever written - OpenSSL Heartbleed is not an exception, but business as usual.

by ipsin 12y ago

primitivesuave 12y ago

It takes a reasonably intelligent programmer to identify a security hole, and an entire team of foolish programmers to let one through. It's quite evident that this company only has the latter.

fleitz 12y ago
It's not a team, all you need is one fucking idiot who sometime in the 80s once wrote some software that ended up on a satellite. After that everyone will believe whatever that idiot says. I once spent two hours arguing as to why using a single static AES key for encryption on an app used by millions of people rather than just use SSL was a bad idea, they talked about how secure it was, etc, etc. After that frustration I went drinking, when I came back, I discovered that their shitty encryption system had a 4 byte field for how big the message was, I sent 256 requests 20 byte requests to that system with message 'sizes' of 0xFFFFFF00-0xFFFFFFFF and watched as the server consumed about 64 GB of RAM before falling over. (It was a .NET app so a request of that size has to go into gen3, since the subsequent requests are larger they can't reuse the existing block) Then I openly mocked them in the next meeting, they still went with their shitty encryption system because it was 'good enough' and apparently faster than SSL.
- hhsnopek 12y ago
  I hate when this occurs, people would rather go with their implementation rather than have their own pride suffer.
  - jacquesm 12y ago
    http://en.wikipedia.org/wiki/Not_invented_here http://en.wikipedia.org/wiki/Not_invented_here
r00fus 12y ago
While this is the case, I think it's pretty obvious that until this sort of thing happens, security is still seen as a "tack on", and treated like any feature (i.e., might be tested, might simply be released and let users find the bugs). Similarly, I had a previous experience with a Software VPN provider that simply let my Mac client login without any credentials. I was completely unsurprised.
kjs3 12y ago
They probably don't have any programmers except one or two guys who brand the code with their messages and logo and such. Products like this are very often OEM'ed from another shop, who may OEM the code from one or more other shops. It's like sausage, and they might not have a clue what's in there. Someone's a shitty coder, but who knows for sure who this far down the supply chain.
PeterisP 12y ago
If the definition of a "team of foolish programmers" is letting a security hole through, then 100% of teams consist of foolish programmers. Practical evidence shows that a baby monitoring webcam created by a team of the world best security experts will still have security holes and stupid errors; for examples see any security software ever written - OpenSSL Heartbleed is not an exception, but business as usual.