6 ms·

Website with 1000s of live baby monitors, web cams and CCTV feeds has shut down

41 points by BillFranklin 12y ago

digitalgravy 12y ago
What, and there's no other website that does this? No one thought to look at https://www.shodan.io/ https://www.shodan.io/ ?
- werid 12y ago
  In this case, the website showed webcams which were protected by passwords, but they were using default ones. I don't think shodan does that.
el_duderino 12y ago
This all stemmed from Gizomodo's original posting of it: http://gizmodo.com/a-creepy-website-is-streaming-from-73-000-private-secur-1655653510 http://gizmodo.com/a-creepy-website-is-streaming-from-73-000... I'm glad it's been shut down.
- icefox 12y ago
  Why are you glad it was shut down? Were you hoping to make a competing site?
- 13 12y ago
  The website linking to it going away hasn't made the content go away. The public just won't be aware of it now.
- philtar 12y ago
  Makes no difference. All it takes is Shodan and a bit of scripting knowledge and your competitor is a weekend away.
Nux 12y ago
The site may be gone, but not the problem.
Someone1234 12y ago
The "expert" is still suggesting special characters instead of full sentences? Sigh.
- freehunter 12y ago
  I blame Active Directory and the "use strong password" which focuses on special characters and not entropy.
  - Someone1234 12y ago
    Agreed. AD's password rule enforcement is almost completely inflexible[0] and originates from 1980s US Government requirements they incorporated to get some certification. It is completely inappropriate in 2014 and don't even get me started on how convoluted Microsoft make adding 2 factor to NT login (i.e. use our expensive convoluted solution or nothing, no RFC 6238 you can just slot in). [0] http://technet.microsoft.com/en-us/library/cc875814.aspx http://technet.microsoft.com/en-us/library/cc875814.aspx
  - the-dude 12y ago
    AppleID does this too.
  - drzaiusapelord 12y ago
    Meh, that's a GPO setting. Don't turn it on if you don't like it. Bill Gates isn't holding a gun to your head here. Hell, its not even turned on by default! AD can handle long passphrases. Granted, its cryptography only considers the first 14 characters, but I've read case studies where shops have moved away from complexity to minimum 14 characters and suddenly things like password resets become a thing of the past. Turns out its easier for humans to process "mydogsnameismrmittens" vs "M1tt3ns" I've tried long passphrases in embedded devices like cameras and routers. Most of the time they can't handle it. Don't knock AD as being the bad guy here. Go after the nightmarish cockup that defines the security of consumer embedded world.
    - freehunter 12y ago
tshadwell 12y ago
I was amazed when I was watching BBC News and this came on. I remember Google dorking webcams when I was 12 and the BBC were playing it up like some prodigal hacker had tapped into the matrix to produce these webcams or something.
- _sword 12y ago
  Oh man when I was in the range of 12 - 14 I loved watching these webcams to get small glimpses into other peoples' lives around the world. I still have vivid memories of watching street vendors in Japan, fishing boats docking and leaving somewhere in Asia, and the sun rising over beautiful mountains somewhere in Europe during an early spring. It was mesmerizing to peer through these virtual windows into locations half a world away.
  - MrJagil 12y ago
    How do you do this? The article is very sparse on technicalities...
    - TazeTSchnitzel 12y ago
      Google the right phrases, mostly.
kcorbitt 12y ago
> Last week it was showing video feeds from more than 250 countries I may be very confused, but Wikipedia only lists 206 sovereign states (193 full UN member states)[0]. Even with border disputes 250 seems like a very inflated number. Is there some other common definition of "country" I'm not aware of, or did this article just fail to perform basic fact-checking on the claims? [0] http://en.wikipedia.org/wiki/List_of_sovereign_states http://en.wikipedia.org/wiki/List_of_sovereign_states
- philwelch 12y ago
  "Country" is an ambiguous term that's not always synonymous with "sovereign state". For instance, British people tend to think Wales, England, and Scotland are three countries.
- TazeTSchnitzel 12y ago
  I suspect it was a typo and they meant 150.
- imaginenore 12y ago
  http://en.wikipedia.org/wiki/List_of_countries_by_population http://en.wikipedia.org/wiki/List_of_countries_by_population
xaitv 12y ago
> An analogy best describing this would be just because someone leaves their window open it does not give permission for an unauthorized individual to set up a camera outside their window and broadcast the feed worldwide I think a better analogy would be someone putting up a tv screen on the side of their house showing a camera feed of the inside of the house, with a sign that asks people "Don't look at this TV"
- corobo 12y ago
  Better than that is the exact same but without the "Don't look at this TV" sign. There's just a TV there and the curious are going to be curious
zimbatm 12y ago
If you need to video feed for experiments just search for "inurl:axis-cgi/jpg/image.cgi" on google.
tsemple 12y ago
I while ago I bought a webcam, plugged it in and entered my wifi password. I little bit later I realized that it had reconfigured my router and was broadcasting to the internet. Wow, I'm all for easy to install, but that's crazy. I couldn't believe that my router was configurable automatically without entering the password. I fixed my router, but you have to be pretty tech savvy to understand that your cheap baby cam is broadcasting pictures from inside your house to the entire world by default.
- ssharp 12y ago
  I wanted to get a video baby monitor for my twins, but gave absolutely no thought into getting an internet-connected one. I just didn't see the benefit and it seemed super creepy having the camera accessible over the internet. Now, after about two months, I realize that I hardly ever use the video feature and the audio is almost always enough. I guess we'll see if I change my mind as the babies get a little older, but I'd rather have my $250 back and just have gotten a simple audio monitor.
- drzaiusapelord 12y ago
  This is the purpose of unpnp port forwarding. Devices can request an open port from the firewall. I have yet to see a consumer router where this was off by default. Its dangerous stuff for those with no idea what's going on. At the very least it should be off by default.
digital-rubber 12y ago
Attention for this particular issue is nice. But all these reports are not going to reach the actual user. I don't see anybody making such a big fuss when people don't close the curtains in their home at night (or even during the day). Sure you can see who is peeking into your house, but technically is it much different then a insecure/unconfigured webcam?
- k-mcgrady 12y ago
  >> "But all these reports are not going to reach the actual user." I think it might. It was one of the top headlines on the evening news in the UK and the main message was to users - change your password. How many acted on that I don't know but the reports certainly got out to regular people.
  - digital-rubber 12y ago
    It's been on the news here to, i didn't see any drop in the number of cams online from my country.
- ryanedick 12y ago
  In the case of the general public it is different. A curtain is a highly intuitive instrument for privacy protection, you pull it and it covers the window. Understanding how to secure a technical device such as a webcam is not as easy or intuitive, especially if as another poster mentioned, the device is configured to broadcast automatically. People will almost always stay with the defaulted configuration unless they fully understand the technology, hence the reason wifi routers now come with long cryptic random passwords.
joshstrange 12y ago
> If we can take one lesson away from this experience, it is that default passwords do not provide protection from the threats that exist in the modern world. No shit.... Also this article covers what not to make your password which I think is misleading... This isn't about a hacker guessing easy passwords it's about people setting up these devices and not changed the DEFAULT user/password which is easy to find (or guess: user/user, admin/admin, root/root, user/root, etc).
missing_cipher 12y ago
If anyone is interested, there was good Defcon talk about camera "security" a while back: https://www.youtube.com/watch?v=B8DjTcANBx0 https://www.youtube.com/watch?v=B8DjTcANBx0
shittyanalogy 12y ago
"An analogy best describing this would be just because someone leaves their window open it does not give permission for an unauthorized individual to set up a camera outside their window and broadcast the feed worldwide," That's a terrible analogy. These webcams are accessible publicly on the web with no security. A better analogy would be, it's like leaving your window open, and your window location can be indexed by google, and your window can simultaneously be viewed by anyone around the world in their underwear. And in some cases they can pan, rotate, and zoom your window. "If we can take one lesson away from this experience, it is that default passwords do not provide protection from the threats that exist in the modern world." No, if we take away one lesson from this experience it's that the person exposing the serious issue can sometimes recieve the most criticism. Nothing is better, just back to being hidden.
- sbarre 12y ago
  Yeah I also thought the camera company's statement was BS. Setting a password should be part of the installation process for these kinds of products, and you should not be able to get it up and running without that step. But none of these companies want to absorb the support costs of dealing with customers who will struggle with that step (and there will be plenty, Insecam was proof of that), so they pass the risk onto their customers and then try to vilify the people who point it out.
- grecy 12y ago
  > "An analogy best describing this would be just because someone leaves their window open it does not give permission for an unauthorized individual to set up a camera outside their window and broadcast the feed worldwide," Actually, I'm pretty sure it does. I'm a photographer, so I'm constantly following discussions and lawsuits about it. Anything that can be photographed (or videoed) while the operator is standing on public space is fair game. I can absolutely take photos and video of the front of your house while standing on the road. If you happen to have your window down, that's your problem not mine.
  - grecy 12y ago
    Downvotes because I'm wrong (legally speaking) or because you don't like the implications if I'm right? https://www.aclu.org/kyr-photo https://www.aclu.org/kyr-photo opening paragraph: "Taking photographs of things that are plainly visible from public spaces is a constitutional right "
insomniasexx 12y ago
I used to be part of a forum that had a massive list of the default login and unprotected cams. There were maybe 10k-20k per document, maybe 5 or 6 documents. As far as I could tell, all were working cams but 99% of the time there was nothing happening. Either they were too dark to see much, pointed at a front door, or showing rooms with no one in them. I personally never saw any movement on any of the cams except for a sleeping puppy. On the rare occasion someone found a not-empty cam, there would be screencaps immediately. It was like crowdsourced voyeurism before crowdsourcing was a thing. The best one was a guy who was using the camera to monitor his weed grow op. Apparently, according to more knowledgable users on this forum, he was using the lights inefficiently. It sparked a massive debate on the intricacies of grow lights and that's when the thread died. It was creepy but far less creepy or exciting than I imagined when I first stumbled upon the thread. Still, change your passwords people.
jostmey 12y ago
Funny that everyone is upset by this. When it comes to government surveillance, a lot of people don't seem to care.
- ianlevesque 12y ago
  The government is only out to get bad guys of course.
- singold 12y ago
  Maybe this is a good example of why is not a good idea for our goverments to have irrestricted access to everything, because this kind of people would have access too.

41 points by BillFranklin 12y ago

What, and there's no other website that does this? No one thought to look at https://www.shodan.io/ https://www.shodan.io/ ?

werid 12y ago
In this case, the website showed webcams which were protected by passwords, but they were using default ones. I don't think shodan does that.

el_duderino 12y ago

This all stemmed from Gizomodo's original posting of it: http://gizmodo.com/a-creepy-website-is-streaming-from-73-000-private-secur-1655653510 http://gizmodo.com/a-creepy-website-is-streaming-from-73-000... I'm glad it's been shut down.

icefox 12y ago
Why are you glad it was shut down? Were you hoping to make a competing site?
13 12y ago
The website linking to it going away hasn't made the content go away. The public just won't be aware of it now.
philtar 12y ago
Makes no difference. All it takes is Shodan and a bit of scripting knowledge and your competitor is a weekend away.

Nux 12y ago

The site may be gone, but not the problem.

Someone1234 12y ago

The "expert" is still suggesting special characters instead of full sentences? Sigh.

freehunter 12y ago
I blame Active Directory and the "use strong password" which focuses on special characters and not entropy.
- Someone1234 12y ago
  Agreed. AD's password rule enforcement is almost completely inflexible[0] and originates from 1980s US Government requirements they incorporated to get some certification. It is completely inappropriate in 2014 and don't even get me started on how convoluted Microsoft make adding 2 factor to NT login (i.e. use our expensive convoluted solution or nothing, no RFC 6238 you can just slot in). [0] http://technet.microsoft.com/en-us/library/cc875814.aspx http://technet.microsoft.com/en-us/library/cc875814.aspx
- the-dude 12y ago
  AppleID does this too.
- drzaiusapelord 12y ago
  Meh, that's a GPO setting. Don't turn it on if you don't like it. Bill Gates isn't holding a gun to your head here. Hell, its not even turned on by default! AD can handle long passphrases. Granted, its cryptography only considers the first 14 characters, but I've read case studies where shops have moved away from complexity to minimum 14 characters and suddenly things like password resets become a thing of the past. Turns out its easier for humans to process "mydogsnameismrmittens" vs "M1tt3ns" I've tried long passphrases in embedded devices like cameras and routers. Most of the time they can't handle it. Don't knock AD as being the bad guy here. Go after the nightmarish cockup that defines the security of consumer embedded world.
  - freehunter 12y ago

tshadwell 12y ago

I was amazed when I was watching BBC News and this came on. I remember Google dorking webcams when I was 12 and the BBC were playing it up like some prodigal hacker had tapped into the matrix to produce these webcams or something.

_sword 12y ago
Oh man when I was in the range of 12 - 14 I loved watching these webcams to get small glimpses into other peoples' lives around the world. I still have vivid memories of watching street vendors in Japan, fishing boats docking and leaving somewhere in Asia, and the sun rising over beautiful mountains somewhere in Europe during an early spring. It was mesmerizing to peer through these virtual windows into locations half a world away.
- MrJagil 12y ago
  How do you do this? The article is very sparse on technicalities...
  - TazeTSchnitzel 12y ago
    Google the right phrases, mostly.

kcorbitt 12y ago

> Last week it was showing video feeds from more than 250 countries I may be very confused, but Wikipedia only lists 206 sovereign states (193 full UN member states)[0]. Even with border disputes 250 seems like a very inflated number. Is there some other common definition of "country" I'm not aware of, or did this article just fail to perform basic fact-checking on the claims? [0] http://en.wikipedia.org/wiki/List_of_sovereign_states http://en.wikipedia.org/wiki/List_of_sovereign_states

philwelch 12y ago
"Country" is an ambiguous term that's not always synonymous with "sovereign state". For instance, British people tend to think Wales, England, and Scotland are three countries.
TazeTSchnitzel 12y ago
I suspect it was a typo and they meant 150.
imaginenore 12y ago
http://en.wikipedia.org/wiki/List_of_countries_by_population http://en.wikipedia.org/wiki/List_of_countries_by_population

xaitv 12y ago

> An analogy best describing this would be just because someone leaves their window open it does not give permission for an unauthorized individual to set up a camera outside their window and broadcast the feed worldwide I think a better analogy would be someone putting up a tv screen on the side of their house showing a camera feed of the inside of the house, with a sign that asks people "Don't look at this TV"

corobo 12y ago
Better than that is the exact same but without the "Don't look at this TV" sign. There's just a TV there and the curious are going to be curious

zimbatm 12y ago

If you need to video feed for experiments just search for "inurl:axis-cgi/jpg/image.cgi" on google.

tsemple 12y ago

I while ago I bought a webcam, plugged it in and entered my wifi password. I little bit later I realized that it had reconfigured my router and was broadcasting to the internet. Wow, I'm all for easy to install, but that's crazy. I couldn't believe that my router was configurable automatically without entering the password. I fixed my router, but you have to be pretty tech savvy to understand that your cheap baby cam is broadcasting pictures from inside your house to the entire world by default.

ssharp 12y ago
I wanted to get a video baby monitor for my twins, but gave absolutely no thought into getting an internet-connected one. I just didn't see the benefit and it seemed super creepy having the camera accessible over the internet. Now, after about two months, I realize that I hardly ever use the video feature and the audio is almost always enough. I guess we'll see if I change my mind as the babies get a little older, but I'd rather have my $250 back and just have gotten a simple audio monitor.
drzaiusapelord 12y ago
This is the purpose of unpnp port forwarding. Devices can request an open port from the firewall. I have yet to see a consumer router where this was off by default. Its dangerous stuff for those with no idea what's going on. At the very least it should be off by default.

digital-rubber 12y ago

Attention for this particular issue is nice. But all these reports are not going to reach the actual user. I don't see anybody making such a big fuss when people don't close the curtains in their home at night (or even during the day). Sure you can see who is peeking into your house, but technically is it much different then a insecure/unconfigured webcam?

k-mcgrady 12y ago
>> "But all these reports are not going to reach the actual user." I think it might. It was one of the top headlines on the evening news in the UK and the main message was to users - change your password. How many acted on that I don't know but the reports certainly got out to regular people.
- digital-rubber 12y ago
  It's been on the news here to, i didn't see any drop in the number of cams online from my country.
ryanedick 12y ago
In the case of the general public it is different. A curtain is a highly intuitive instrument for privacy protection, you pull it and it covers the window. Understanding how to secure a technical device such as a webcam is not as easy or intuitive, especially if as another poster mentioned, the device is configured to broadcast automatically. People will almost always stay with the defaulted configuration unless they fully understand the technology, hence the reason wifi routers now come with long cryptic random passwords.

joshstrange 12y ago

> If we can take one lesson away from this experience, it is that default passwords do not provide protection from the threats that exist in the modern world. No shit.... Also this article covers what not to make your password which I think is misleading... This isn't about a hacker guessing easy passwords it's about people setting up these devices and not changed the DEFAULT user/password which is easy to find (or guess: user/user, admin/admin, root/root, user/root, etc).

missing_cipher 12y ago

If anyone is interested, there was good Defcon talk about camera "security" a while back: https://www.youtube.com/watch?v=B8DjTcANBx0 https://www.youtube.com/watch?v=B8DjTcANBx0

shittyanalogy 12y ago

"An analogy best describing this would be just because someone leaves their window open it does not give permission for an unauthorized individual to set up a camera outside their window and broadcast the feed worldwide," That's a terrible analogy. These webcams are accessible publicly on the web with no security. A better analogy would be, it's like leaving your window open, and your window location can be indexed by google, and your window can simultaneously be viewed by anyone around the world in their underwear. And in some cases they can pan, rotate, and zoom your window. "If we can take one lesson away from this experience, it is that default passwords do not provide protection from the threats that exist in the modern world." No, if we take away one lesson from this experience it's that the person exposing the serious issue can sometimes recieve the most criticism. Nothing is better, just back to being hidden.

sbarre 12y ago
Yeah I also thought the camera company's statement was BS. Setting a password should be part of the installation process for these kinds of products, and you should not be able to get it up and running without that step. But none of these companies want to absorb the support costs of dealing with customers who will struggle with that step (and there will be plenty, Insecam was proof of that), so they pass the risk onto their customers and then try to vilify the people who point it out.
grecy 12y ago
> "An analogy best describing this would be just because someone leaves their window open it does not give permission for an unauthorized individual to set up a camera outside their window and broadcast the feed worldwide," Actually, I'm pretty sure it does. I'm a photographer, so I'm constantly following discussions and lawsuits about it. Anything that can be photographed (or videoed) while the operator is standing on public space is fair game. I can absolutely take photos and video of the front of your house while standing on the road. If you happen to have your window down, that's your problem not mine.
- grecy 12y ago
  Downvotes because I'm wrong (legally speaking) or because you don't like the implications if I'm right? https://www.aclu.org/kyr-photo https://www.aclu.org/kyr-photo opening paragraph: "Taking photographs of things that are plainly visible from public spaces is a constitutional right "

insomniasexx 12y ago

I used to be part of a forum that had a massive list of the default login and unprotected cams. There were maybe 10k-20k per document, maybe 5 or 6 documents. As far as I could tell, all were working cams but 99% of the time there was nothing happening. Either they were too dark to see much, pointed at a front door, or showing rooms with no one in them. I personally never saw any movement on any of the cams except for a sleeping puppy. On the rare occasion someone found a not-empty cam, there would be screencaps immediately. It was like crowdsourced voyeurism before crowdsourcing was a thing. The best one was a guy who was using the camera to monitor his weed grow op. Apparently, according to more knowledgable users on this forum, he was using the lights inefficiently. It sparked a massive debate on the intricacies of grow lights and that's when the thread died. It was creepy but far less creepy or exciting than I imagined when I first stumbled upon the thread. Still, change your passwords people.

jostmey 12y ago

Funny that everyone is upset by this. When it comes to government surveillance, a lot of people don't seem to care.

ianlevesque 12y ago
The government is only out to get bad guys of course.
singold 12y ago
Maybe this is a good example of why is not a good idea for our goverments to have irrestricted access to everything, because this kind of people would have access too.