Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- I generally run security cameras on a separate VLAN and use something like frigate or other floss dvr tool for them to talk to.
Never let a cheap networked security camera touch the actual internet. %-/
by Kim_Bruning - It’s kind of interesting - I imported security cameras for a business roughly twenty hours ago. The security problems at the time were unbelievable to a point that any kind of wireless, IP or any type of service offering remote view was really scary. It was always stupid stuff - little oversights, things that were hard coded and shouldn’t have been or extremely old versions of insecure software running critical functions.
Apparently, nothing has changed in two decades.
by hluska - This blog's misuse of the external link icon irks me.by sodapopcan
- will fix it tomorrowby hhh
- The CSS selector they used (`a[href*="://"]::after`) is meant to only target only external links, but assumes any internal links will be using relative paths like `href="/about"`. The problem is that this site uses absolute URLs (`href="https://hhh.hn/about"`) for its nav links, so every link ends up with an icon.
You could fix this by adding an exception to the CSS rule so it skips links starting with your site's name:
a[href*="://"]:not([href^="https://hhh.hn"])::afterby kyle-rb - Back in the mid-1990s, I was working at an ISP and also at a consulting firm. The consulting firm's #1 business at the time was to get businesses connected to the Internet, where these businesses already had significant LAN buildouts.
Now these were the days before IANA had officially assigned those "Private IP Network" numbers. Nobody had any private IPv4 space to work with! So the choices consisted of: make up some numbers and hope they don't conflict, or go ahead and register your IPv4 space and get public netblocks assigned, even if you're just using them privately.
So, needless to say, we encountered some bonkers configurations, and a lot of our job was undoing some really awful configurations in order to make them compliant with actual Internet connectivity, and so that different office LANs would interoperate properly.
We were also big advocates of security, firewalls, and the venerable "DMZ/Bastion" setups from back in the day, so those Private IP Network assignments would've been really useful, along with NAT, but we simply didn't have those tools at our disposal, and our clients were basically registering huge IPv4 blocks that they really didn't need to ever use.
- Perhaps they should just drop the 'security' from the name and simply call it a camera.by pak9rabid
- LLMs have truly killed obfuscation. It only worked previously by making things extremely tedious but AI doesn't care about that.by IshKebab
- On the bright side, even a small local LLM can easily improve garbage code like that.by p-e-w
- And it's worth considering that obfuscation only ever worked against casuals for whom tedious was a bridge too far. Nation state actors and criminal hacker groups, on the other hand, consider the tedious entirely worth it.by llm_nerd
- When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites.
You can curse the storm, but the wind will come.
by RyJones - how did "same MAC" lead to "access to everything"?
Was the website's security based on MAC, which presumably is supplied by the client? If so, I guess.. typical IoT.
by netsharc - I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.by whalesalad
- Everything can be controlled without a proprietary app. Hope you reverse engineer the protocol and publish how to do it.by inigyou
- What lights did you get? I have Oasis. Love them but same thing would rather control them through a central bot or something.by vhiremath4
- In many cases it is bad to publish this info because they might come after you. There used to be a company who shielded the “researcher” from the legal consequences, can’t remember the name though.by dev_l1x_be
- Ugh, that's a new low. I can't think of a single good reason a lighting app would need shopify api access.
That said, I've done some consulting work on shopify stores, and I wouldn't be shocked at all to see something like that at all. The bar for code quality that a lot of low end consultants/designers deliver is just abysmal.
by zrobotics - Another rule of thumb - i know it's not always the best since some products are really nice aesthetically - is to buy only local smart stuff, for example, zigbee/zwave.by tehlike
- Have you actually tried to do anything with them though? The keys are in there, but may not grant you any real extra access beyond what your user is actually allowed to do via the app.by fragmede
- There's a lot of public keys that don't give you any special access, unless the dev is really bad.
Anyone who cares about security will be using App Attest or the Google store equivalent.
by Ecsta - A rule of thumb, put your cameras on a separate VLAN and never give that vlan internet access.
Least you can do.
by tehlike - Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)by dev_l1x_be
- How can there be a baseline check when you operate by getting the most inexperienced cheapest person possible to do the work?by awakeasleep
- Especially these days there’s really no excuse
Add a skill to your repo that does some basic checks at least, not that hard
by gxs - There’s some irony to security not being a priority for security cameras. Different kind of security I know, but still.by folkrav
- As they say: in IoT the S stands for security.by snoman
- The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.by grommz
- Note to self: never buy any Korean hardware or software product.
/S
by kingleopold - just buy stuff you can put your own firmware/os on because it's either just the worst security in the world (aka anything not from china) or, well... china.
and while i currently don't hate china as much as i do US rn (because canadian; sorry) i can also say -- due to being an aforementioned leaflandian -- that due to very personal experience i have zero faith in anything from china that has the ability to connect to any type of network :')
And so yeah at this point if I can't at the very least get a whatever-wrt firmware (preferably a proper linux distro nowadays; not to say the *-wrt firmwares aren't a real OS but, y'know) on the device i just avoid them entirely since, well... it's all i can do at this point because even if there were baked in hardware-based backdoors i as an individual can't do much more than that.
- > Department of War
n.b., it's the Department of Defense, just like the Kennedy Center doesn't have Trump's name attached, and the large body of water by Texas is the Gulf of Mexico.
by KPGv2