warning about IP cams

tombruton87

I have wanted to post about this for a while but robin who discovered these problems had not posted it on his site till recently. Pretty much a whole range of ip cameras can be viewed by any1 and also have some other pretty massive security issues

http://www.digininja.org/blog/owasp_leeds.php

I think this is important as these security flaws can apply to pretty much any device on your home network. meaning you can have the securist network ever and one of these devices can destroy all your good work.

Also do you really want the whole world to be able to see your camera

robin only took it so far however this can be taken much much further

my favorite quote from a company making secure networking devices, "security wasnt an issue when designing it"

bob_a_builder

This has been going for for quite a while, used to be just a case of googling for the 'fingerprints' of the various camera manufacturers

like THIS

tombruton87

I know and it is shocking manufactures are still putting cams out there with such poor security.

worst thing is no validation ovr firmware updates so anybody who knows the cameras ip adress could potentialy update it with there own firmware, to do pretty much wateva they want, could easily pakage a command line version of metasploit and have it look for weak machines then auts o send you a reverse shell.

Alot of the problem is internatiolal regulation and pretty much that there is none.

We dont know how lucky we are in the UK having CREST, yes its a !!!!! of an exam and alot of hassle but at least it ensure's those who work on goverment systems are competent and can be held accountable. It also gives a benchmark for companies aswell.

How many sucsessful attacks have there been PUBLICLY on UK goverment sites, now lets compare that to the USA that even script kiddies such as Gary McKinnon who the US just make stuff up as they go along, first it was 10,000 computers then it goes down to 97, big differnce considering a router is a computer so is a switch in the eyes of the law access a single access point that can easily be 97 computers. 60 years maximum sentance. I think 500 hours comunity service is more appropiate for a 3rd offence not a long jail sentance than most murders and rapists face

It really does anger me how the US gets away with this he hacked them from his home IP address, he knows enough to exploit an unpatched node on a network, he is no more of a threat than a 13 year old who has watched a few too many youtube videos.
The US rather than sort there problems out they just hand out huge jail sentances to put others off, when the truth is it is pretty much impossible to catch the good hackers.Who would of guessed that the prision system is being privatised in the US

bob_a_builder

heres ONE clearly expecting 'visitors'

withabix

bob_a_builder wrote: »

heres ONE clearly expecting 'visitors'

I think that might not be a live cam....

The Christmas tree kind of gives that away!

spud17

Yawn, we had a thread about these cameras 3 years ago.
There was even one link where you could control the camera on a road junction somewhere in the USA.

https://forums.moneysavingexpert.com/discussion/1653085

bob_a_builder

The Christmas tree kind of gives that away!

and all the furry animals ?
although date and timestamp is correct ?, and there was someone working at the desk last night

Yawn, we had a thread about these cameras 3 years ago.

well the link I gave with search strings for was from 2005, so yes its an old issue, as old as web cams themselves

spud17

well the link I gave with search strings for was from 2005, so yes its an old issue, as old as web cams themselves

Wasn't having a dig at you.

spannerzone

Yeah hardly new news to be honest.....I remember controlling a webcam in an office in the US and the staff kept looking at the camera as it moved, clearly they weren't used to it moving! - and a similar thing in a Japanese tech store... the next day they finally locked it down so you could only view but not control the cam.

Then there's the Google search where you could find unsecured network printers and print something from your PC that would appear somewhere else in the world....

spud17

Security's a right pig HERE