50 comments

[ 0.28 ms ] story [ 20.2 ms ] thread
When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites.

You can curse the storm, but the wind will come.

(comment deleted)
(comment deleted)
The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.
I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.
Ugh, that's a new low. I can't think of a single good reason a lighting app would need shopify api access.

That said, I've done some consulting work on shopify stores, and I wouldn't be shocked at all to see something like that at all. The bar for code quality that a lot of low end consultants/designers deliver is just abysmal.

What lights did you get? I have Oasis. Love them but same thing would rather control them through a central bot or something.
LLMs have truly killed obfuscation. It only worked previously by making things extremely tedious but AI doesn't care about that.
Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)
(comment deleted)
Department of War IP address? I feel this should be making headlines!
This blog's misuse of the external link icon irks me.
A rule of thumb, put your cameras on a separate VLAN and never give that vlan internet access.

Least you can do.

I know you're a mastermind when it comes to security, but you should provide more context about the tools and methods you're using in your article so we can better understand what it's all about and not have to Google every single step you're taking.
(comment deleted)
I've seen these systems at US defense industry tradeshows so I'm guessing they are in use somewhere.
Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way.

I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced.

edit: seems there are some options now (or I missed them before), e.g. https://www.goodcam.io/#for-independent-developers

Not exactly open firmware, but something like ONVIF on an isolated network is pretty close. An ONVIF camera should talk to basically any NVR (network video recorder), there are several open-source ones available.

There are tons of ONVIF-compliant and cheap PoE cameras, and with this setup you really don't care about the security of the manufacturer firmware since you aren't exposing them to the network publicly. However, you do need to be extra diligent when configuring your VLAN/network segmentation.

For anyone who wants a setup like this but the nice notifications and quality of life capabilities (recordings, easy remote access for family), and are ok being on Apple infra (end to end encrypted) -

ONVIF camera (or one compatible with Scrypted) Block WAN (ideally, VLAN) on the cheap cameras Home computer to run Scrypted AppleTV (for Apple home bridge)

This is what I moved to after getting away from Ring and it works quite well. Reolink cams, old desktop, and an hour of setup.

Getting this right is hard, speaking as someone who has ARP poisoned an exposed ethernet connected to some cheap switches to monitor cameras in whole buildings before. The problem is the endpoint itself, adding layers on top doesn't solve things. Ideally I'd like a device that could be connected to public wifi and still be robust. For example including padding any data it's transmitting to avoid observable compression side effects being usable as a proxy for motion detection (which is a cool trick you can try even without a working wifi key)
You would be better served using a USB capable camera behind an RPi to have assurance that broken firmware isn't compromising your network.
I have yet to find a pattern for when the author chooses to capitalize things.
My cameras are analog rather than PoE or IP based, but that's just because I set up the initial iteration of the system a long time ago. The standard now is to give your camera an IP address.

With many IoT type things I block access to the public internet. I think with cameras specifically a lot of people even set it up physically on a different network that can only talk to the NVR.

But tldr, basing the cameras on IP invites some of the things in this article. Anyone deploying these devices needs to think about securing them.

This kind of open source expands the world.
Why would you write like that? Not capitalizing the first word of a sentence makes the whole thing less readable. So that you can feel special? Really?
Perhaps they should just drop the 'security' from the name and simply call it a camera.
> Why would Hanwha Vision need anything remotely related to the DoD? Is it possible that their CI is provided by some centralized team at their parent company Hanwha, where the needs of their sister company Hanwha Aerospace cause the shared platform to have these entries in the CI environment variables? Or maybe because of their other sister company, Hanwha Defense USA, where they make other large scary steel machines

Or... the Department of Warmongers (nee DoD) addresses on the device are evidence of a supply-side attack targeting the DoW and carried out using the aforementioned github admin token.

... I mean, while we're in here speculating about truffles and all.