Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This security camera was infected by malware 98 seconds after it was plugged in

techcrunch.com

Post reply on HN
Print view View original

21–30 of 37 posts

Re: This security camera was infected by malware 98 seconds after it was plugged in

#21

Post by macintux »

kinkdr wrote: post #17

This brings back memories of Windows 95-98 era, where a fresh install would get infected in matter of seconds after connected to the internet. I expect the IoT to go though a similar phase, but eventually get fixed and be secure enough.

Maybe. Windows had a single company behind it, and as I recall Bill had to issue a company-wide cease and desist order to get people to stop developing and focus on security for a while.

IoT may always be plagued by cheap hardware with buggy software from fly-by-night companies.

Re: This security camera was infected by malware 98 seconds after it was plugged in

#22

Post by drzaiusapelord »

jenamety wrote: post #15
drzaiusapelord wrote: post #9

Earlier quoted context omitted.

Because the camera requests port forwarding from your firewall using UPnP. Now your mobile app connects directly to port 83785 and streams video from the camera without any firewall hassles. The problem now is that hackers can also connect to port 83785 and exploit unpatched security holes. If a firmware update exists, its probably too technically challenging for Joe User to find and install. For a lot of these devic…

so are you stating the hacker was notified, or was the hacker polling to check the port?

They're just mass scanning for known IoT ports. UPnP opens up the port for everyone. My port number is an example. This blogger found his camera opening up port 80 via UPnP:

https://www.pentestpartners.com/blog/hacking-the-aldi-ip-cct...

Also Brian Krebs examined that Foscam camera and found it enabled a P2P protocol and opened a port on the firewall using UPnP as well:

https://krebsonsecurity.com/2016/02/this-is-why-people-fear-...

Re: This security camera was infected by malware 98 seconds after it was plugged in

#24

Post by gridspy »

jenamety wrote: post #15
drzaiusapelord wrote: post #9

Earlier quoted context omitted.

Because the camera requests port forwarding from your firewall using UPnP. Now your mobile app connects directly to port 83785 and streams video from the camera without any firewall hassles. The problem now is that hackers can also connect to port 83785 and exploit unpatched security holes. If a firmware update exists, its probably too technically challenging for Joe User to find and install. For a lot of these devic…

so are you stating the hacker was notified, or was the hacker polling to check the port?

Polling sounds the most likely. Note that previously compromised cameras can be used to perform tasks such as port scanning other IP addresses. They can also be used to compromise other devices in the home network.

Re: This security camera was infected by malware 98 seconds after it was plugged in

#25

Post by ruddct »

Having flashbacks to the 'bad old days' of similar things happening to Windows machines (PCs, ATMs, etc). Microsoft, the gigantic, near-monopoly company in the space with a jillion very smart people working for it, struggled with such issues for many years (though eventually reined it in).

This time, though, I don't see a tenable path to actually fix this. The IoT industry is terribly, terribly fragmented. Few business models incentivize providing ongoing maintenance once they've sold you their gizmo. Few consumers have the ability to detect that this is happening.

I suspect that security and compatibility issues will cripple a large chunk of the IoT industry, with bigger players slowly picking off the profitable/useful chunks with niche products customers will think of as 'safe' (read: Amazon/Google's many IoT products).

In the mean time, I'll continue avoiding smart/IoT devices in my house. The risks seem to far, far, outweigh the rewards.

Re: This security camera was infected by malware 98 seconds after it was plugged in

#26

Post by gridspy »

drzaiusapelord wrote: post #9
fanzhang wrote: post #5

How would the malware even know that the camera was connected in? Especially if you're on a home network (which is firewalled / has NAT on). I suspect that it must be the central server that this camera reports to that is infected, either directly, or indirectly with some program sitting at a nearby router listening for traffic.

Because the camera requests port forwarding from your firewall using UPnP. Now your mobile app connects directly to port 83785 and streams video from the camera without any firewall hassles. The problem now is that hackers can also connect to port 83785 and exploit unpatched security holes. If a firmware update exists, its probably too technically challenging for Joe User to find and install. For a lot of these devic…

I don't believe you could download and install a firmware update in those 2 minutes.

If you knew about the risk, you would have secured your router firewall. If you did not know, you wouldn't be rushing to install the firmware.

Once the camera is compromised, it can modify the firmware being transmitted (to compromise it) or prevent its install.

Re: This security camera was infected by malware 98 seconds after it was plugged in

#27

Post by dawnerd »

stamps wrote: post #6

What is a good security camera? Who makes good ones? I haven't been able to find a company who provides a quality POE device that allows me to control the feed into something like Zoneminder. Do I have to use something more analog to be "safer" from something like this?

These look pretty good.

https://www.ubnt.com/unifi-video/unifi-video-camera-g3-dome/

I'm going to get some for my new house. I already have some of their other gear and it has been rock solid so far.

Re: This security camera was infected by malware 98 seconds after it was plugged in

#28

Post by [deleted] »

jenamety wrote: post #15
drzaiusapelord wrote: post #9

Earlier quoted context omitted.

Because the camera requests port forwarding from your firewall using UPnP. Now your mobile app connects directly to port 83785 and streams video from the camera without any firewall hassles. The problem now is that hackers can also connect to port 83785 and exploit unpatched security holes. If a firmware update exists, its probably too technically challenging for Joe User to find and install. For a lot of these devic…

so are you stating the hacker was notified, or was the hacker polling to check the port?

[deleted]

Re: This security camera was infected by malware 98 seconds after it was plugged in

#29

Post by wfunction »

macintux wrote: post #21
kinkdr wrote: post #17

This brings back memories of Windows 95-98 era, where a fresh install would get infected in matter of seconds after connected to the internet. I expect the IoT to go though a similar phase, but eventually get fixed and be secure enough.

Maybe. Windows had a single company behind it, and as I recall Bill had to issue a company-wide cease and desist order to get people to stop developing and focus on security for a while. IoT may always be plagued by cheap hardware with buggy software from fly-by-night companies.

Whoa, any reading you can point to on that historical note?

Re: This security camera was infected by malware 98 seconds after it was plugged in

#30

Post by rhizome »

jbyers wrote: post #12

What is the expected time between port scan for an arbitrary IPv4 address? Is the level of scanning activity so high (or so well-targeted to "promising" address spaces) that one should expect to be scanned in minutes?

https://github.com/robertdavidgraham/masscan
Post reply on HN