TRENDnet IP cameras acessible without authentication

#1

Post by ranit8 » Sat, Feb 11, 2012, 1:39 PM UTC

TRENDnet IP cameras acessible without authentication
console-cowboys.blogspot.com

Re: TRENDnet IP cameras acessible without authentication

#2

Post by dhughes » Sat, Feb 11, 2012, 4:35 PM UTC

A big red "critical update patch" banner showing on the TRENDnet site already, nice to see.

Re: TRENDnet IP cameras acessible without authentication

#3

Post by gnu8 » Sat, Feb 11, 2012, 5:24 PM UTC

Trendnet appears to be in compliance with its GPL obligations (at first glance.) It should be possible for anyone to develop a patch for the camera.

Re: TRENDnet IP cameras acessible without authentication

#4

Post by SoftwareMaven » Sat, Feb 11, 2012, 6:04 PM UTC

This is why you put your permission checks on the resource itself, not on the link to the resource (well, in addition to, really).

Re: TRENDnet IP cameras acessible without authentication

#5

Post by JonnieCache » Sat, Feb 11, 2012, 6:12 PM UTC

There's a googledoc floating around with a big list of urls for these things. It includes significantly more than the 350 devices he mentions iirc.

Re: TRENDnet IP cameras acessible without authentication

#6

Post by spindritf » Sat, Feb 11, 2012, 6:24 PM UTC

gnu8 wrote: post #3

Trendnet appears to be in compliance with its GPL obligations (at first glance.) It should be possible for anyone to develop a patch for the camera.

Which is nice but we shouldn't need to patch appliances to be able to use their basic functions in at least somewhat secure manner.

Re: TRENDnet IP cameras acessible without authentication

#7

Post by daeken » Sat, Feb 11, 2012, 6:36 PM UTC

gnu8 wrote: post #3

Trendnet appears to be in compliance with its GPL obligations (at first glance.) It should be possible for anyone to develop a patch for the camera.

That assumes that 1) the device doesn't require signed blobs, which would prevent you from putting your own code on it (easily), and 2) that their own components are open source, thus patchable without wrapping the service or patching the binaries.

Re: TRENDnet IP cameras acessible without authentication

#8

Post by windsurfer » Sat, Feb 11, 2012, 7:19 PM UTC

This seems very illegal (looking through someone elses camera)

Re: TRENDnet IP cameras acessible without authentication

#9

Post by methoddk » Sat, Feb 11, 2012, 7:48 PM UTC

I have one of these cameras, specifically, the TV-IP422W. Great to see TRENDnet pushing an update so fast.

Re: TRENDnet IP cameras acessible without authentication

#10

Post by emi420 » Sat, Feb 11, 2012, 7:58 PM UTC

JonnieCache wrote: post #5

There's a googledoc floating around with a big list of urls for these things. It includes significantly more than the 350 devices he mentions iirc.

All is public, since doesn't have password. I took a pastebin list, a free geolocation API, and I made this to play: http://big-brotha.appspot.com/static/index.html