Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse-Engineering an IP Camera (2019)

dalpix.com

Post reply on HN
Print view View original

31–40 of 109 posts

Re: Reverse-Engineering an IP Camera (2019)

#31

Post by mv4 »

kajecounterhack wrote: post #30
mv4 wrote: post #20

This may come as a surprise, but it's not just hackers (or China) that you need to worry about. I've worked at a couple of FAANGs (risk, privacy, compliance) and was shocked by the lack of internal guardrails. Here's Amazon Ring settling with the FTC - company's own employees were watching customer video feeds for entertainment: https://www.ftc.gov/enforcement/refunds/ring-refunds Tesla's been caught doing similar th…

I use Nest cameras at home instead of ring because based on work at Google I expect there to be strong internal guardrails relative to Ring (also heard about their lax standards), but happy to hear anecdata from (ex-)Nest engineers about potential issues.

I would love to hear from ex-Nest engineers as well about internal access. As for hackers, I remember seeing multiple Nest hacking incidents in the press a few years ago, but it appears they've hardened the system since then:

https://techcrunch.com/2020/06/01/google-nest-advanced-prote...

Re: Reverse-Engineering an IP Camera (2019)

#32

Post by cbsks »

mv4 wrote: post #25
cbsks wrote: post #21

Earlier quoted context omitted.

I’m interested! I have a few cheap Poe cameras but the rtsp connection is always flaky on them. Your email is not in your profile by the way.

Thanks, just added email (+LinkedIn). Happy to chat. Not selling direct-to-consumer yet (going through installers and integrators) but that's coming.

Ah bummer. I’m just a lowly consumer.

Re: Reverse-Engineering an IP Camera (2019)

#33

Post by michaelt »

mv4 wrote: post #13

Since someone mentioned 'declouding' here, my startup (well, scaleup now) makes a few privacy-first, autonomous (no cloud) video security products - on-prem video security hub, relays for automation, cameras. I was also getting sick of cloud-based 'smart' cameras that ping random servers in China, so we made our own 'dumb' cameras that are fast (Uniview hardware with our firmware inside). If anyone here is interested…

> Always interested in product feedback.

While I share your concerns about the security implications of sending video to the cloud, the way I see it if someone's burgling my house they're probably going to steal whatever I'm using for on-prem video storage while they're at it.

And while I could secure it in an impenetrable or hidden box - if I have such a box I can put all my valuables in the box, and feel peace of mind without needing any cameras.

Re: Reverse-Engineering an IP Camera (2019)

#34

Post by mv4 »

mv4 wrote: post #25
cbsks wrote: post #21

Earlier quoted context omitted.

I’m interested! I have a few cheap Poe cameras but the rtsp connection is always flaky on them. Your email is not in your profile by the way.

Thanks, just added email (+LinkedIn). Happy to chat. Not selling direct-to-consumer yet (going through installers and integrators) but that's coming.

What I meant we don't have a "click here to buy" just yet.

We can still figure out how you can evaluate if you're interested.

Re: Reverse-Engineering an IP Camera (2019)

#35

Post by vivekkairi »

I faced a similar problem recently, where the IP cam I had was streaming video through the internet and it was Chinese ofcourse. But I found a much simpler solution to avoid it. The camera had rstp support and internet forums have already guessed the rstp url so I used that to hook it upto my surveillance system. Regarding avoiding transmission to internet, I just disabled internet access to that device and boom it became offline camera.

Re: Reverse-Engineering an IP Camera (2019)

#36

Post by mv4 »

michaelt wrote: post #33
mv4 wrote: post #13

Since someone mentioned 'declouding' here, my startup (well, scaleup now) makes a few privacy-first, autonomous (no cloud) video security products - on-prem video security hub, relays for automation, cameras. I was also getting sick of cloud-based 'smart' cameras that ping random servers in China, so we made our own 'dumb' cameras that are fast (Uniview hardware with our firmware inside). If anyone here is interested…

> Always interested in product feedback. While I share your concerns about the security implications of sending video to the cloud, the way I see it if someone's burgling my house they're probably going to steal whatever I'm using for on-prem video storage while they're at it. And while I could secure it in an impenetrable or hidden box - if I have such a box I can put all my valuables in the box, and feel peace of m…

These are good points. The main problem we're solving for people is real-time awareness and automation/prevention. The device monitors your cameras locally (no cloud), notifies you, and/or performs actions locally (play barkingdog.mp3, close gates, turn on the lights, etc) that act as a deterrent. Even if your uplink is down.

Now, if someone's broken in, that's a different problem. You want video evidence for investigative purposes. The device is small, energy efficient (10-20W typically) and can be easily hidden (provided you supply power and LAN ethernet to it). The storage is encrypted. And we'll be introducing an option for your own offsite backup (again, optional and not centralized).

Interesting problem for sure.

Re: Reverse-Engineering an IP Camera (2019)

#37

Post by codetrotter »

cameldrv wrote: post #23

These cameras are extremely suspicious -- just follow the money. I bought some cheap Chinese cameras in 2020 that by default send the video stream to a Chinese server, which you can watch with an app on your phone. The cameras were about $40 on Amazon, so my guess is the manufacturer was getting paid maybe $15-20 for them. Bandwidth to and from China is not that cheap, and you could be running this stream 24x7. The s…

I bought one on AliExpress for just under 18 EUR. Mine works similarly, that it streams to some server in the cloud. I knew this, and only connected it for testing a little bit and made sure to not put my face or any of my documents etc in view of the camera.

The company behind the one I bought does seem to have a slightly better business model though. With them you can use it free to see live or you can pay them a monthly fee for recordings.

As for me my plan is to put it on a LAN without internet access and figure out how to get the video locally.

Re: Reverse-Engineering an IP Camera (2019)

#38

Post by lormayna »

fusslo wrote: post #14
mv4 wrote: post #13

Since someone mentioned 'declouding' here, my startup (well, scaleup now) makes a few privacy-first, autonomous (no cloud) video security products - on-prem video security hub, relays for automation, cameras. I was also getting sick of cloud-based 'smart' cameras that ping random servers in China, so we made our own 'dumb' cameras that are fast (Uniview hardware with our firmware inside). If anyone here is interested…

This is exactly what I've been looking for. There's plenty of cheap RTSP and ONVIF compliant cameras coming out of china, but I trust them exactly 0%. I also don't trust us-based companies with remote access via their services. So I'm learning how to partition my home network to not allow the cameras on a vlan to not access the outside world. But then I need to figure out how to access the video streams.. from the ne…

This is exactly the role for a firewall.

Re: Reverse-Engineering an IP Camera (2019)

#39

Post by mv4 »

codetrotter wrote: post #37
cameldrv wrote: post #23

These cameras are extremely suspicious -- just follow the money. I bought some cheap Chinese cameras in 2020 that by default send the video stream to a Chinese server, which you can watch with an app on your phone. The cameras were about $40 on Amazon, so my guess is the manufacturer was getting paid maybe $15-20 for them. Bandwidth to and from China is not that cheap, and you could be running this stream 24x7. The s…

I bought one on AliExpress for just under 18 EUR. Mine works similarly, that it streams to some server in the cloud. I knew this, and only connected it for testing a little bit and made sure to not put my face or any of my documents etc in view of the camera. The company behind the one I bought does seem to have a slightly better business model though. With them you can use it free to see live or you can pay them a m…

Make sure to also specify a domestic NTP server - it may refuse to work until the time is synced, and most of the cheap cameras I looked at sync time with China by default.

Re: Reverse-Engineering an IP Camera (2019)

#40

Post by [deleted] »

mv4 wrote: post #28
krunck wrote: post #9

"This first difficulty was to find information about the camera. Despite having a company logo printed on its front, I could not find any information about this company on Google. I found several identical cameras being sold online, but under different brands, all of them seem to be Chinese names." Why does this continue to surprise people? So much sketchy garbage coming out of China is sold under numerous "brands".…

This is true for the top, known' brands as well. Wyze camera (top seller on Amazon) is a Tianjin Hualai Technology camera https://www.hualaikeji.com/en/product Roku just rolled our a similar cube-shaped cam (you can tell by the overall design). There's very little real innovation happening in consumer cameras right now.

[deleted]
Post reply on HN