Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wanted to spy on my dog, ended up spying on TP-Link

kennedn.com

Post reply on HN
Print view View original

101–110 of 181 posts

Re: Wanted to spy on my dog, ended up spying on TP-Link

#101

Post by mschuster91 »

pimterry wrote: post #82
mschuster91 wrote: post #51

Earlier quoted context omitted.

They're already barely possible as it is. For frida to work you need to root the device, which is impossible on ever more models, and there's an endless supply of very good rooting detection SDKs on the market, not to mention Play Integrity.

> For frida to work you need to root the device, which is impossible on ever more models There's plenty of physical devices where it is possible, and Google publish official emulator images with root access for every Android version released to date. This part is still OK. > there's an endless supply of very good rooting detection SDKs on the market, not to mention Play Integrity Most of the root detection is beatabl…

> There's plenty of physical devices where it is possible

Yup, but say Samsung, kiss KNOX goodbye. Fused off once you flash a non-Samsung image.

> and Google publish official emulator images with root access for every Android version released to date. This part is still OK.

Many apps will straight refuse to run in emulators unless you're lucky to snag a debug build that accidentally got pushed to production.

> Most of the root detection is beatable with Frida etc, mostly.

It's a cat and mouse game and frankly, I'm sick of it - and especially about the fact that it's either "accept that you'll need to wait X weeks until gets an update" or "install some unofficial closed source fork that may or may not be laced with malware".

> Best hope here is that a) it creates much work for most apps to bother and b) it eventually gets restricted as anti-competitive.

Rooting detection used to be too much work, then SDKs cropped up that made it very easy, and that will be the case for remote-verifiable hardware attestation.

And restrictions from anti-trust? No way that will happen in the next three years in the US, and here in the EU it takes about 5-10 years until our parliament finally gets to work after a problem gets too much attention for their lazy asses to ignore. And even then, the lobby from banks, game studios ("them cheaters!!!" in f2p scam games) and other influential lobbyists will likely prevent any serious action.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#102

Post by dsymonds »

Wowfunhappy wrote: post #99
bri3d wrote: post #87

Earlier quoted context omitted.

> If it's true that 90% of fraud comes from mobile despite all of the restrictions Statistics on mobile vs. desktop banking will really shock you; the mobile usage penetration is easily well upwards of 90% in many markets. There's also a skewed distribution for fraud-vulnerable users and scenarios. > I think it would be reasonable to disable those specific features on mobile while leaving the rest of the app accessib…

> Statistics on mobile vs. desktop banking will really shock you; the mobile usage penetration is easily well upwards of 90% in many markets. There's also a skewed distribution for fraud-vulnerable users and scenarios. But if my goal was to commit fraud, wouldn't I go to wherever it was easiest to commit fraud? The actual market penetration of each platform shouldn't matter.

It's usually done in bulk, so the overall payoff is the combination of value and number of targets, but the effort is typically sublinear with the targets. Something easier to attack but relatively low in number is not as juicy as something a bit harder (where the effort is mostly a one-off up-front rather than per target) but having many, many more targets.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#103

Post by briHass »

selinkocalar wrote: post #89

IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning. Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.

The stuff on the shelf, sure, but you can always go 'prosumer-grade' like Ubiquiti or Mikrotik for hardware that actually receives timely updates and has competently written firmware.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#104

Post by fignews »

bmurphy1976 wrote: post #100
baby_souffle wrote: post #92

Earlier quoted context omitted.

Or openWRT. The bsd based distributions sure are powerful, but with the power/heat budget to match.

I love me some OpenWRT but updating it has always been a risky chore.

Check out attended sysupgrade

Re: Wanted to spy on my dog, ended up spying on TP-Link

#105

Post by cortesoft »

selinkocalar wrote: post #89

IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning. Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.

Most people are using routers given to them (and configured by) their ISP... so really they are blackboxes connected to an upstream blackbox for most people.

I am always surprised by how many people give me their ISP chosen router name and ISP chosen password when I connect to their WiFi. I don't want to give my ISP that much control.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#106

Post by BLKNSLVR »

I tried and failed at enough suggestions I found on the internet and via AI to cobble together a frigate configuration that eventually worked with the Tapo cameras.

RTC setup section:

  go2rtc:
    streams:
      :
        - rtsp://tapoadmin:@:554/stream1
        - ffmpeg:#audio=opus
        - tapo://@
      _sub:
        - rtsp://tapoadmin:@:554/stream2
        - ffmpeg:_sub#audio=opus
        - tapo://@
Main section:

  :
    ffmpeg:
      output_args:
        record: preset-record-generic-audio-aac
      inputs:
        - path: rtsp://127.0.0.1:8554/_sub
          input_args: preset-rtsp-restream
          roles:
            - detect
        - path: rtsp://127.0.0.1:8554/
          input_args: preset-rtsp-restream
          roles:
            - record
            - audio
    detect:
      enabled: true
      width: 640
      height: 360
      fps: 7
    live:
      streams:
        : 
    record:
      enabled: true
      retain:
        days: 0
        mode: all
Where:

* is just any old short name you want to assign to the camera.

* is the main name for the camera that will be shown in the frigate UI

* is something set individually on each camera (settings > Advanced > Camera Account, set it to On and setup username/password > Account Information)

* is the password setup for the Tapo app (I'm not sure how necessary this is, since there's nowhere that the username is specified... this is the only bit I'm fuzzy on)

This is the basics that works for me for the Tapo cameras. There are a boatload of other settings specific to Frigate (but not specific to Tapo cameras).

This is nowhere near as cool hack as the article, however.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#107

Post by drnick1 »

briHass wrote: post #103
selinkocalar wrote: post #89

IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning. Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.

The stuff on the shelf, sure, but you can always go 'prosumer-grade' like Ubiquiti or Mikrotik for hardware that actually receives timely updates and has competently written firmware.

Ubiquiti is awful, it's a cloud-centric ecosystem. The best "prosumer-grade" stuff is probably OpenWrt. If you need more power, opnSense or a plain Linux distro on an x86 machine.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#108

Post by drnick1 »

teaearlgraycold wrote: post #90
selinkocalar wrote: post #89

IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning. Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.

The solution is pfsense

Actually, pfsense kind of has a shitty reputation in the FOSS community and opnSense is preferred.

But I don't like the limitations of BSD systems in terms of hardware compatibility and performance, so I build my router using a plain Linux distro (Debian).

Re: Wanted to spy on my dog, ended up spying on TP-Link

#109

Post by BLKNSLVR »

java-man wrote: post #97
selinkocalar wrote: post #89

IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning. Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.

IOT - "S" stands for "Security"!

The password for my IoT wifi is "TheSInIoT"

;)

Re: Wanted to spy on my dog, ended up spying on TP-Link

#110

Post by xrd »

Does anyone have a good reference for which tapo cameras support rtsp? I have a c210 that works well (sort of, you can't use it with their cloud capture) and I have it working with frigate.

But today I got a c402 (outdoor) thinking I could use it to capture my son's soccer practice. But that doesn't have the camera account option under advanced.

I love the price point of these devices but the functionality is all over the place.

If anyone knows a good outdoor camera, preferably with solar panel, that is cheap and has an rtsp stream, please let me know.

Post reply on HN