Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My security camera shipped a GitHub admin token in its login page

hhh.hn

Post reply on HN
Print view View original

221–230 of 265 posts

Re: My security camera shipped a GitHub admin token in its login page

#221

Post by ungreased0675 »

ece wrote: post #185
badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

Pinecube from pine64. https://pine64.org/devices/pinecube/

Would it be so difficult to include a simple plastic case? Having to find/design 3D printed cases adds time to getting these projects set up. I don’t have a 3D printer and have to go to the local maker space to make anything.

Re: My security camera shipped a GitHub admin token in its login page

#223

Post by hluska »

It’s kind of interesting - I imported security cameras for a business roughly twenty hours ago. The security problems at the time were unbelievable to a point that any kind of wireless, IP or any type of service offering remote view was really scary. It was always stupid stuff - little oversights, things that were hard coded and shouldn’t have been or extremely old versions of insecure software running critical functions.

Apparently, nothing has changed in two decades.

Re: My security camera shipped a GitHub admin token in its login page

#226

Post by inigyou »

oasisbob wrote: post #177
inigyou wrote: post #150

Earlier quoted context omitted.

If they converted to IPv6, they could easily have a globally unique address space. Real globally unique, not probabilistic.

The fact that the network concentrator co uses DoD v4 address space to avoid conflicts implies that their clients are bringing v4 addresses, so IPv6 is utterly irrelevant in this situation.

It's common for a network to address its own devices with v6 while carrying v4 traffic either natively or by tunneling. Saves v4 space.

Re: My security camera shipped a GitHub admin token in its login page

#227

Post by mschuster91 »

numpad0 wrote: post #158
badatnames wrote: post #107

Worthy thread to ask: is there such a thing as a white label IP camera (or similar) with a supported open firmware? Not asking for open source, but something close to plug and play that nonetheless has a way of stripping the rootfs as desired for bespoke use in a manufacturer-supported way. I have looked around before but I only found genuinely dev-oriented kits that weren't even in a shell, and crazy priced. edit: s…

Not exactly what you have asked for, but ESP32 based M5Stack and Seeed Xiao modules might fit the bill. They are not so expensive, are Linux-free, and there's no report so far of secret ping home features in the SDK.

ESP32 are powerful enough to run realtime image processing?! Wtf.

Re: My security camera shipped a GitHub admin token in its login page

#228

Post by kemotep »

ErroneousBosh wrote: post #149
inigyou wrote: post #118

Earlier quoted context omitted.

How many /24s does your organisation have? With IPv6, one block is almost always sufficient.

It's mental that my fairly techy-orientated but otherwise pretty standard UK ISP provides me with a /48 as default. So I have 1.2 million million million million IPv6 addresses available. That ought to be enough, eh?

Of course, we could hand all 8 billion people on the planet a thousand /48’s each and still have trillions and trillions to spare.

Re: My security camera shipped a GitHub admin token in its login page

#229

Post by mschuster91 »

necovek wrote: post #202
ButlerianJihad wrote: post #194

Earlier quoted context omitted.

I was working with Raspberry Pis, starting with a college honors project, around 2018. For a while, I thought about building a network of surveillance cameras around the interior of my home. The Raspberry Pi seemed like a tempting platform to hook up a bunch of cameras to it. Sadly, I could not find a backend surveillance app or system that was suitable for running such a network. The best one I found was some kind o…

As an — I am guessing — American, you should feel more comfortable with handing over your domestic surveillance to Russia or China than to a US-based company. They absolutely have no interest in your domestic matters, nor do they have a clear path to monetize your attention. There are non-IP cameras and coax interfaces, which would expose a USB video device on any Linux system, RPi included. Plenty of software to han…

> As an — I am guessing — American, you should feel more comfortable with handing over your domestic surveillance to Russia or China than to a US-based company. They absolutely have no interest in your domestic matters, nor do they have a clear path to monetize your attention.

Unfortunately, that isn't exactly true. Sure, they don't have any usage for your porch camera and its data, but the fact that it is hooked up to an IP classified as "US residential" or "US small-business" is the valuable thing. DDoS nodes, "residential IP proxy" malware or running botnet campaigns all benefit from a high bandwidth connection that is 99% not getting flagged in any list.

Post reply on HN