If you can read this, either the style sheet didn't load or you have an older browser that doesn't support style sheets. Try clearing your browser cache and refreshing the page.

(BBC)   If you have a Trendnet home security camera, welcome to the show: you're it   (bbc.co.uk) divider line 47
    More: Fail, TRENDnet, cam, security cameras, Uniform Resource Locator  
•       •       •

10510 clicks; posted to Geek » on 07 Feb 2012 at 9:17 AM (2 years ago)   |  Favorite    |   share:  Share on Twitter share via Email Share on Facebook   more»



47 Comments   (+0 »)
   
View Voting Results: Smartest and Funniest

Archived thread
 
2012-02-07 08:15:07 AM
Useless without pics.....
 
2012-02-07 09:24:08 AM
jimcarrey-information.com

Not amused. Well, maybe he is.

/one of my all-time favorites
 
2012-02-07 09:24:51 AM
a1.idata.over-blog.com
 
2012-02-07 09:26:32 AM
Welcome to Fark, where you'll read last month's news, today.
 
2012-02-07 09:36:50 AM
I'll have to get one of these as a gift for that neighbor of mine with three hot, teenaged daughters.
 
2012-02-07 10:08:18 AM

star_topology: [jimcarrey-information.com image 300x309]

Not amused. Well, maybe he is.

/one of my all-time favorites


when I saw that movie as a kid, it made me stop masturbating for like a week, I was paranoid someone was watching.

/so did the orb Zordon uses in Power Rangers
 
2012-02-07 10:11:09 AM
Holy shiatsnacks!

Googling "trendnet" brought me to a pastebin with over 600 camera addys.

Most are boring, a baby or two, sure, lots of homes, offices and workplaces and (hehe) one fat-stomached farker in fron of his computer. Which one of you is that?

Still, this is very not cool. People are not gonna be happy.
 
2012-02-07 10:15:58 AM
I think we figured out what is causing the slowdown of the web... Skynet is accessing these cameras to find Sarah Connor.
 
2012-02-07 10:19:36 AM
Hmmm... more than a couple of cribs.
It must be weird, growing up under constant camera surveillance.
What a weird new world we're making.
 
2012-02-07 10:45:37 AM
I'm not familiar with Trendnet's cameras or this particular exposure... Do the cameras run their own internal web server? If so, then I assume the exposure is somewhat mitigated if they're sitting on a WPA-protected network? Or is the exposure that they also listen for unencrypted requests?
 
2012-02-07 10:46:21 AM

Porous Horace: Holy shiatsnacks!

Googling "trendnet" brought me to a pastebin with over 600 camera addys.

Most are boring, a baby or two, sure, lots of homes, offices and workplaces and (hehe) one fat-stomached farker in fron of his computer. Which one of you is that?

Still, this is very not cool. People are not gonna be happy.


Yeah, spying on people isn't as fun as it sounds. I think the most interesting cam I saw was a darkened server room with lots of blinky lights. A fair portion of links were dead - or so slow I didn't wait long enough for them to load.

Oh great - I just found a cage with 2 furry creatures in it that hopefully are just sleeping. I can't tell what they are, but I'm going to have to keep that tab open until they move around. It makes me want to poke them with a stick.
 
2012-02-07 10:47:32 AM

Porous Horace: Holy shiatsnacks!

Googling "trendnet" brought me to a pastebin with over 600 camera addys.

Most are boring, a baby or two, sure, lots of homes, offices and workplaces and (hehe) one fat-stomached farker in fron of his computer. Which one of you is that?



Waves.
 
2012-02-07 10:50:02 AM

arcas: I'm not familiar with Trendnet's cameras or this particular exposure... Do the cameras run their own internal web server?


Yes.

If so, then I assume the exposure is somewhat mitigated if they're sitting on a WPA-protected network?

No.

Or is the exposure that they also listen for unencrypted requests?

They're running a wide-open web server that anybody can access. Of the over 600 cameras on that list, I've found ONE that asks for an HTTP password.
 
2012-02-07 10:51:19 AM

Kar98: Welcome to Fark, where you'll read last month's news, today.


Last month's? The brand of camera may be new, but the ability to access people's webcams has been around for years. You could Google certain phrases and come up with page after page of accessible cams. Some you could even control remotely.
 
2012-02-07 10:54:32 AM

stevetherobot: Kar98: Welcome to Fark, where you'll read last month's news, today.

Last month's? The brand of camera may be new, but the ability to access people's webcams has been around for years. You could Google certain phrases and come up with page after page of accessible cams. Some you could even control remotely.


Hell, you can control the heat and A/C on some people's homes from the comfort of your own basement a thousand miles away. But no, I meant this particular weakness has been widely known and amused thousands of /b/tards since January 12 of this year.
 
2012-02-07 10:59:28 AM
I have to admit, I had never heard of the "Shodan Search Engine" before this article.

Great game(s)
 
2012-02-07 11:11:39 AM

Kar98:
They're running a wide-open web server that anybody can access. Of the over 600 cameras on that list, I've found ONE that asks for an HTTP password.


See, that's the part I don't fully understand. So these cameras have obtained an IP address, presumably assigned by a DHCP server running somewhere on the user's network. In the case of my home network, that DHCP request must occur either on the wired subnet or over the WIFI subnet (WPA2-protected). In either case, that IP address is going to belong to a private subnet (10. or 192.168.) and won't be routable from outside the firewall.

Seems to me people who're exposed are for those who just plug their cable/DSL modems into an ethernet switch along with all their other devices with no router/firewall sitting in between?
 
2012-02-07 11:16:48 AM
One thing I have discovered through this so far:

Almost everyone has a less cluttered house than mine.
 
2012-02-07 11:23:50 AM

Happy Hours: Porous Horace: Holy shiatsnacks!

Googling "trendnet" brought me to a pastebin with over 600 camera addys.

Most are boring, a baby or two, sure, lots of homes, offices and workplaces and (hehe) one fat-stomached farker in fron of his computer. Which one of you is that?

Still, this is very not cool. People are not gonna be happy.

Yeah, spying on people isn't as fun as it sounds. I think the most interesting cam I saw was a darkened server room with lots of blinky lights. A fair portion of links were dead - or so slow I didn't wait long enough for them to load.

Oh great - I just found a cage with 2 furry creatures in it that hopefully are just sleeping. I can't tell what they are, but I'm going to have to keep that tab open until they move around. It makes me want to poke them with a stick.


I saw a cage with a nice white doggie in it.
The cage looked a bit small for the dog. Maybe I should call the cops.
 
2012-02-07 11:27:15 AM

arcas: Seems to me people who're exposed are for those who just plug their cable/DSL modems into an ethernet switch along with all their other devices with no router/firewall sitting in between?


Or routed port 80 through to the webcam's IP because they want to be able to check the camera while out of the house. What good is a security system that requires you to check it, if you can't check it? They probably expected that the 'randomly generated directory' would be random, and that the http password would be checked.

And, probably quite a few did just plug the damn device in and let it get a publicly accessible IP addressed. People aren't smart.
 
2012-02-07 11:29:27 AM

arcas: Kar98:
They're running a wide-open web server that anybody can access. Of the over 600 cameras on that list, I've found ONE that asks for an HTTP password.

See, that's the part I don't fully understand. So these cameras have obtained an IP address, presumably assigned by a DHCP server running somewhere on the user's network. In the case of my home network, that DHCP request must occur either on the wired subnet or over the WIFI subnet (WPA2-protected). In either case, that IP address is going to belong to a private subnet (10. or 192.168.) and won't be routable from outside the firewall.

Seems to me people who're exposed are for those who just plug their cable/DSL modems into an ethernet switch along with all their other devices with no router/firewall sitting in between?


Not sure if this is applicable, but if they've enabled UPnP, it will take care of the port forwarding and translation if they cameras are behind a NAT.
 
2012-02-07 11:30:52 AM

arcas: Kar98:
...
Seems to me people who're exposed are for those who just plug their cable/DSL modems into an ethernet switch along with all their other devices with no router/firewall sitting in between?


Most home routers come with UPnP these days. They may have set it up once for something else and not realized the camera is wide open.

"Using UPnP, applications that support it can automatically tell the router to open the port they're listening on and close them when their done listening. Automatic port forwarding with UPnP means you don't have to worry about IP address, ports, or anything like that."
 
2012-02-07 11:32:47 AM

arcas: See, that's the part I don't fully understand. So these cameras have obtained an IP address, presumably assigned by a DHCP server running somewhere on the user's network. In the case of my home network, that DHCP request must occur either on the wired subnet or over the WIFI subnet (WPA2-protected). In either case, that IP address is going to belong to a private subnet (10. or 192.168.) and won't be routable from outside the firewall.


Network Address Translation. The cameras have a private IP address on the owners' home LAN, but are accessible through the public IP address assigned by their ISP, and anybody can access that from any public IP address because these cameras are running a public web server, unless the owner chose to protect them with a password.
It's pretty farking stupid not to have the user set a password by default though.
 
2012-02-07 11:36:45 AM

Scorpion: "Using UPnP, applications that support it can automatically tell the router to open the port they're listening on and close them when their done listening. Automatic port forwarding with UPnP means you don't have to worry about IP address, ports, or anything like that."


And that's another thing: we've just moved to a new place in a new city, and while we were moving in and our internet service wasn't transferred yet, I fired up the iPad and was able to hook into several private WLANs. The closest and strongest one was a dlink access point. Hooked into it no problem, but when I tried to get the wife's Windows 7 laptop to connect to it, the access point demanded that I enter the number on the sticker at the access point's bottom, whereas the iPad and iPhones didn't even notice this security barrier was there.
 
2012-02-07 11:44:25 AM

stevetherobot: Porous Horace: Holy shiatsnacks!

Googling "trendnet" brought me to a pastebin with over 600 camera addys.

Most are boring, a baby or two, sure, lots of homes, offices and workplaces and (hehe) one fat-stomached farker in fron of his computer. Which one of you is that?



Waves.


Put on a shirt!
 
2012-02-07 11:46:06 AM
YodaBlues:

arcas: Kar98:
They're running a wide-open web server that anybody can access. Of the over 600 cameras on that list, I've found ONE that asks for an HTTP password.

See, that's the part I don't fully understand. So these cameras have obtained an IP address, presumably assigned by a DHCP server running somewhere on the user's network. In the case of my home network, that DHCP request must occur either on the wired subnet or over the WIFI subnet (WPA2-protected). In either case, that IP address is going to belong to a private subnet (10. or 192.168.) and won't be routable from outside the firewall.

Seems to me people who're exposed are for those who just plug their cable/DSL modems into an ethernet switch along with all their other devices with no router/firewall sitting in between?

Not sure if this is applicable, but if they've enabled UPnP, it will take care of the port forwarding and translation if they cameras are behind a NAT.


This. UPnP is one of those things that cuts down on support calls by making things easy and automatic for the user, but also makes it so the user has no idea what's going on on their network.

I always disable it when setting up a home router, otherwise you end up with things like cameras automatically punching holes through the router to the internet.
 
2012-02-07 11:46:33 AM

Kar98: Scorpion: "Using UPnP, applications that support it can automatically tell the router to open the port they're listening on and close them when their done listening. Automatic port forwarding with UPnP means you don't have to worry about IP address, ports, or anything like that."

And that's another thing: we've just moved to a new place in a new city, and while we were moving in and our internet service wasn't transferred yet, I fired up the iPad and was able to hook into several private WLANs. The closest and strongest one was a dlink access point. Hooked into it no problem, but when I tried to get the wife's Windows 7 laptop to connect to it, the access point demanded that I enter the number on the sticker at the access point's bottom, whereas the iPad and iPhones didn't even notice this security barrier was there.


Did you try to access the web from the apple devices? There are 'guest' type access points that all you to establish a connection, but any browsing you do will redirect you to a login screen when you have to enter a password. But just attaching to the SSID, no problem.
 
2012-02-07 11:49:25 AM
UPnP is fine...provided you have strict MAC filtering to determine which devices are allowed to attach to the network.
 
2012-02-07 11:53:49 AM
Caelistis:

UPnP is fine...provided you have strict MAC filtering to determine which devices are allowed to attach to the network.

And if you're doing that, you're probably not the sort of person having this problem and can maintain the port forwarding list by hand.
 
2012-02-07 11:56:17 AM

Vlad_the_Inaner: Did you try to access the web from the apple devices? There are 'guest' type access points that all you to establish a connection, but any browsing you do will redirect you to a login screen when you have to enter a password. But just attaching to the SSID, no problem.


I've got full access right now, and under setup, wireless settings, it even gives me the PIN it was asking for.
 
2012-02-07 12:04:14 PM

Kar98: Vlad_the_Inaner: Did you try to access the web from the apple devices? There are 'guest' type access points that all you to establish a connection, but any browsing you do will redirect you to a login screen when you have to enter a password. But just attaching to the SSID, no problem.

I've got full access right now, and under setup, wireless settings, it even gives me the PIN it was asking for.


Oh, so basically someone took an AP out of its box, plugged it in, and left the admin access wide open even though they set up a guest password. All without defining an encryption password.

Did you even have to type "Admin" as a password to get into the control web page?


Swift.

I wonder if it would be a mercy to change the SSID to "INeedToRtfm"
 
2012-02-07 12:08:28 PM

Vlad_the_Inaner: Did you even have to type "Admin" as a password to get into the control web page?


On that model router, the user name is "admin" (and you don't even have to type that in, it's a drop down menu) and the default password is blank.

I wonder if it would be a mercy to change the SSID to "INeedToRtfm"

Well, I turned off SSID broadcast. After checking the DHCP clients table, seeing that they named their Windows PC after themselves, and looking for that name plus the town in question on Facebook and finding which mosque they attend, where they work and what the names of their offspring, parents and friends are.
Ach, it's hard to be ethical.
 
2012-02-07 12:32:02 PM
moistD :when I saw that movie as a kid, it made me stop masturbating for like a week, I was paranoid someone was watching.


Huh, that's funny. Because I really picked up the pace.
 
2012-02-07 12:43:24 PM
According to TFA, Trendnet had known about the problem for at least three weeks before press attention forced them to take public action. Trendnet management is clearly populated by sociopaths.

I will bet that the code was written in Nepal for $4 an hour, by people who have no knowledge or concern for security or auditing.

Not that it matters. It could've been a crackerjack dev shop that very succinctly warned management about the vulnerability. Management's response would've been "Fixing that will cost money and lead to support calls from people who can't access their cameras. If we authorize that fix, we'll miss our annual bonus targets. Now shut up, get back to work, and delete all emails about this conversation."
 
2012-02-07 12:45:52 PM
There is a link on pastebin that has hundreds of them listed.

Ironic tag would have been appropriate.
 
2012-02-07 04:51:22 PM

Kar98: arcas: See, that's the part I don't fully understand. So these cameras have obtained an IP address, presumably assigned by a DHCP server running somewhere on the user's network. In the case of my home network, that DHCP request must occur either on the wired subnet or over the WIFI subnet (WPA2-protected). In either case, that IP address is going to belong to a private subnet (10. or 192.168.) and won't be routable from outside the firewall.

Network Address Translation. The cameras have a private IP address on the owners' home LAN, but are accessible through the public IP address assigned by their ISP, and anybody can access that from any public IP address because these cameras are running a public web server, unless the owner chose to protect them with a password.
It's pretty farking stupid not to have the user set a password by default though.


You still have to configure NAT unless their software has it built in which is generally limited to very specific routers.
 
2012-02-07 05:31:39 PM

Kazrath: You still have to configure NAT unless their software has it built in which is generally limited to very specific routers.


uPnP is pretty standard nowadays,
 
2012-02-07 06:33:00 PM
I found an elevator that could be promising. Too bad I can't hear the muzak!
 
2012-02-07 07:19:01 PM
i41.tinypic.com
 
2012-02-07 07:56:26 PM

dilate: [i41.tinypic.com image 320x240]


dilate: [i41.tinypic.com image 320x240]


ha ha

Black people were here.
 
2012-02-07 09:05:18 PM
After reading the article, before I read the above comments, I'm going to guess this is an Attack of the Insecure Default Preferences, Questionable Update version. Trendnet cameras have had a built-in web server to stream images from the camera for years; we bought some at my old job supposedly for that very reason (and then never actually got the system working... long story).
 
2012-02-07 11:13:49 PM
"they" been doing this on /b/ for months.

the fun = when you can back up the cam address and they didn't change the default admin/pass...

some of the camera text would be filtered here on Fark.
 
2012-02-08 05:58:37 AM

Caelistis: UPnP is fine...provided you have strict MAC filtering to determine which devices are allowed to attach to the network.


The word strict and mac filtering shouldn't be used in the same sentence. MACs can be spoofed and are not sent between the AP and client in an encrypted fashion 20 seconds with the appropriate packet analyzer app and you can find a perfectly good MAC address to use. Almost as equivalent to using the Club on your car. Keeps away the lazy.
 
2012-02-08 01:07:45 PM

Wellon Dowd: I'll have to get one of these as a gift for that neighbor of mine with three hot, teenaged daughters.


Twin eighteen year olds and one nineteen year old, of course.
 
2012-02-08 04:54:14 PM

Porous Horace: Holy shiatsnacks!

Googling "trendnet" brought me to a pastebin with over 600 camera addys.

Most are boring, a baby or two, sure, lots of homes, offices and workplaces and (hehe) one fat-stomached farker in fron of his computer. Which one of you is that?

Still, this is very not cool. People are not gonna be happy.


Wow, and to zoom in all you have to do is copy image url to another tab. Fascinating.

Really hopin' for a chick home alone, kids all gone, decides to run around naked...
 
2012-02-08 05:18:54 PM
So far I've seen a woman berating a child, and a guy clipping his toenails. Hmph.
 
2012-02-09 12:13:36 AM
I worked for a DVR company once where as the admins we had our "Best of the best" folder, mainly just super funny stuff. Two guys that got into a fist fight, one went to run away, turned and just face planted a light pole. Another this on going feud between 2 neighbors that had the most stupid "petty crimes" like stealing pottery, newspapers, etc. The video for that one was so much funny as it was the owners wanting to meet the police at our HQ to get backups provided to them (at $25 a dvd, even if it's 5 seconds of footage).

Then he had our "not for entertainment viewing, ever" that was pretty bad crime footage. I got to see the folder once, a casino robbery and shooting from cameras inside the cage looking at the robber 2 feet away. Another was a pretty grissly robbery-murder where you could see the red puddle slowly expanding from the guys head.

Other than, what everyone else said in this thread. The most boring stuff...ever. Only exception where the 10+ million homes. That was never boring, just the most amazing homes ever.

/CSB
 
Displayed 47 of 47 comments

View Voting Results: Smartest and Funniest


This thread is archived, and closed to new comments.

Continue Farking
Submit a Link »






Report