Child pornography on sale from hacked Hikvision cameras using Hik-Connect app

https://ipvm.com/reports/cp-sale-hack?code=fgasdtgf

by fortran77 • 3 years ago

51 100 3 years ago

bell-cot• 3 years ago

Daydream: At some level of such child-safety f*uck-ups, the company's exec's get to spend the rest of their lives in brightly-lit plexiglass jail cells. Naked. Surrounded by publicly accessible web cams.

trompetenaccoun• 3 years ago

Surveillance is bad enough as it is, I'll never understand why some people install internet-connected CCTV inside their own homes. What's that even for, spying on your family members? Using a brand like Hikvision is the bizarre cherry on top.

JumpCrisscross4• 3 years ago

I'll never understand why some people install internet-connected CCTV inside their own homes. What's that even for, spying on your family members?

In case someone breaks in. To keep an eye on the housekeeper. This past winter an ice dam sprung a leak in the roof. I was there and caught it promptly. But had I been away, the damage would have been severe. Cameras would have let me keep an eye on that. I don't think it's worth the tradeoff in terms of privacy. But I can understand someone else deciding differently.

kypro2• 3 years ago

Motion sensors make way more sense imo. All you need to know is that someone's there who shouldn't be. What's the value of seeing them sneaking around your home in a balaclava?

sspiff• 3 years ago

To keep an eye on the housekeeper.

If you can't trust your housekeeper not to steal from you (or do something else you want to catch on camera), you either hired the wrong person or are not paying them a fair wage. Either way, it's a you-problem.

dragonwriter• 3 years ago

I'll never understand why some people install internet-connected CCTV inside their own homes. What's that even for, spying on your family members?

Well, babysitters (there is a reason they are called nannycams), and also often just for local app access to video baby monitors because no one makes consumer devices LAN accessible, they always use internet with a hosted server for app access.

Using a brand like Hikvision is the bizarre cherry on top.

The virtual death of brick and mortar retail and the general Amazonization of retail (not just Amazon itself, but the other looks-like-an-online-retailer-but-really-is-an-ungatekept-open-marketplace sites) contributes heavily to that.

squarefoot3• 3 years ago

Making potential intruders uncomfortable. The whole point of protection isn't to stop burglars, as there's no such thing as an impenetrable house, but to delay and discourage them so that they will rather try the next house or, better, move to another area. It may seem harsh, but that's how it works. Surveillance forces them to wear masks, park their cars far away, etc.

Regarding HikVision cameras, they're closed and untrustworthy just like every other brand out there; there's a huge list of compromised cameras, and only some of them were from HikVision. I wouldn't feel safe with any camera that I didn't put behind a physical separated and firewalled network that I would access only using Open Source software (read: no proprietary apps).

klyrs• 3 years ago

What's that even for, spying on your family members?

It's good for making catchy music videos too https://m.youtube.com/watch?v=9xxK5yyecRo

jayski• 3 years ago

I have exactly those Hikconnect all over my house. I always felt unsafe about them. My house doesn't have a static IP, so obviously the only way for me to connect to them when I'm away is through an intermediary

Having some technical networking knowledge I disconnected them from the Internet and set up a VPN where my wife and I first have to connect to prior to viewing the cameras.

Why do I surveil my own home? Because I have small children, when my wife and I go out and they stay with a baby sitter it gives us peace of mind to have the ability to verify everything is good. Also although we trust the sitters, we trust them even more knowing they know there's cameras.

Why did I get the cheap ass sketchy cameras? Cause I'm a cheap ass. The system I have cost about 2K with installation and spending 2 or 3x was outside our budget.

unforeseen9991• 3 years ago

My house doesn't have a static IP, so obviously the only way for me to connect to them when I'm away is through an intermediary

Dynamic DNS record services have been around almost since the beginning of the public internet, and it's not the only way to deal with a remote location that has a changing IP address.

It's far from "obviously the only way for you to connect" - you are just ignorant of your options

scruple• 3 years ago

We use ours when we're away from home but have people in our home to watch our pets. Otherwise, they're unplugged and sitting in a drawer in my home office.

shudza2• 3 years ago

These ip cameras have 2-3 different backdoors, which are even easy to discover. Probably more not so easy ones. If you have this in your home disable outgoing connections at router level, and you're safe.

formerly_proven2• 3 years ago

If you have this in your home disable outgoing connections at router level, and you're safe.

This is bad advice and people should stop posting it. An IP or MAC based rule does not prevent a malicious device from exfiltrating data and neither does it protect a vulnerable device from other devices in the network.

IP cameras must be installed with a separate broadcast domain. Be that a separate switch or a port-based VLAN. The only connection if any should be through the trusted NVR/VMS.

shudza2• 3 years ago

An IP or MAC based rule does not prevent a malicious device from exfiltrating data

Care to elaborate?

saetaes• 3 years ago

I bought some cheap IP cameras to monitor our cabin while we're not there, and every single time we arrive I unplug them. This makes me feel vindicated that I'm not just paranoid; the creeps really are one buggy firmware away from selling videos of your family on the Internet.

CCRpoundher4• 3 years ago

Stuff like this is why I believe software engineering ought to start requiring a professional license.

insanitybit11• 3 years ago

That's definitely a very spicy take but I think people need to be more willing to engage with the idea. There is a serious problem where software engineers are building systems that, when built poorly, are causing significant harm.

If we don't engage with that problem we're going to get regulated in a way that we may not like.

edit: Look at how many comments are just attacking a straw man policy. This is why we're going to end up getting regulated in some dumb way - people can't or won't even imagine a situation better than this one.

ryandrake5• 3 years ago

This is one of the few opinions which are consistently rejected by the HN peanut gallery, unsurprisingly since most of us are developers. OP is brave to outright say it!

Any time you bring up the idea of accountability to “engineers” for defects in their software that cause serious, real life harm, you get a litany of excuses in response, instead of good faith debate. If an engineer signs off on a bridge and it collapses, injuring a dozen people, there will at the very least be questions asked, if not more accountability. But if a software engineer implements a shoddy system that gets hacked and results in this kind of very personal data getting exfiltrated, all you get is 1,000 versions of “it’s not the developers’ fault!” and “they were probably under an impossible deadline!” And “bad manager told them what to implement, they had no choice!” and “the market forces this, careful developers can’t compete!” and so on.

Saying there should be licensure with revocation as a consequence in extreme cases? Now that’s crazy-talk here!

ronsor• 3 years ago

I mean, the camera in question is from China. China is simply not going to care about any new regulation.

kodah• 3 years ago

I'd be supportive of licensing but it needs to go after the right things. Currently the industry is dominated by academics who took their CS & CE degrees and made them barriers to entry for jobs. Real software engineering involves very little DS&A. If we were making people demonstrate competency around OWASP on an infrastructure and dynamic application level I think licensure would go a long way.

Xeoncross3• 3 years ago

It wouldn't work. A ton of recent attacks and crypto all originated outside the US as well. Plenty of porn, scam calls, and war research on weapons systems.

There is no way the entire world would agree/require a shared license for writing software.

insanitybit11• 3 years ago

The US could easily influence other countries here by enforcing labeling of 'non compliant' devices, tariffs, or flat out banning the sale of those items in the US.

Consumers could also look at something that is built in the US and understand that it is built to a different standard. Right now I don't think consumers really have a strong sense of "this is going to have worse security than that".

dilap2• 3 years ago

I don't think requiring a professional license would result in these cameras being secure. The issue isn't individual developers, but market forces not rewarding making the investment to make software secure.

I could imagine things like (spitballing) requiring security audits for this kind of software or, say, assessing very large financial penalties in the event of security flaws being found, working -- those would incentivize the company to make a genuine effort to make their software secure.

CCRpoundher4• 3 years ago

Why wouldn't it be any different than other Engineering disciplines?

A professional license comes with ethics. If you release a product that you certified was good to go but later comes out that you effectively skipped corners, you're out a career.

bombolo• 3 years ago

Some people do honestly think they made their product secure.

I've met a guy who claimed that with a clear text and an encrypted email he could derive my private PGP key (yes he failed to deliver).

I'm sure he was not the only person in the world overestimating his own knowledge.

OO000oo• 3 years ago

It's a non-starter. Tech companies would never allow anything remotely like that to happen.

DecayingOrganic• 3 years ago

Even with heavy licensing in the medical field, research cites medical errors like wrong diagnoses and surgical mishaps causing over 250,000 US deaths yearly [0]. Granted, some studies argue over the exact number, but the core truth remains. Licenses don't eliminate human error.

[0] https://www.bmj.com/content/353/bmj.i2139

guerrilla• 3 years ago

Perfect is the enemy of good. Licensing could make the situation alot better... or worse.

pipo234• 3 years ago

A license, that can be revoked. Like a doctors license. (Not just some "seal of professionalism" certificate, like, ITIL, PCI, Prince2 or that garbage of course.)

Its an interesting proposition. But thinking it through: suppose the issue were that Hikvision weren't licensed and that therefore all those cameras were illegal. But they're still there, filming. And so will future cameras from certified suppliers that simply never get firmware updates, because the user never enabled them.

A professional license will probably help. Another approach would be to completely outlaw cameras in certain locations.

But the broader problem is that people like cheap cool new stuff and then neglect it.

lyu07282• 3 years ago

Like have you seen the code academics write? Who is supposed to license developers, bad software is the result of bad management and profit maximization not giving a shit about software quality. It's just in the neoliberal hell world we live in we can only ever blame the workers of course. The managerial class has so much class solidarity, we just down here idiotic peasantbrained as always.

CCRpoundher4• 3 years ago

It's not blaming workers, it's why isn't this class of career protected like others in it's class (electrical, mechanical, etc.)

A professional license benefits the professional as well as the profession itself as a whole.

darepublic• 3 years ago

Sounds awful and dystopian. Just a big layer of ineffective bureaucracy on top of every else.

CCRpoundher4• 3 years ago

Okay. Would you rather drive on a bridge that was just designed by amateurs in their basement or engineers that are licensed and professionally held responsible if it collapses?

squarefoot3• 3 years ago

Stuff like this is why I believe software engineering ought to start requiring a professional license.

Many murderers had a regular gun permit, and almost all drivers who killed someone in a car accident because of their negligence had a driving license. A professional license for software engineering would not help at all if not accompanied by a thorough psychological evaluation of the person who is being given access to sensitive personal data.

lo_zamoyski• 3 years ago

Difficult to generalize. There are varieties of programming and software engineering and varieties of safety and rigor needed. Writing software for a janky little web app vs. phone app for note taking vs. firewall software vs. compilers vs. operating systems vs. operational software for automated trains vs. medical device software.

It's probably better to regulate the particular domain.

throw_m2393394• 3 years ago

Stuff like this is why I believe software engineering ought to start requiring a professional license.

So the developer goes to jail in case of negligence? Not the executives who actually forced bad decisions? Like in the car industry? No.

The people here who are pushing for a license to deploy anything every time there is a hacking scandal somewhere just want to stifle innovation, and eliminate competition and create their own little "developer elite" with themselves as gatekeepers.

the_only_law• 3 years ago

I just want to know what the certification examination that somehow is going to determine the worthiness of every developer across every domain look like.

fareesh• 3 years ago

Is there a way to remotely control a Hikvision camera with open source software without using their cloud?

I have a PTZ camera which works well but I rarely use it

squarefoot3• 3 years ago

If the camera is ONVIF compatible, and most Hikvision are, it should work with Zoneminder and its mobile Open Source app zmninja.

As for the cloud, if you have a public (not necessarily static) IP and your carrier doesn't filter incoming connections, you can use a dynamic DNS such as DuckDNS.

It is however always advisable to put all cameras behind a firewall, so that whatever it could happen (compromised or not, it still runs a closed firmware) it can be restricted to a dedicated physical network with no access to any personal data.

https://zoneminder.com/

https://zmninja.zoneminder.com/

https://www.duckdns.org/

PaulAJ• 3 years ago

I use a Raspberry Pi, cheap USB webcam and https://raspberry-valley.azurewebsites.net/MotionEye-OS/ Motion Eye to watch out for intruding cats coming through the cat flap. Entirely open source, completely under my control, and simple to set up. What's not to like?

nbernard• 3 years ago

Among the cheap USB webcams, any model you would recommend ?

kypro2• 3 years ago

My autistic sense of morality is off a little with this. My guess is that this type of thing happens far more often to unsuspecting adult women simply using public changing rooms or public bathrooms, etc.

My guess is that the child-incidents here are much fewer and far between and rarely ever publicly shared – and when they are shared (even if not publicly) it's taken extremely seriously by law enforcement (as it should be).

On the other hand, I get the impression that it's relatively easy to find this type content featuring adult women on popular porn / social networks – at least I see stuff that looks suspicious quite often on sites like Reddit and 4chan.

I really wish more focus was put on the "revenge porn" / "hidden camera" area generally. It's quite sad that so many women are victims to this and as a society we don't really seem to care unless a child is involved. In fact I'd argue our society and media almost normalises perving on adult women. Just search for any random famous celeb women and there's probably a dozen popular sites with nude or semi-nude photos of her taken by some perv spying on her during vacation. Anyone care to put some effort into stopping that? Why is that content even allowed on the public internet?

htag• 3 years ago

Society takes the child-incidents more seriously because of how much more vulnerable children are to predators and how much trauma a predator can inflict. We take a snip it in the bud approach with anyone involved in these crimes. I agree that what you are talking about is terrible, and if law enforcement had unlimited resources we would stop all of that activity too.

Cupprum• 3 years ago

Why is that content even allowed on the public internet?

How could this be even done? If you have open internet, then its every hard. If you just try to keep it off some specific sites, like facebook, its still hard. Facebook pays a lot of money to Accenture to clean up facebook, but from time to time you can still find something what is not supposed to be there.

TazeTSchnitzel• 3 years ago

Why is that content even allowed on the public internet?

Consenting adults can do whatever they like, including creating consensual/fake hidden camera pornography, and there's quite some market for such content. In general, at a glance, there's no way to distinguish legitimate from illegitimate content, no matter the pornographic (or other) genre. So how do you know what's illegal and what's not? It's by no means easy to solve at the level of an individual piece, let alone at scale. Many of the proposed solutions amount to mass surveillance, invade the privacy of performers, or make it so onerous to upload pornography that they effectively amount to bans of it. It's no secret that the Christian Right are quietly supportive of certain “anti-exploitation” approaches because they would destroy the market for legal pornography, putting sex workers out of work. It's a very difficult balancing act and no position avoids harming someone.

megraf• 3 years ago

I might be reading this different than most; I read this as: "these cameras are being used as a storage medium for Child Pornography, and content is being shared by leveraging Hik Connect"

Not necessarily that the cameras were doing the capturing.

jhonovich• 3 years ago

The cameras are doing the capturing, I can confirm (IPVM employee).

gumballindie2• 3 years ago

Never use cameras than rely on some dubious (or even on legit) cloud “providers”. Heck knows that employees do with the content. I bought a baby monitor off of amazon once only to discover it sends content somewhere in china. Never again. Went for a local radio based monitor and called it a day. Ring doorbells have their camera off when at home. Also they are pointed towards objects (door or parked car).

Saris• 3 years ago

Yup, my setup is local RTSP cameras with firewall rules to completely block traffic to/from them, local Frigate server that pulls the stream and runs object recognition and handles recording, and then a Wireguard VPN if I need access from outside the local network.

It's been very reliable, has no fees, and I'm not worried about cameras being hacked or cloud storage issues.

gumballindie2• 3 years ago

Damn, that’s impressive! I am adopting your architecture - you should def blog about it in case you haven't already.