Google exposes security cameras

http://www.google.com/search?q=inurl%3A%22viewerframe%3Fmode%3Dmotion%22

by jacquesm • 17 years ago

60 37 17 years ago

jacquesm7• 17 years ago

I think the makers of these cameras should include a 'robots.txt' by default that stops crawlers (or more correctly asks them to stop) from indexing the cameras.

I highly doubt this is intended behaviour, some of these look like they were not meant to be exposed to the general public.

tsally2• 17 years ago

The security cameras aren't exposed because of Google, but rather because of a website admin that didn't know what he was doing. Google's responsibly for this is akin to the responsibly a construction company has for building roads to an insecure bank. :-p

axod• 17 years ago

The default setting on most ip cameras is "public". I can't remember it atm, but there's another search you can do that exposes a ton of cameras of the form

<uniqueID>.something.com where something is setup by the camera makers to provide an easy way to share your cam. (This isn't anything new, I was thinking of doing some analysis on all the public IP cams you can find on google a few years ago).

Here's another one http://www.google.co.uk/search?hl=en&q=inurl%3A%22snapsh...

After the 1st page or so, the rest are all Panasonic IP cams.

I think the answer is to have IP cam makers default to private - just like routers/hubs/etc

dattaway• 17 years ago

The default robots.txt on my Axis camera is deny. Myself and many others often change this to watch people play with the camera and catch things out of the ordinary. Mine is a 35x optical zoom, pan and tilt, have fun:

http://www.dattaway.net:8000/view/viewer_index.shtml

jacquesm7• 17 years ago

For the majority of these I doubt there even is a website admin. I think most of these urls were found by people that have the google toolbar installed looking at their own private cameras.

There are downsides to the toolbar, one of them is that google knows about urls that are never linked.

gojomo5• 17 years ago

Do you have any examples where URLs that were only discovered via toolbar reporting (from one or any number of visitors) appear in Google's search results, even though never linked from any other page?

Some sites use unique per-user access URLs as their only access-control; I would have expected more tales of woe if such URLs regularly received Googlebot visits or appeared in search results.

karanbhangui• 17 years ago

Lovely analogy. Is there a way of coming up with these, i've been trying to improve my ability to do so for a long time :P

They're such useful tools in arguments.

gojomo5• 17 years ago

I like to use such analogies, but have actually found them very limited for persuasive purposes, or only very effective with certain kinds of abstract thinkers.

Of course, if you already agree with a speakers' point, the analogy makes sense and helps make the matter vivid.

But when a listener intuitively disagrees, the analogy can derail discussion. Even though in the spirit in which it was offered, it aligns one axis of the issue at hand, with one axis of the offered analogous situation, the listener instead may focus on -- and comment about -- every other dimension of the two things that are wildly different.

For some thinkers, all those other differences are easy to factor out -- of course they're different in those dimensions, and the wild variance only serves to highlight the similarity-in-one-dimension-of-interest. But for other fuzzier/holistic thinkers, every difference is a distraction to be considered separately, and the attempted analogy may harden them against your point.

Worst case is when some other aspect of the analogy so dominates listeners' thought (or can be cynically flipped against you to imply you've said something you didn't mean). This is why Nazi analogies can be so conversationally-derailing -- whatever one small comparison was being intended, the response is "how dare you call [Bush|Obama|Teachers' Unions|Evangelicals|Mall Santas|etc] Nazis!"

tsally2• 17 years ago

Try explaining tech stuff to tech-illiterate people. The road analogy has come in useful many times when explaining the ethics of vulnerability research and related security matters.

dryicerx• 17 years ago

If anyone remembered johnny i hack stuff from way back (mmm nostalgic) that popularized using google to find vulnerabilities such as this. The reincarnation of that site seems to be http://www.hackersforcharity.org/ghdb/ (lists a wealth of google discoverable devices/services and other stuff)

mahmud• 17 years ago

Johnny popularized the phrase "google hacking". See his "No-Tech Hacking" session from DefCon 15: EPIC!

http://www.youtube.com/watch?v=5CWrzVJYLWw

tlrobinson5• 17 years ago

He literally wrote the book: http://books.google.com/books?id=XKgRELiphAcC&printsec=f...

csmajorfive• 17 years ago

Hah. I can't believe someone made an AdSense farm for these cams with this search term as the domain. It came up towards the bottom of the first results page for me.

http://www.viewerframe-mode.com/inurl-viewerframe-mode=motio...

tlrobinson5• 17 years ago

You can buy "Inurl Security Cameras"!

tlrobinson5• 17 years ago

http://tlrobinson.net/bigbrother [warning: very bandwidth + CPU intensive, but worth it]

A few weeks ago I scraped the results from one of these searches (using Yahoo BOSS). This page shows the live streams of a random subset of them. Scroll to see more.

abalashov• 17 years ago

That's badass!

gojomo5• 17 years ago

Interesting... but the bandwidth saturation detracts from the impact. Paginate?

tlrobinson5• 17 years ago

I've spent enough time working on this thing :)

Make your window smaller and reload. It will only show as many cameras as will fill the page. Refresh to get a new random set.

manhol• 17 years ago

"These are live video feeds from 325 unprotected Panasonic Network Cameras..."

This one is very funny: http://212.248.100.101:89/ViewerFrame?Mode=Motion&Langua...

boucher• 17 years ago

the much better version: http://tlrobinson.net/bigbrother/snowstack.html

nostrademons• 17 years ago

Could you geolocate the IPs in the scrape and then overlay them on top of a Google Maps API? That'd be a bit more useful: security cameras in your neighborhood.

tlrobinson5• 17 years ago

Interesting idea. I'll leave that as an exercise to the reader.

Here's the list of camera domains/IPs http://tlrobinson.net/bigbrother/urls.txt and the paths to the viewer page and MJPEG, respectively:

    a.href = baseURL + "ViewerFrame?Mode=Motion&Language=0";
    img.src = baseURL + "nphMotionJpeg?Resolution=160x120&Quality=Standard";

rriepe• 17 years ago

Here's a giraffe:

http://60.45.63.26/ViewerFrame?Mode=Motion&Language=1

jacquesm7• 17 years ago

A Japanese Giraffe at that!

Adaptive• 17 years ago

It brought back a little of that early-web, fish-cam thrill when I realized that I could actually control pan and tilt on that camera.

jacquesm7• 17 years ago

Way back in the day of the first ptz webcams we were installing one in a zoo in Amersfoort, the Netherlands where an Elephant was about to give birth.

The webcast was tremendously popular, over half a million visitors over the course of a few days (at the time this was phenomenal), we set up relay stations just to be able to handle the bandwidth.

Being in a cage with a 6 metric tons pregnant elephant is quite an experience I can tell you :)

edit: here is a panda: http://www.sandiegozoo.org/pandacam/index.html

diiq• 17 years ago

Thank you for making my day. I actually clapped my hands like a mechanical monkey and said "Yay! A giraffe!"

cpach• 17 years ago

Gee, Google even suggests related searches where you can find more cameras.

shaddi• 17 years ago

Man I remember doing this stuff /years/ ago. Can't remember where I learned about it... Maybe 2600? Lots of sweet cameras to look at in Japan. Of course back then I was using a dial-up connection so to be able to see more than a frame every few seconds is a welcome improvement.

Thanks for the nostalgia. :)

onreact-com• 17 years ago

The quality of the images is so bad with these I wonder what "security" at all they do provide.

Scientific surveillance studies have shown that CCTV has no positive effect on crime. Either the crime happens elsewhere or it happens anyways and just gets filmed.

The only thing that CCTV changed is that you have footage of masked burglars afterwards or you catch some people having sex in the act.

Statistics suggest that catching the criminals on tape does not mean more of them get arrested either so it's just about civil liberties being taken away.

jacquesm7• 17 years ago

I'm quite strongly against CCTV but the claim that they are not a deterrent is false.

3% of the crimes solved in areas where CCTV systems are set up were attributed to that. This is a pittance, but it is 3% more than would have been solved otherwise.

The real drawback of CCTV is the 'false positive' rate, and the fact that people that should not have access to the data (which was sort of the point of my posted link) are able to look over the shoulder of the people in control of the cameras. This is a serious invasion of privacy.

singlow• 17 years ago

Full-disclosure equals reduction in vulnerability here, in an odd way. Because of links about this all over the blogosphere, the google search results are now mostly cluttered with stories about it, instead of the actual pages. (Although you can still find them.)

Google exposes security cameras

Related Stories