Hacker taps into baby monitor, shouts at sleeping infant

http://blog.sfgate.com/sfmoms/2014/04/29/hacker-taps-into-baby-monitor-shouts-at-sleeping-infant/

by timr • 12 years ago

57 56 12 years ago

blog.sfgate.com

strozykowski• 12 years ago

Heather picked up her mobile phone and accessed the camera to check on her 10-month-old daughter Emma’s room.

She didn't just walk into her baby's room after hearing a man's voice?

snowwrestler2• 12 years ago

What if there actually was a man in there? Better to know that in advance.

runjake• 12 years ago

Personal safety isn't typically something a parent would prioritize over the safety of their child.

emiliobumachar2• 12 years ago

Checking the camera is a reflex you develop after the third time you get up and go to the baby's room seconds after hearing them cry, to find them sleeping.

megablast• 12 years ago

I mean, we can understand that, but surely when you hear a strange mans voice, that is going to snap you out of the normal reflex actions? I guess if you are always tired you don't always think straight.

dingaling• 12 years ago

Perhaps it's a cultural thing. When my Northern Irish colleague was raising a family in Hong Kong, he would let his baby cry in her cot for five to ten minutes before going into the room.

Nothing unusual, that's generally what we do here. The baby will often settle back to sleep and learn that crying doesn't always result in attention.

But the neighbours in his apartment were aghast and would immediately knock at his door, panicking because his baby was crying and berating him for 'abandoning' her! And the next day they would continue the chastisement; apparently the local custom was to pick up a crying baby immediately.

emocakes• 12 years ago

maybe her favourite TV show was on

niix• 12 years ago

Wake up baby! Wake up baby!

ultimoo• 12 years ago

An internet routable camera in the house with a voice channel is the exact kind of thing that should have a two-plus factor authentication, strong tls capabilities, responds only to pre-approved IP address ranges, and any other paranoid security practice that you can come up with.

In fact any tin foil class practice in these situations is worthwhile.

cbhl• 12 years ago

On the other hand, new parents are probably really stressed out (being awoken in the middle of the night, etc.) so I wonder whether parents would be willing to put up with two-factor auth on such a camera.

valarauca1• 12 years ago

Is opening your laptop, waiting for it to pull up the site, load the feed, wait until your eyes can actually focus, faster then walking 10-20 feet down a hall to another room?

Maybe I just don't understand the company's target use case not having children of my own.

jonny_eh• 12 years ago

pre-approved IP ranges? Makes it kinda hard to access over 3G then.

Easier would be to make it only available on the LAN and then access it via a VPN. But even that would be too complex for 99% of the population.

ipsin• 12 years ago

http://krebsonsecurity.com/2014/01/bug-exposes-ip-cameras-ba...

"The issue came to light on the company’s support forum after camera experts discovered that the Web interface for many Foscam cameras can be accessed simply by pressing “OK” in the dialog box when prompted for a username and password."

I understand that using this security hole to yell at a baby makes you a terrible person, but I'm also appalled at the company that made that situation possible for so many of its customers.

primitivesuave• 12 years ago

It takes a reasonably intelligent programmer to identify a security hole, and an entire team of foolish programmers to let one through. It's quite evident that this company only has the latter.

fleitz• 12 years ago

It's not a team, all you need is one fucking idiot who sometime in the 80s once wrote some software that ended up on a satellite. After that everyone will believe whatever that idiot says.

I once spent two hours arguing as to why using a single static AES key for encryption on an app used by millions of people rather than just use SSL was a bad idea, they talked about how secure it was, etc, etc.

After that frustration I went drinking, when I came back, I discovered that their shitty encryption system had a 4 byte field for how big the message was, I sent 256 requests 20 byte requests to that system with message 'sizes' of 0xFFFFFF00-0xFFFFFFFF and watched as the server consumed about 64 GB of RAM before falling over. (It was a .NET app so a request of that size has to go into gen3, since the subsequent requests are larger they can't reuse the existing block)

Then I openly mocked them in the next meeting, they still went with their shitty encryption system because it was 'good enough' and apparently faster than SSL.

r00fus• 12 years ago

While this is the case, I think it's pretty obvious that until this sort of thing happens, security is still seen as a "tack on", and treated like any feature (i.e., might be tested, might simply be released and let users find the bugs).

Similarly, I had a previous experience with a Software VPN provider that simply let my Mac client login without any credentials. I was completely unsurprised.

kjs3• 12 years ago

They probably don't have any programmers except one or two guys who brand the code with their messages and logo and such. Products like this are very often OEM'ed from another shop, who may OEM the code from one or more other shops. It's like sausage, and they might not have a clue what's in there. Someone's a shitty coder, but who knows for sure who this far down the supply chain.

PeterisP• 12 years ago

If the definition of a "team of foolish programmers" is letting a security hole through, then 100% of teams consist of foolish programmers.

Practical evidence shows that a baby monitoring webcam created by a team of the world best security experts will still have security holes and stupid errors; for examples see any security software ever written - OpenSSL Heartbleed is not an exception, but business as usual.

redeemedfadi• 12 years ago

It's probably even easier to view the feed from my 2.4GHz baby monitor, but at least you have to be in range...!

3rd3• 12 years ago

It’s funny that "Schreck" is German for fear/fright/shock.

devindotcom• 12 years ago

This isn't even the first time this has happened, if I remember correctly. There are thousands of unsecured devices out there that no one will ever secure, because they were never registered, just plug and play devices bought at Target for $20. It's an insoluble problem unless someone writes an invasive fix-it worm or something.

librethrowaway• 12 years ago

There are threads every week on /b/ where people look for unsecured webcams and do stuff like this, often with 50 other people logged on to watch.

I'd wager that's who is behind this incident.

Torgo• 12 years ago

As far as I'm concerned, Foscam cameras (the type in the story) are not securable. The firmware is complete trash. I have one and it is loaded with bugs. At least twice now I've gotten an urgent email telling me to update my firmware because of an exploit. I blocked mine on my router from accessing the Internet.

To give you notifications, it wants you to put in your email password, instant messenger password, ftp password, basically almost a dozen things. that could destroy your life if hacked. And this buggy, remotely exploitable camera wants you to trust it with all of them.

cpayne• 12 years ago

"Shouts at sleeping infant"

I hate that kind of sensationalist, link baiting journalism.

emiliobumachar2• 12 years ago

Both the title and the article seemed pretty objective to me. In this case, the facts are truly sensational. What looks linkbaity to you?

bertil3• 12 years ago

The facts are there, but they might be framed in a wait to make them come off as worst, or more impressive than they really are, hiding a more representative reality.

To take a controversial example: Pointing out how many hardened criminals are from a certain ethnic background might be true, yet without precautions about discrimination, correlation between economic opportunities, expectation once jailed a first time, attitude of parole system… it can come off as racist, because it over-simplifies a problem. In many cases, say point out the gender breakdown of declared sexual assaillants, take a minority behaviour to placate it to a larger group.

In that case, the title seems to imply (although, does not say) that the ‘hacker’ was a threat to the baby. He never actually was: yelling at a baby is callous coming from an adult, but their siblings probably do that daily. More to the point, it gives the impression that accessing a home connexion is about bodily harm and threats to physically fragile people -- or even heartless pranks. Truth is: the real issue is a lot more about accessing your digital assets, identity and bank account.

IvyMike• 12 years ago

sensationalist

"the use of exciting or shocking stories or language at the expense of accuracy, in order to provoke public interest or excitement"

The "at the expense of accuracy" part doesn't seem to apply here-- the hacker did in fact scream at a sleeping infant.

elwell• 12 years ago

a hacker accessed a Houston couple’s device and called their 2-year-old a slut

Sorry, this is just hilarious; partly because the journalist doesn't put the degradation in quotes.

subdane• 12 years ago

"scare" quotes. Literally.

erobbins• 12 years ago

Does thinking this is hilarious make me a bad person?

bertil3• 12 years ago

A little bit.

In all reason, a child that age has very little memory, and loud noise are not exactly rare in his environment, so… it is a little funny. I think reading in Feynman lectures would be funnier, but then again, I’m not comedian.

ars3• 12 years ago

has very little memory

Not true at all. Yes, they won't remember specific events, but they certainly do remember they way things work, and they now have a fear response to a certain kind of voice.

It hopefully will fade, but not necessarily. I've met babies (and one toddler) who were scared of men but not women.

krick• 12 years ago

I'm surprised to see such comments here, because I guess the majority of HN would say "definitely yes", but, honestly, I couldn't help laughing while reading that.

NAFV_P• 12 years ago

I can see the humourous side of it, but mostly I found it very frightening.

I have trouble picking which is more frightening, a flesh and blood intruder or a disembodied voice spying on you.

facepalm• 12 years ago

The baby monitor we used, while without camera, wasn't even digital/internet based nor encrypted. Once we heard a kid call for "mama" before our baby could even speak. Wonder how many people listened in on us.

jrvarela56• 12 years ago

It's both amazing and scary that this kind of vulnerability is fairly common. Check out this great talk given at Defcon (https://www.youtube.com/watch?v=5cWck_xcH64) to get an idea of the magnitude. These are systems that do not require any kind of tampering or credentials. Most times credentials are given to you in a prompt!

Mz• 12 years ago

Well, while, obviously, this is atrocious behavior on the part of the hacker, I can't quite relate. I hovered over my kids and I can't imagine sticking my infant so far away from myself that a baby monitor would be necessary. I never used one. I think that's generally not a good use for modern tech. I think it's the kind of thing that falls under "what's wrong with the world today."

microcolonel• 12 years ago

Slightly off-topic: isn't it a bit weird for them to air two stories criticizing IP cameras in a row?

finnh• 12 years ago

why does the listening end of the monitor have a speaker? My (non-video, non-IP) baby monitors are strictly one-way.

senorprogrammer2• 12 years ago

These cameras aren't baby monitors per se, they're designed for surveilling a space. They have both a microphone for listening and a speaker for... shouting at ne'er-do-wells stealing your stuff, presumably.

smoyer• 12 years ago

"Heather picked up her mobile phone and accessed the camera to check on her 10-month-old daughter Emma’s room."

There's a man's voice coming from my 10 month-old daughter's room ... should I check my phone or get out of bed and RUN over to make sure she's not being kidnapped, molested, etc? This mother's reaction makes me think she'll be texting her (soon to be) teen-age daughter at the dinner table instead of making conversation.

senorprogrammer2• 12 years ago

As an owner of one of these cameras I remember being appalled at how difficult it was to actually secure, how many settings needed to be changed, and how bad the defaults were. Foscam cameras are practically shipped open and insecure by default, and it's not a stretch to say that you need to be a security-minded technophile to figure out how to lock them down properly.

They make commercial routes look positively impregnable by comparison.

throwaway-9684• 12 years ago

It's most likely that the "hacker" in news is from /g/. Every so often he has been posting videos on YouTube where he's yelling at people with unsecured IP cams. https://rbt.asia/g/thread/S41535725

ars3• 12 years ago

It's one thing to yell at an adult, it takes a different kind of nasty creature to yell at a baby.

anaphor• 12 years ago

With the rise of things like shodan this will probably become a lot more common until people either stop caring to exploit them or the vendors fix it.

Hacker taps into baby monitor, shouts at sleeping infant

Related Stories