Hacker News Reader

Comment by dpiers | Hacker News Reader

I have a lot of IoT devices in and around my home, including some cameras. I don't trust any of the smart devices, which is why they all have offline/locally controlled operation modes and are segmented off from the rest of the network with their own manufacturer/purpose specific VLANs and firewall rules.

I don't think most people comprehend what their devices are doing, or how their data could be used against them. My robovac has a LIDAR sensor that maps the house - that's cool - what isn't cool is that by default it uploads those maps to Xiaomi and they can connect it via GeoIP (or GPS if I ever use their app) and have the location and floorplan of my home. I'm not special enough for that information to be very valuable, but it's still super creepy and I would prefer they not have it.

View on HN

Are you doing any hand-rolled home automation? I just finished building a house and I had power over ethernet (PoE) put throughout before I discovered that security items using this command a hefty price premium over simple wireless / battery operated. I've toyed with the idea of just buying a Raspberry Pi with a PoE module and a decent camera module and seeing if I can replicate the functionality for half the price or less (and obviously not valuing my time at anything).

I've made some done some stuff with ESP8266 boards - remote controllers for our A/C minisplits[1], motors for our shades[2], and a humidity sensor (DHT11) for our crawlspace.

Most devices are connected to HomeKit through a Pi running Homebridge. I wanted voice control and Apple is the company I distrust the least since they at least pretend to care about privacy.

I have only messed around a little with HomeAssistant, but that's what I would recommend if you want entirely locally controlled home automation. They even have a voice assistant[1] but for now it's worse than Siri, which is really saying something.

1: https://github.com/SwiCago/HeatPump 2: https://www.thingiverse.com/thing:2392856 3: https://www.home-assistant.io/blog/2019/11/20/privacy-focuse...

Just a heads-up that DHT11 has ridiculously lousy humidity accuracy, I recommend going at least for DHT22.

You can buy splitters that convert the PoE into standard network + barrel power plug. Cost 20ish dollars and a roughly raspberry pi sized device in physical space.

One such example (Though I haven't used it personally): https://www.amazon.com/Amcrest-Splitter-Adapter-802-3af-comp...

I have used various PoE splitters over the years. They're very handy. The older generation had barrel plugs, but newer ones have various USB connectivity options too. If you're able to run cable PoE is pretty sweet. It's particularly nice to be able to put a single UPS in place to power a bunch of devices during power outages.

Check out the cube by pine64. Not available yet. But I bet it is exactly what you are looking for.

https://www.pine64.org/cube/

I wouldn't do my security stuff wirelessly if I was serious about it. A simple $2 esp8266 deauther is enough to disrupt WiFi and for the other protocols there's the option of jamming.

Our neighbor had his truck stolen and had a wireless camera in his front house. Last footage shows a car pull up across the street, a few minutes later the camera goes out, then when it comes back online the truck and car is gone. I guess the investigation decided it was jammed. So yeah, stick with wired systems.

Can't speak to PoE but Raspberry Pi works fine as a camera. I just have it shoot a still every hour that I can see on a web page. Also have a temperature sensor. Obviously I could password protect, add a motion sensor, save video, email, etc. if I wanted to get fancier.

IIRC the amcrest indoor cameras I use are POE compatible and they were like $50. Is that what you meant about a hefty price premium?

Check Ubiquiti's catalog - reasonably priced and plenty of PoE support.

where do you find the necessary protocol information for the various devices? that (and the trickiness of getting the firewall rules just right) seems to be a barrier to adoption for vlan'ing all the things. i still have issues with this on my little home network, typically with service discovery (e.g., mdns) and control app to device(s) communications (e.g., tradfri) across vlan boundaries.

Btw you should look into Valetudo for xiaomi vacuums it runs locally

https://github.com/Hypfer/Valetudo

Yep, running it for our roborock.

I have the model one step down and I just didn't go through with the app/wifi setup. Hadn't thought about using a VLAN.

How would my cameras be used against me? Pragmatically, not theoretically.

Are you a woman or do you live with any women you care about? It was just last year it was reported that Ring employees had access to live customer camera feeds and would regularly watch each other’s homes and joke about who each other had slept with.

If you’re okay with someone in front of a computer screen watching what you and the people you care about do through a camera or even share those videos across the internet, then you’re all good!

Source?

Your other reply is horrible - LMGTFY has apparently gotten much worse and now uses their own heavily monetized search engine rather than Google - so here's a direct link to what the source probably is:

https://theintercept.com/2019/01/10/amazon-ring-security-cam...

> Although the source said they never personally witnessed any egregious abuses, they told The Intercept “if [someone] knew a reporter or competitor’s email address, [they] could view all their cameras.” The source also recounted instances of Ring engineers “teasing each other about who they brought home” after romantic dates. Although the engineers in question were aware that they were being surveilled by their co-workers in real time, the source questioned whether their companions were similarly informed.

https://www.youtube.com/watch?v=Gx2rgLt9gY8

https://lmgtfy.app/?q=ring+employees+watching+customers

Whew, I'm a dude, so glad thoes cameras can't actually see me.

Does that also mean that the cameras can't see if a guy breaks into my house? That seems like a pretty big risk then.

Assuming read access to your device: Detecting a shift in daily patterns to burgle your house when you're on vacation.

Assuming write access to your device: implanting false digital evidence on your device, calling the cops, and framing you

Assuming root access to your device and network: if you work from home, exfiltrating company-confidential from your home network. Running a botnet from your home.

So IoT vendors working with local burglars? Or local cops? I guess we know Amazon certainly has done the latter... (but not to frame Ring owners, that would be an odd business model...) Having rogue IoT devices on your LAN attack other machines on it is a valid concern, though your traffic would be encrypted, and your actual workstations firewalled?

Part of concern is vulnerabilities in your devices when exposed to the internet. The manufacturer doesn’t have to be malicious, just infosec incompetent.

look at it this way, if major companies who spend billions to hire the best industry security experts to secure their devices and their networks still find themselves regularly compromised, then consider how many of the iot companies are tiny or/and clearly place a significantly higher value on marketing/sales/shareholder return then they do on security, then ask yourself if you want the security and very specific details of your life to reside in the data these companies devices collect.

i don’t want to say they’re malicious but it should be clear by now that a very tiny fraction of companies are taking the security of this data and it’s collectors at even a fraction of how serious they should. even behemoths like amazon have had massive problems with their devices and have been very loose with the data collected.

I have worked with some electronics vendors. Their IT practices leave a lot to be desired. I could completely see that someone working there could get access to all info on all clients without anyone noticing and selling it over dark net.

With long term access? I can think of a few options off the top of my head (obviously your sensitivity to them will depend on your situation):

- Blackmail

- Stalking

- Determining when you're out of your house, and for how long you're likely to be out of your house to plan burglary.

If somebody ever gained access to Ring's online video storage, they could easily process it to get a list of addresses and home/not-home schedules. They then could sell subscription access to that online for cheap, giving criminals a huge list of target homes (wealthy enough to be buying amazon's security products) and when it is safe to break in to them.

What an odd feeling-- to see somebody discussing an illicit business and putting a subscription model to it. A sign of the times, I guess...

This was a thing starting in the early 10s. URL was something like burgleme.com. It used Facebook posts to identify when people were away from their homes.

Reply on news.ycombinator.com