Hacker News Reader

Comment by swiley | Hacker News Reader

To the surprise of absolutely no one closed IP cameras that rely on a manufacturer run internet service are not secure.

Consumer electronics really suck, I wish there was an alternative to the DIY approach of Linux SBCs with rsync over ssh.

View on HN

I'm making it -- https://github.com/openmiko/openmiko if you want to help!

Each of these security camera system/IoT companies are only offering you a bit of hardware to interact with their true purpose of making you a user of their SaaS product.

Get cheap-ass wired camera (even PoE).

Isolate the network they are on behind a Linux box that cannot route.

Record on the box, display from another hardware port.

Wrap all the above behind another firewall.

Make it all IPv6 only.

why ipv6?

Another reason (the address space one is good, layers defense if the camera "escapes" your network restrictions somehow) is that cameras that WORK on IPv6 are usually a level of quality just above "absolute crap". (Note that many ADVERTISE IPv6 but don't actually work on that.)

Presumably for the larger address space that is more resistant to scans.

Its interesting that you can and people have scanned the entire ipv4 space in minutes on a fast VPS but it would take you forever to find your first ipv6 address that is even in use.

Shodan - a search tool for such things - had a pretty incredible approach to attacking this - they quietly provided most of the ipv6 hosts to pool.ntp.org, which is widely used as a linux default - and would queue a portscan up for any device that connected at startup for timesync.

https://arstechnica.com/information-technology/2016/02/using...

Ingenious - and all the more reason to run NTP on the border router/firewall and have that be the only device that communicates with the outside world.

but if this is applied >Isolate the network they are on behind a Linux box that cannot route.

then it doesn't matter the address space size

D-Link sells cameras that don’t have cloud access. Look up a DCS-913L. I bought one on eBay around a year ago. It has wifi and you can set it up to record over SMB.

It’s not the best image quality but if you get another router, a raspberry pi and a large external HDD you can have a relatively cheap CCTV set up.

Here's one project based on RPi & HomeKit integration - https://github.com/brutella/hkcam

Reply on news.ycombinator.com