Hacker News Reader

Comment by walterbell | Hacker News Reader

Security cameras should be wired PoE with local NVR + decoy NVR.

Wi-Fi conveniently enables x-ray vision (IEEE 802.11bf) through walls of home, making it easier for attackers to identify where valuables are stored, observe password keystrokes, etc. Any room with a safe should have EMF shielding.

https://www.cnn.com/2024/04/05/us/burglary-tourists-visa-wai...

> Prosecutors say the break-in is part of a larger issue in which so-called “burglary tourists” enter the United States .. they join sophisticated burglary rings that prey on luxury homes.. “They take advantage of the fact that most people don’t have window sensors or motion detectors on their second floors. They have WiFi jammers to stop the alarm company from being notified.. the stolen goods are often sold quickly and the money is sent back to the suspect’s home country. Most often, that’s Chile.

View on HN

I spent over a decade working on security cameras and various NVR related applications. Hard wired cameras are more secure, BUT, if someone can get access to your network cable, it's not hard to inject packets and DOS out most UDP-based cameras.

Most large sites put their cameras on segregated networks, so it might not even be obvious to folks for a while.

I consider this to be an embarrassing property of modern networking. A network switch that tracks and enforces the mapping between addresses and ports, blocks spoofed packets, ensures fair allocation of DHCP leases, and enforces fair allocation of bandwidth out to be available out of the box from any credible vendor. None of this is conceptually difficult, and all the building blocks are available in somewhat standardized form. But for some reason, port security is an exotic enterprise-y set of features rather than something one can deploy out of the box.

Or an NVR deployment could use 802.1BR to isolate all the cameras.

I’m a firm believer in endpoint security — endpoints should not need to trust the network for authentication or authorization when communicating with each other. But the network really ought to be able to do its job despite attacks by rogue endpoints or someone compromising a single piece of network infrastructure, and the network’s job is to maintain reliable connectivity.

802.1BR would certainly help in that situation, but it adds management overhead. A large deployment of IP cameras brings with it a fair amount of IT overhead and the capabilities of most corporate IT departments (let alone the 'security department') can be challenged by even basic setups.

I've spent a lot of time handling support for big camera deploys and I was surprised by the number of customers who would bring their systems down by misconfiguring their own networks.

> I’m a firm believer in endpoint security — endpoints should not need to trust the network

It's called Ethernet for a reason. You fling packets into the ether and hope they come out the other end. What happens in the ether is anyone's guess.

They are also often on switch with single uplink to the recorder so if cameras are connected with 1gig you could just flood recorder itself, downing every camera connected to it.

> NVR + decoy NVR.

A friend did this - he hid the DVR in a space under his steps then took a cheap dead DVR, gutted it and shoved an RPi in to run Firefox and the DVR web UI. Even set it up in with a monitor and mouse on top. He left the old HDD in there for weight too.

One thing to think about though, he had a NAS box in his office next to the router on a table and I said, what if they take that thinking its the DVR? That is now under the steps too.

> Any room with a safe should have EMF shielding.

You just made the target that much more visible.

> Security cameras should be wired PoE with local NVR + decoy NVR.

Given that wires can also be cut, is that worth it given the extra cost to install?

A better solution might be for alarm to be triggered if traffic from cameras is lost (although that would create a lot of false triggers)

Wire cut is a definite hard alert. More reliable indictor than a jammed WiFi, way less false positive too.

> Given that wires can also be cut, is that worth it given the extra cost to install?

Proper camera deployment includes redundancy in camera viewpoints. If you're cutting a camera's cable, I'm seeing you cut it from at least one other camera on property.

> Given that wires can also be cut, is that worth it given the extra cost to install?

First off if the wires can be reached the installation is a failure. My cameras are up high with all wiring well out of reach or in metal conduit. Getting near the wiring also means theives get closer to cameras setting of motion sensing algos wasting time and risk making a racket trying to climb up to disable them.

Perhaps it would be better if APs could detect jamming or deauth attacks.

Detecting jamming still doesn't restore your cameras functionality. It's still jammed.

Wifi is useful for many things - just not anything security related.

Having the police come over when jamming is detected would help though

> Security cameras should be wired PoE with local NVR + decoy NVR.

Shouldn't the NVR have real time offsite backups and/or a redundant NVR instead of a decoy?

Neither of those are common, or practical.

First, decoy recorders are extremely rare, and never really recommended. Most higher-end systems are using software on a PC for the video recording, not a little NVR appliance anyway. In that case your recorder can be any random PC, potentially even hidden in plain sight.

Real time offsite backups is usually not practical for reasons of upstream bandwidth limitations. A common camera can easily produce a bitstream of 2+Mbps. Get a dozen of those going, and you're bumping up against the upstream bandwidth limit of cable internet providers in the US. If you have the bandwidth for realtime offsite backups, then you can skip the on-site NVR/recorder and go with a full cloud solution like Eagle Eye (this will have a small onsite PC that acts as a buffer so that if you have a short outage of a few hours, or congestion, you don't lose video).

Maybe these kinds of things are more commona and practical in the kinds of facilities that the article is talking about?

Either way, in the city I live in most residences have 1gb up/down fiber connections. a real time offsite back up is trivial for anyone who wants to do that here.

They're even less common in those kinds of places (I've been involved in thousands of commercial video surveillance projects).

Internet connections have certainly become more robust in recent years, and cloud video storage is becoming more common, but I don't think it even makes up 1% of the market at this point. Offsite backups, remote storage, etc. are still the exception, not the rule.

Overall, the video surveillance market has many price sensitive customers. Redundancy means increased costs, it is not an easy sell, particularly when attacks on the video surveillance system/components are exceptionally rare in most cases.

Well, I bet this site is going to be getting a complete overhaul of their security systems which will probably include a real-time offsite backup.

Based on my experience, they'll immediately initiate a review of things. They might plug a couple of small holes if there is anything obvious. Then the process will drag on, and the sense of urgency and concern will start to get diluted as other newer issues come up in day to day operations. They might finally get some recommendations, and if those recommendations are huge, there won't be a budget. So it'll get put into next years budget request, reviewed in a few months, and then there is a 50/50 chance they get funding approval to do anything major.

During this, it will become apparent that this was an inside job, and the attackers had knowledge of the system, and thus most common hardening or mitigation procedures would be less effective against an informed attacker. Because of that, the feeling of a need to install the most robust systems with offsite backups will drop to near zero.

The article doesn't even state that the video system was in fact disabled, or that they were using wifi cameras at all. Obviously, the police are not disclosing many details, it is possible that they have video from the robbery and are simply not saying it.

To anyone else wondering, this is the actual, factual take on how this will go down. Everything else is just words.

Sorry, could you expand on NVR please?

Network Video Recorder - basically, the place where the video footage is stored. It's essentially a NAS, aka a big box of hard drives.

e.g. Frigate OSS with local AI using Google Coral TPU, https://frigate.video/

You record the data locally and not only stream it directly to the cloud.

+ decoy NVR.

Is always smart - use unique bright yellow (say) CAT cable to route from cameras to local storage .. and on the last leg route the real camera data to a hidden NVR behind a good false panel and "continue on" with fake yellow CAT to a decoy NVR in plain view.

It's a good feeling when robbers have visually followed the bright cables to the decoy storage and trashed the drives that don't have the idiots faces and other data stored in HiRes.

An old friend of mine installed many security systems, he was all about the deception too. He had these fake looking cameras, like you see for $10 with the fake clipped cable, except he hid real cameras in them. Worked on several occasions where we assume people scoped out the location and decided they were fakes.

Security by obscurity surveillance

Haha not the same. This is a honeypot.

security made to look like obscurity

security by bamboozlement

That is a scenario that only happens in the movies. Even is really low quality installs, there isn't much exposed cable, and it's going to go into a wall/floor/ceiling fairly quickly. Robbers are not following network cables around like some kind of map line.

> Robbers are not following network cables around like some kind of map line.

That's why matching cable from cameras [ ... disappears, reappears ... ] and into visible on office desk sacrifical anode NAS box works. They don't trace the cabling, they make assumptions based on matching colour. The 'trick' is to make sure the camera display screens cut out if the "fake" NAS goes down .. best to route to screen through sacrifical secondary storage.

> That is a scenario that only happens in the movies.

Here, in my part of the world, it's used by several contracters I'm aware of, in homes, shops, warehouses .. fake drives near camera display screens get destroyed in break ins more often than you realise - and more frequently in recent years.

Even in the US the Afroman raids show the police about to rip drives out of the security system .. if there'd been a decoy box | real time cloud backup there'd be more footage of the raid for his songs and court case.

I've been involved in video surveillance for the last 15ish years, in the US, UAE, Japan, UK, South Africa, South America, Caribbean, and elsewhere. What you're describing is exceedingly rare. Robbers are generally not spending much time on cameras and recorders unless the equipment is right out in the open, such as at a small store that puts the recorder near the cash register. Thieves are not following cables around, and installers are not adding time and expense to create these scavenger hunt decoy systems.

If you feel that you have a legitimate threat that might lead to attackers trying to disable your video system you would more commonly install better equipment. Cameras that are more covert, or are ruggedized/vandal proof, and installed out of reach. Installations that leave no exposed cables, PC-based video recorders that don't have branding or indications of what they are doing, etc.

> Even in the US the Afroman raids show the police about to rip drives out of the security system .. if there'd been a decoy box | real time cloud backup there'd be more footage of the raid for his songs and court case.

I think bigger problem is people that think they can do that in first place still being employed in police...

Heck, even the cameras I bought my mom were PoE with in-situ SD cards for self-contained recording and NVR, with a cloud option. An armored car company holding zillions of dollars can't bother to secure itself with even 2009-level residential technology or wall/ceiling penetration sensors is an absolute case study in security theater.

Not real X-rays!

True, those are in white vans.

https://www.rapiscan-ase.com/products/mobile/zbv-cargo-and-v...

Singapore is simply the best security camera you can buy for you and your descendants. They will be bored (so will you) but will have energy because its not spent on fear. Safe houses, guns, these things are foreign concepts to many but especially to people living in a benevolent dictatorship countries.

Tito, René, Lee Kwan Yew, Park Chung Hee. Only two countries remain true to its art form.

For you, maybe. For your descendants? History suggests otherwise. Dictatorships are benevolent until they’re not, either because the current ruler gets wacky in the head or their successor has some fresh ideas about projecting power.

Reply on news.ycombinator.com