Hacker News Reader

Comment by eschneider | Hacker News Reader

I spent over a decade working on security cameras and various NVR related applications. Hard wired cameras are more secure, BUT, if someone can get access to your network cable, it's not hard to inject packets and DOS out most UDP-based cameras.

Most large sites put their cameras on segregated networks, so it might not even be obvious to folks for a while.

View on HN

I consider this to be an embarrassing property of modern networking. A network switch that tracks and enforces the mapping between addresses and ports, blocks spoofed packets, ensures fair allocation of DHCP leases, and enforces fair allocation of bandwidth out to be available out of the box from any credible vendor. None of this is conceptually difficult, and all the building blocks are available in somewhat standardized form. But for some reason, port security is an exotic enterprise-y set of features rather than something one can deploy out of the box.

Or an NVR deployment could use 802.1BR to isolate all the cameras.

I’m a firm believer in endpoint security — endpoints should not need to trust the network for authentication or authorization when communicating with each other. But the network really ought to be able to do its job despite attacks by rogue endpoints or someone compromising a single piece of network infrastructure, and the network’s job is to maintain reliable connectivity.

802.1BR would certainly help in that situation, but it adds management overhead. A large deployment of IP cameras brings with it a fair amount of IT overhead and the capabilities of most corporate IT departments (let alone the 'security department') can be challenged by even basic setups.

I've spent a lot of time handling support for big camera deploys and I was surprised by the number of customers who would bring their systems down by misconfiguring their own networks.

> I’m a firm believer in endpoint security — endpoints should not need to trust the network

It's called Ethernet for a reason. You fling packets into the ether and hope they come out the other end. What happens in the ether is anyone's guess.

They are also often on switch with single uplink to the recorder so if cameras are connected with 1gig you could just flood recorder itself, downing every camera connected to it.

Reply on news.ycombinator.com