Hacker taps into baby monitor, shouts at sleeping infant
blog.sfgate.com
blog.sfgate.com
"The issue came to light on the company’s support forum after camera experts discovered that the Web interface for many Foscam cameras can be accessed simply by pressing “OK” in the dialog box when prompted for a username and password."
I understand that using this security hole to yell at a baby makes you a terrible person, but I'm also appalled at the company that made that situation possible for so many of its customers.
I once spent two hours arguing as to why using a single static AES key for encryption on an app used by millions of people rather than just use SSL was a bad idea, they talked about how secure it was, etc, etc.
After that frustration I went drinking, when I came back, I discovered that their shitty encryption system had a 4 byte field for how big the message was, I sent 256 requests 20 byte requests to that system with message 'sizes' of 0xFFFFFF00-0xFFFFFFFF and watched as the server consumed about 64 GB of RAM before falling over. (It was a .NET app so a request of that size has to go into gen3, since the subsequent requests are larger they can't reuse the existing block)
Then I openly mocked them in the next meeting, they still went with their shitty encryption system because it was 'good enough' and apparently faster than SSL.
Similarly, I had a previous experience with a Software VPN provider that simply let my Mac client login without any credentials. I was completely unsurprised.
Practical evidence shows that a baby monitoring webcam created by a team of the world best security experts will still have security holes and stupid errors; for examples see any security software ever written - OpenSSL Heartbleed is not an exception, but business as usual.
In fact any tin foil class practice in these situations is worthwhile.
Maybe I just don't understand the company's target use case not having children of my own.
Easier would be to make it only available on the LAN and then access it via a VPN. But even that would be too complex for 99% of the population.
Sorry, this is just hilarious; partly because the journalist doesn't put the degradation in quotes.
She didn't just walk into her baby's room after hearing a man's voice?
Nothing unusual, that's generally what we do here. The baby will often settle back to sleep and learn that crying doesn't always result in attention.
But the neighbours in his apartment were aghast and would immediately knock at his door, panicking because his baby was crying and berating him for 'abandoning' her! And the next day they would continue the chastisement; apparently the local custom was to pick up a crying baby immediately.
In all reason, a child that age has very little memory, and loud noise are not exactly rare in his environment, so… it is a little funny. I think reading in Feynman lectures would be funnier, but then again, I’m not comedian.
Not true at all. Yes, they won't remember specific events, but they certainly do remember they way things work, and they now have a fear response to a certain kind of voice.
It hopefully will fade, but not necessarily. I've met babies (and one toddler) who were scared of men but not women.
I have trouble picking which is more frightening, a flesh and blood intruder or a disembodied voice spying on you.
I'd wager that's who is behind this incident.
To give you notifications, it wants you to put in your email password, instant messenger password, ftp password, basically almost a dozen things. that could destroy your life if hacked. And this buggy, remotely exploitable camera wants you to trust it with all of them.
There's a man's voice coming from my 10 month-old daughter's room ... should I check my phone or get out of bed and RUN over to make sure she's not being kidnapped, molested, etc? This mother's reaction makes me think she'll be texting her (soon to be) teen-age daughter at the dinner table instead of making conversation.
They make commercial routes look positively impregnable by comparison.
I hate that kind of sensationalist, link baiting journalism.
To take a controversial example: Pointing out how many hardened criminals are from a certain ethnic background might be true, yet without precautions about discrimination, correlation between economic opportunities, expectation once jailed a first time, attitude of parole system… it can come off as racist, because it over-simplifies a problem. In many cases, say point out the gender breakdown of declared sexual assaillants, take a minority behaviour to placate it to a larger group.
In that case, the title seems to imply (although, does not say) that the ‘hacker’ was a threat to the baby. He never actually was: yelling at a baby is callous coming from an adult, but their siblings probably do that daily. More to the point, it gives the impression that accessing a home connexion is about bodily harm and threats to physically fragile people -- or even heartless pranks. Truth is: the real issue is a lot more about accessing your digital assets, identity and bank account.
> miasma of implications
I’m not sure that tone applies.
An infant has bare social skills, little idea of property beyond holding and no lasting memory; it is therefore far less sensitive to the threat of ‘hacking’ than its parents. I don’t see any miasma in “implying” (nota: I was being careful because you come off as very anal) that it was used as a symbol of frailty that needs protected — a symbol that only makes sense in an inappropriate physical interpretation of the event.
Then again: You were the one asking why that title could be seen as inappropriate. Could. I answered that. I didn’t claim my answer was purely objective: interpreting representativity never entirely is.
I will now remember not to answer questions you ask, certainly in a way that could possibly change your position: you obviously don’t like that. In a related concern: why the f-ck is someone so bigoted doing on HackerNews?
1) I'm not the person you think you're responding to.
2) You're objectively lying about what you're responding to.
3) What position did I take, precisely, that you'd like to change?
4) Have you considered learning how to read? Because being incapable of it is the most charitable conclusion I can draw from your comment... and that's not even bothering with the original topic.
"the use of exciting or shocking stories or language at the expense of accuracy, in order to provoke public interest or excitement"
The "at the expense of accuracy" part doesn't seem to apply here-- the hacker did in fact scream at a sleeping infant.