ALERT: Trendnet security cam flaw exposes video feeds on net

ALERT: Trendnet security cam flaw exposes video feeds on net

www.bbc.co.uk

Feeds from thousands of Trendnet home security cameras have been breached, allowing any web user to access live footage without needing a password.

Internet addresses which link to the video streams have been posted to a variety of popular messageboard sites.

...roughly 5%" of purchasers had registered their cameras and it had not yet issued a formal media release - despite being aware of the problem for more than three weeks...

(visit the link for the full news article)


Related News Links:
www.trendnet.com

The company claims the global total is "most likely less than 50,000" units." Hardly reassuring for families using these devices!

I was a little hesitant to publicise this issue further, but on balance it is best that word gets out now that masses of people are already misusing this flaw to gain access to people's live home video feeds.

The following montage of video stills was used by one Trendnet user to alert the media to what was going on:


[atsimg]http://files.abovetopsecret.com/files/img/gz4f3191ad.jpg[/atsimg]


If you know anyone using this equipment it would obviously be worth contacting them. The company itself has seemingly done little to publicise the issue (— though that may arguably have been prudent at an early stage).

What strikes me is that virtually anyone who ever considered installing this type of equipment must have asked themselves, and the vendor: "Could other people on the Internet ever gain access?" — only to be given absolute reassurance that it could never happen.

Maybe we should listen to our intuition more often...




(Postscript: the Trendnet homepage now links to the critical firmware update)



www.bbc.co.uk
(visit the link for the full news article)

lol, do you know how many security cameras from other vendors are also open to unauthorized access? A LOT.

Yikes..... That is scary. The positive point is that services like this give me work and allow me to spend my days how I do yet still get the bills paid. Cameras with online access are simple, secure and really nothing more complicated than a basic website, but people just assume everything has to have a monthly fee and big company behind it.

Which is more secure? 50,000 individual sites with cam feeds out of homes or ONE site holding 50,000 feeds? It seems hacking one to access the many sure worked well for the hackers here.

Hint: Not everything requires a company and monthly fees....and what this company was supplying with the added feature of having hackers watch your intimate moments...can be done fairly easy if someone knows a person with functional knowledge of Web software and design basics. It's a shame so many were violated in the process of doing it the easy way.

reply to post by Hellhound604


Having never used such equipment, no I did not know that. I don't mind if you express surprise that I was unaware of the issue — you learn something every day.

On the other hand, I am assuming that wasn't a dirty laugh...

Originally posted by pause4thought

Maybe we should listen to our intuition more often...

Very true, and in a day and age such as this that can not be understated.
Funny, I just changed my signature yesterday.

reply to post by pause4thought

This is kinda old news, as other brands have had similar issues for years. With a simple google search you can get access to thousands of security cameras including anything from aircraft hangars, kindergardens, schools, hospitals and so on.

Who the hell would install a remotely-linked security camera in their home? 1984 anyone?

reply to post by juleol


Boy, the mind boggles at the implications. It's an absolute gift to all manner of criminality. Not to mention dodgy governments...

why is it that so many people wants their cable TVs or Satellite TVs cracked (or have cracked systems in their homes) and now some of those same people react in shock when the learn that a cheap security cam is also vulnerable to being cracked?

reply to post by pause4thought


I want to snoop!!! how can I
dont be alarmed, I cant even load an Avatar on my ATS profile.

Originally posted by Dimitri Dzengalshlevi
Who the hell would install a remotely-linked security camera in their home? 1984 anyone?

My home is wired from a birds eye view, head level height and ground level height, some are visible and some are hidden, the level of surveillance also covers sounding property and night vision. The system is a custom unit from an old army buddy, its nothing remotely close to what is available on the market. Its a live feed, all members of my family have access to the system from their homes and my gf has partial access. You can actually talk into any room and give commands to seal and notify any local department. That then will dial and give specific details via a digital voice and leave the transmission open until it is deactivated from a physical family member. When activated all accounts within the system are notified and automatic recording across all acounts are active. In short, its one bitchin unit. Oh in case one replies what happens if a family member accesses it while i am at home. The unit must be set to "enabled" for it to receive external commands, the unit must be enabled from internal commands within the house, or after a period of non activity it automatically engages the system. You can say its similar to a banks hot safe unit. Am i paranoid, you betya, am i wearing my tin hat..always...!

Maybe outside the house, but never
inside.. I can not imagine putting them
INSIDE... I saw the ADT commercials
and thought the same thing.

I was like it could not be too hard
to break into those sources since
they are online. Here is just one
incident of the security flaws.

Now think if it was NOT a hacker
and someone WHO WORKED
for the company, who was nefarious
in there intentions.. You could have
a bad apple working for the company
able to look at all those cameras..
Not a good idea by any means for the INSIDE
of the home..

reply to post by popsmayhem


I agree with you 1000% , its why i opted for a custom unit, as you pointed out, who knows who is working for who and what their intentions might be several months or years down the road.