Stuff like this is why I have to tell our Chinese CFO why we don't want Huawei network devices. Yes Jeff, I know they are cheap as shit, you cheapskate, but you don't put the cheapest solution in place to run your critical systems on!
this post was submitted on 17 Sep 2024
556 points (99.3% liked)
World News
38553 readers
3306 users here now
A community for discussing events around the World
Rules:
-
Rule 1: posts have the following requirements:
- Post news articles only
- Video links are NOT articles and will be removed.
- Title must match the article headline
- Not United States Internal News
- Recent (Past 30 Days)
- Screenshots/links to other social media sites (Twitter/X/Facebook/Youtube/reddit, etc.) are explicitly forbidden, as are link shorteners.
-
Rule 2: Do not copy the entire article into your post. The key points in 1-2 paragraphs is allowed (even encouraged!), but large segments of articles posted in the body will result in the post being removed. If you have to stop and think "Is this fair use?", it probably isn't. Archive links, especially the ones created on link submission, are absolutely allowed but those that avoid paywalls are not.
-
Rule 3: Opinions articles, or Articles based on misinformation/propaganda may be removed. Sources that have a Low or Very Low factual reporting rating or MBFC Credibility Rating may be removed.
-
Rule 4: Posts or comments that are homophobic, transphobic, racist, sexist, anti-religious, or ableist will be removed. “Ironic” prejudice is just prejudiced.
-
Posts and comments must abide by the lemmy.world terms of service UPDATED AS OF 10/19
-
Rule 5: Keep it civil. It's OK to say the subject of an article is behaving like a (pejorative, pejorative). It's NOT OK to say another USER is (pejorative). Strong language is fine, just not directed at other members. Engage in good-faith and with respect! This includes accusing another user of being a bot or paid actor. Trolling is uncivil and is grounds for removal and/or a community ban.
-
Rule 6: Memes, spam, other low effort posting, reposts, misinformation, advocating violence, off-topic, trolling, offensive, regarding the moderators or meta in content may be removed at any time.
-
Rule 7: We didn't USED to need a rule about how many posts one could make in a day, then someone posted NINETEEN articles in a single day. Not comments, FULL ARTICLES. If you're posting more than say, 10 or so, consider going outside and touching grass. We reserve the right to limit over-posting so a single user does not dominate the front page.
We ask that the users report any comment or post that violate the rules, to use critical thinking when reading, posting or commenting. Users that post off-topic spam, advocate violence, have multiple comments or posts removed, weaponize reports or violate the code of conduct will be banned.
All posts and comments will be reviewed on a case-by-case basis. This means that some content that violates the rules may be allowed, while other content that does not violate the rules may be removed. The moderators retain the right to remove any content and ban users.
Lemmy World Partners
News [email protected]
Politics [email protected]
World Politics [email protected]
Recommendations
For Firefox users, there is media bias / propaganda / fact check plugin.
https://addons.mozilla.org/en-US/firefox/addon/media-bias-fact-check/
- Consider including the article’s mediabiasfactcheck.com/ link
founded 1 year ago
MODERATORS
How the fuck did that happen?
Dear south korean government
please hire me instead. I promise I'm so paranoid, this will never happen.
Suppliers lie.
I know a guy who is the sole reason that software written by <adversary> isnt being currently used in <host countries most top secret defense environment>. His boss told him to lie if asked, and he refused to and informed <end user>.
Like every military operation, the job always goes to the lowest bidder, that is still overpriced, because it's just tax money. That's what always cracks me up about stuff that is marketed as military grade.
It's still expensive because everything has to go through OPSEC.
It's expensive because it has to go through a dozen layers of private contractors.
The US military was remarkably good at rapidly churning out cheap, effective armorments during the WW and early Cold War era. But the LBJ/Nixon pivot to private industry eroded all the efficiency. Then Reagan kicked military spending into overdrive in the 80s, and it's been a snowball of waste, fraud, and embezzlement ever since.
Now the model for military procurement is just a jobs program for Congressional districts. The epitome of the Do Nothing profession.
Capitalism. They just bought the cheapest reliable enough option they could find and didn't give two craps about infosec, because that's too expensive to actually properly do. Minimize the financial losses of an upfront purchase. (I worked more than enough jobs in hardware design to know what management cares about and what it doesn't)
Also, big yikes for the Israel flag in your username.
I think this is more of an OPSEC issue than an Infosec one, but both terms work.
Cheap devices
Don't all cheap IP cameras feed back to at least one server in China?
I bought two different no-name brands from Amazon several years back, and both models of them were trying to call home. I ran them on an isolated network, so they couldn't get anywhere, but they were persistent little buggers. Oh, and the root password to one of them was hardcoded to "1234567" lol
Tangent, but if anyone can recommend a good IP camera that just craps out an RTSP stream locally and doesn't phone home anywhere, DM me lol.
Just get some raspberry pi camera.
What to do about IR vision though?
I don't currently have them, but there is (or was?) a NoIR version of the Pi cameras that didn't have IR filters. That should let the IR LED illuminators work same as most other cameras advertised with night vision.
That would be pretty useful.
I'm still looking for how I might manage to use my old phone's camera anyway. Seems like a waste of good engineering to keep the pinout and protocol closed.
Don't DM, reply so we may spread the word.
I'm really surprised that military in such a technologically advanced country just connected random IP cams to the internet
It's a big bureaucracy and procurement often just means going to the private sector and scooping up what's on sale.
Non-zero chance the Koreans are running around with explosive pagers in their pockets right now.
They were on sale!!!
That's fine, I got them too but they're isolated
load more comments
(1 replies)
Reolink, amcrest. Amcrest dont get anything starting with ASH in the model name.
If you want ONVIF, be sure to check the specs, many cheaper models drop support, but not all.
Some YI cameras have easily replaced firmware and can do rtsp too, but you have to do your homework on those models to be sure you're getting one that can be modded.
You'll still want to (IMO) toss any of them in a vlan without internet access, and rather than provide that vlan access to an NVR on another vlan, I'd lean toward your NVR having a second connection to that vlan. I'm a huge fan of segmentation though, so YMMV.
I can vouch for reolink, they have fairly straight forward nvr with decent cameras for the money. Been using their poe nvr system for around 5 years now and have never had an issue with it.
Yeah, that was my old setup: dedicated VLAN with the NVR and cameras in it. Had a firewall rule so I could access the NVR from regular LAN but nothing "got out" of the camera VLAN without being requested from the LAN first.
At first I had the NVR in the LAN with FW rules to reach the cameras in their VLAN, but my FW at the time struggled with all the simultaneous streams going through it so I moved the NVR in with the cams.
Maybe I'll just stick with my current setup of just getting old analog camera housings and sticking Raspberry Pi + camera module inside lol
Dual nic NVR then? You could even just throw a simple switch with no uplink (but preferably managed so you can tag the traffic) and for extra safety just allow only the LAN traffic you want on the NIC/Port connected to your regular LAN from the NVR.
Nothing wrong with a DIY can though! As long as it works of course
"NVR" in my case is just Zoneminder lol. I run it on a dedicated USFF PC and didn't want to deal with multi-homing it or a USB ethernet adapter. When I upgrade it, yeah, I'll probably get something with a dual NIC and go that route.
Right now, yeah, it's all DIY since I scrapped those cameras years ago (neither held up well to UV after 6-7 months outdoors), so I'm less concerned about it with all of them being RPis now. The only thing I lack is PoE since I didn't want to spring for the HATs.
Yeah all of my servers are on usff PC's, so I get it.
If you do a hypervisor like proxmox, then throw your NVR in a VM, you can just create a couple of virtual NICs (though you'll be back at that FW issue I'm sure).
USB NICs are pretty well supported these days though, and cheap to boot. Just need to be certain you've got usb3 if you want to make use of that gig though!
I've got a few pi-a-likes that I'm doing similar camera fun with, though using some webcams in there and a 3d printed case. At least that way they match my diy temp sensors with esp32s!
Ubiquiti G3 and G4 cams do rtsp direct streams without needing Unifi Protect services on a unifi gateway device. G5 requires unifi prot but can rtsp from the protec gateway.
Same with russian 'grandma phones' with big buttons. Some researches found thst although they don't provide any functionality besides basic phone\sms stuff, they do try to call their motherbase, sending all credentials and geoloc. IIRC there was no argument about them sending the content of smses and voicecalls, but it's troubling as it is.
+ Russian as in sold there, they are chinese, sometimes with a local branding.
load more comments
(3 replies)
What happens when infosec is an afterthought, brought to you by management, almost always by management. Most of my gigs throughout my career have been because of this (infosec guy).
The rest of my career has been when management is throwing money at the problem(s), usually right after an incident. Sometimes you get lucky and it's in response to some other entities incident.
Last minute improbable solutions to other people's long term impossible problems.
I remember when, I think, Sony was hacked because of the movie « the interview ». It created enough of a news cycle shitstorm that our corporate overlords became excessively generous with our infosec budget and made it a tier 1 priority.
It went for measly .5% to a whooping 25% of IT expenditure.
On the other hand to really show they didn't understand anything about it they recruited an experienced CISO and fired him a month later because an accountant's workstation was hit by a ransomware. The guy barely had the time to start building a plan and launch a bunch of audit but still got the full blame for decades of neglects. (He eventually sued them and settled).
Not if they were configured correctly. I.e. on their own, non-Internet connected VLANs.
If you have access to hardware level design, just about anything can happen.
If the network the cameras connect to has no way to reach the Internet, then the cameras can't reach the Internet.
I can think of many ways to transmit data. Doesn't even nessesarily have to be the Internet. Internal SIM card? Satelite connection? VLAN is definitely not a solution to a state-level hardware threat.
That is a really weak argument. It implies that no one inspects the device. The cameras I have are blocked at the router on their own vlan and since I pulled the cover off of them I know they have no other means of connecting to a network. A really weak argument
I think you misunderstood the previous comment. Not the devices need to be configured correctly, but the network they're connected to.
China is the only country that gives you lifetime free cloud storage for your devices
Whether you like it or not
If they found out it goes to a specific server, why not just block the server and maybe isolate the network from the internet? I guess its easier to replace them but what's to say the replacements can't have the same flaw if other precautions aren't in place, like how do you even get to installing cameras on military bases without thoroughly vetting the firmware on them fist?
This is just bad spy craft. You don't tell the person who bugged you that you found their bug. You mess with their head by setting up false flags.
Like have maps of China and what look like troop movements.
Or details about tank man.
Maybe this is a double head fake and they have compromised the server in China?
Why not have the cameras on a VLAN that has no Internet access?
Just use a system that connects to a server on base and nothing else
view more: next ›