Showing posts with label Security issues. Show all posts
Showing posts with label Security issues. Show all posts

Wednesday, December 18, 2019

Response to all the hyped postings about the Ring "hack story" / Ring review

First off could people stop posting variations of this same story? I must have seen it posted at least dozen times in a couple days. Everyone should have seen it by now. And if they have not they probably will not gain anything from seeing it now. I'm making this cause I'm tired of explaining the story and correcting all the bad replies to all these posts.

Second if you actually read the accounts this hype is based on, it is mainly A guy doing these "hacks" for a podcast. He and his audience thinks it is funny.  Like a radio talk show host making crank phone calls.

Third any script kiddie can do this to accounts on ANY site if login info is reused on multiple sites without 2FA. BTW This is totally diff from brute forcing which even basic VPS served sites block pretty quick these days.

This is the 21st century. Passwords are like door locks. Reusing passwords if like locking your door with an old style lever tumbler lock might be better than leaving it unlocked but I doubt you are still using them on your doors. SMS 2FA is like upgrading to a typical pin tumbler lock. True 2FA with a fob or app is like adding a deadbolt. If you have deadbolts on you doors then you should have 2FA on any accounts you care about someone getting into.

If any of the above is news to you, get studying or hire someone to handle your online interactions NOW! At bare minimum use something like Lastpass to generate unique passwords for each and remember them for you. Personally I would also suggest getting a domain with mail forwarding and using a unique email address with each site as well. That way when you start to see spam come to that address you know the site has either been breached (often this never reported much less makes the news) or they have sold on your info. In the former you need to change your login ASAP. In the later you may want to route that email address trash and stop doing business with that site.

Now as whether you should get a Ring


I bought the original Ring Doorbell back in 2015 and sent it back same day. The video was awful and it took forever to connect.

Recently I got a deal from Amazon for a Ring 2 with Show 5 for less than the normal Ring 2 price so I thought I'd give it another go. Some of the things I ran into:

  • Failed install with flashing light pattern not in list of options. All options basically said rerun setup. Redid install from scratch despite doorbell showing in app since there seemed to be no way to rerun setup on it or remove it. Seemed to sort in end was same cam and old one disappeared.
  • Installed at my desk then moved outside to install on the door frame and could no longer connect to it. Assuming was because it needed to switch to closer AP so told WiFi to do reconnect. It would not reconnect till I powered it off and on again. This is probably because I have multiple APs but I've only seen this before in really old IP cameras where they get stuck on a channel till rebooted. Fortunate this should not be an issue that often.
  • I've been running a ping sorting the WiFi issues
  • Initial tests seem to show the same bad lag as with the original cam. I'll add more details after more tests.
My playlist of sample videos. Note most should have link in the description to a video of the same shot from another camera to compare with.

Seriously if you are just looking for a cam to watch your front door there are a lot of better options out there for less money. The reason to get Ring is the same one I hear the most complains about, the neighbors app. The video doorbell option with replacement guarantee was the main thing I was looking for.  If a doorbell is your main use and you do not need the neighbors app then you might want to look at the Ezviz DB1 It has 3MP rez (half again what Ring has) and can stream to your NVR as well as the cloud and SD card.

Sunday, August 25, 2019

My current setup

Here is the latest picture of my setup as of 5/23/2022 (See older pics below. in History)


All cameras servers linked into my home automation so it can highlight cams groups on consoles based on various sensors being triggered. And send alerts based on what is "seen" moving. As in someone opening the parcel box at the gate will always trigger the cams pointed that way and switch that console to show the cameras pointed that way as well as sending alerts that a person is out there and probably which delivery service they are with if they pulled in. Critter motion at the gate though only highlights the cams on the console those cams are on but no alert is sent unless it is a coyote, person or vehicle driving further in.

Note the 70 inch display shows the site wide distributed video stream and can be used as a third monitor for my workstations or watching TV from several sources. The camera consoles will highlight (just show) groups of cameras when triggered by Homeseer based on triggered motion or contact sensors. Depending on which sensors and the current alarm settings the main video stream may be switched to that camera console as well. Triggered sensor also give verbal notifications. So for instance if motion is sensed at the gate with a glance I can see if I'm getting a delivery or a visit from wild live or a neighbor's escaped livestock from any where there is a TV. 

A quick and simple video show how my system was setup to return from triggered events with one voice command.

Here is an example of a guy looking for stuff to steal. Since I live in a neighborhood of mostly 5 to 10 acre lots seeing anyone is pretty rare. Predators and loose livestock are a much larger issue. So as I was in the middle of conference call I ignored the first alert but when a second came I could easily make out the guy trying to pull the motion sensor off the tree. Unfortunately he took off before I got down there but he did not get anything and if not for this setup I might not have known he was even about much less had video from 5 cams and good screen grabs of his face for the neighbors and cops.

Future Goals (in no order):

  • Switch from DeepStack, which is no longer being updated or supported, to CodeProject.AI once it calms down a bit and is more stable.
  • Upgrade models to YOLOv5
  • Use the tons of images I've been saving since I last built models to create new versions.
  • Write custom trainer to better streamline adding images.
  • Look into merging my custom models into one. Want to see if this works better or worse than seperate ones.
  • Get MQTT working to link in more sensors and response devices.
  • Add and upgrade cams (of course).

History:

This is how it happens. Your setup just grows and grows as things happen and tech improves.

February 2023

Coming up on 2 years since last update so figured I should update though most of the changes are not really obvious. Mainly as far as Blue Iris is concerned that as mainly been adding DeepStack and then creating custom models. Not just telling cat vs dog/coyote vs raccoon/opossum/skunk/armadillo vs pig/cow/horse/deer but also things like kind of vehicle or bird plus working on fire and smoke. Now that it can ID what is moving fairly well, coupled with my Roku defaulting to showing all my security cams, I shutdown the switching the distributed video to show a console automatically depending if the alert and alarms levels are high enough. Switching views in the Roku is way faster than switching consoles to follow someone thanks to High-bandwidth Digital Content Protection (HDCP). Also been a bit side tracked with weather, you might have heard about the Texas ice storms' tree damage, and the drought that came between them that caused me to some of the creek critters indoors.
large aquarium setup

April 2021

Most of the changes, other than the added Blue Iris server are not really obvious but since it has been almost a year I thought I should post an update. What is new / changed:
  • Moved sky cams and weather images to separate server in prep for more upgrades to house cams.
  • WeeWx moved to Pi4 mounted on back of dedicated display. (On shelf on left next to Davis console though not showing weather info in current pic.) Mainly so I could move the Linux server WeeWx was running on to the shop server room since the connected Davis console needs to be up here.
  • Added cam in bedroom to keep an eye on the cats that automatically goes off when I enter or the home goes into "bedtime mode" and only comes back on when both the bed room and server room doors are closed and the alarm is disarmed. (Both are connected to master bath so this makes sure the cam is always off, as in pic, when I might be in the room.) See Averting your eyes for details.
  • Several cams upgraded. As you can see the Wyze cams are only getting worse (3 of the 4 cams showing offline in pic are Wyze cams) and I'll be replacing most of them in the next round of upgrades. The Hikvision ColorVu G2s and the Dahua IPC-HFW2831T-ZAS-S2 are my current favs.
  • About ready to install 360 sky cam of 4 ColorVu G1s mounted on a single high pole. Hopefully will be able to gen 360 "cylinder" view videos with it but worst case will get better sunrise and sunset views. Once done the "old" (2 were just upgraded to G2s to get 2 G1s for the new array) sky cams will be retasked and or used as upgrades.
  • Using Blue Iris on Roku more that than main stream switching as seems to be somewhat faster than waiting for the the HDMI copy protection nonsense to handshake through the whole system.
  • Added faster workstation for programming and video editing that has the same 3 monitor and broadcast access as the older one letting me mix and match views from both. The old workstation alse clones its broadcast feed to the far left monitor when that monitor is not in use as a secondary monitor for my work laptop. 
  • A lot of infrastructure stuff like adding capacity to the shop server room and moving a lot of stuff down there to distribute the load. All accessible via remotely of course over dedicated lines.
  • Added testing repair station (off camera) with own PC, monitor, POE switch, Pi monitored UPS and tool set for testing, repairing and upgrading hardware including cams.

April 2020

Took 6 tries to get a pic with all the cams on screen without disabling all the automation.

March 2020

4/1/2020 pic snapped quick while all cams idle so showing which means project data extra hidden to avoid work questions.

  • 4 Blue Iris ( 3 with BI4 and 1 with BI5) servers with 27, 15, 9 and 12 cameras on them. 63 total plus the Ring doorbell. With average loads of 877 MP, 1076 MP, 540 MP and 635 MP respectively.
  • LPR plugin is pretty much a bust
  • Pulled all outside dome cams, save the entry way which is sheltered, due to how often they need cleaning outdoors if exposed to rain / sprinklers. Also replacing with higher rez and or lower light performing cams.
  • Shifted an lot of cams around to upgrade rez and or lower light performance.
  • Loving the ColorVus though there are some issues if the light level drops below that of a half moon and of course the lack of varifocus / zoom options.
  • 3 ColorVu sky cams now cover over 3/4s of the horizon. Adding a 4th to fill in the last bit in April. plus have 2 others covering parts of the outdoors hard to cover with lighting IR or visible due combos of reflection glare and distance. 

January 2020

61 working cams (not including Ring doorbell) now, building a server upgrade and a compare of loads between servers.  Also more automated lights, more tree trimming and feral pigs have made my place part of their territory. Have some more lights and trimming to to do then I need to made a video of how the whole works together.  Ring test video can be seen here.

November 2019

After the intruder and something causing the dogs to hang out by the east gate I got the east gate cam back online with 5 MP and trimmed the trees for a better view.


October 2019

After a rat snake got in the shop and then disappeared without me finding where it or the mice before it got in I added 4 more Wyze V2s to track and track where things might be coming in and or where the snake might be in the shop still.

August 2019

Added 4th Blue Iris server and dedicated monitor and increased main monitor to 40 inches
Here is a mountain lion spotted in my neighborhood few believed in till someone caught it on a security cam in a nearby neighborhood.

May 2017

Added 11th screen (not counting the unused laptop one.) 3 dedicated to cams. Note too indicator lights added behind cam monitors.

May 2016

10 screens, 2 dedicated to cams.

May 2015

Bookshelves added.

August 2013

Mid digital conversion. you will notice 29 low rez cams on the Blue Iris monitor. Some are new IP cams and some are being pulled from Geovision servers,

May 2013

2 screens switched to larger portrait mode ones.

January 2012

Using 2 Geovision (analog cam servers) here with another down at the shop. Starting to standardize on 1080p monitors too.

December 2011

Just the one 16 cam Geovision server at the house here. Note how dark some of the cams are.

November 2010

5th added. Note upper right monitor was switchable between TV and computer monitor so I could watch digital sources on it.

October 2008

4th screen added for second Geovision server.

October 2008

Soon after I moved. 3 screens but no dedicated monitor for cams and even the big screen was analog.


July 2008

Moving in

June 2007

At the old house




Wednesday, June 14, 2017

More IP cam insecurities

These kind of issues are why you do not expose your cams to the outside world or let them talk out to just anyone. You should always have your cams talk to a local server and make that local server be the access point for the cameras. To be really secure put devices that should not be talking to the outside world on their own network that blocks any any access to the outside world.

Check out these links for more info about Foscam (and the many OEM brands using their hardware ) current issues and possible fixes. Though at the time of this writing a fixed version of the firmware is not available.
Internet cameras have hard-coded password that can’t be changed
Foscam Security Cameras Full of Security Flaws
Securing Your Foscam Camera – Important Notice
The latest firmware