https://twitter.com/nyancrimew/status/1369390591700828170?s=...
Threadreaderapp: https://threadreaderapp.com/thread/1369373713121083395.html#...
Raw images: https://pbs.twimg.com/media/EwENVr4XIAQWMDp.jpg and https://pbs.twimg.com/media/EwENcRwWYAgxyAi.jpg
Or maybe they can collect the millions, and publish the compromising material anyway? Although if they had given you money, they'd have your law-enforcement compatible personal information.
Edit: ah I thought he was^W^W they were being anonymous, his^W their twitter point to his^W their website...
So you're telling me that the interface that grants you access to ALL of your customers' (including hospitals and schools) data and shells to the cameras doesn't even require 2FA? W...w-what?
Interesting thing is super-user account was discovered earlier, but vendor swept it under the rug few times, adding trivial obstacles on each occasion. My article describes latest case, breaking encrypted challenge based on hard-coded secret key and homegrown 3DES variant.
For small companies often "devops" is one person, sometimes even one person who also does other stuff. I like to think I've made it difficult for that specific person to get complete control of any specific device that we've sold, but I'm also aware that it takes one bug in one of those devices to undo anything I can do on the server side. All they need to do is get the public IP from my system (which is needed right down to customer service level), knowledge of a bug and bingo... they have control. Especially if the bug is "customer chose an obvious password" .
The fact that ANY internet-connected camera system can be considered HIPAA compliant is ridiculous. Anyone who's had any exposure to the internet in the last 20 years has seen dozens of stories of cloud-connected cameras being exposed online... baby cameras, security cameras, etc. Combine that with the number of big hacks increasing, and the idea of any internet-connected camera being "secure/private" should basically be laughed at.
What will happen? Nothing. The hackers will be blamed, not the managers/executives who thought this was a good idea in the first place, or the multiple tiers of people who are responsible for security in these companies.
However, nobody important in those companies is going to jail for a breach like this, so nothing will change.
If you need nurses to remotely monitor patients that's fine, there's a monitor in the nurse station. If those "nurses" are on the other side of the world... then anyone, anywhere, can see those feeds and there's nothing you can do to stop it. We've all seen leaked video from "secure" military systems... how much more secure is your hospital IT system than that?
I bet some people are catching flak for going with Verkada instead of Ubiquiti because Ubiquiti charges more.
