Be careful on what camera is chosen... I have absolutely no experience but the following was posted on my work site:
"This holiday season I’ve got a "present" - one of Amazon’s top-rated home security/surveillance IPCams branded by “FREDI”. "
Expand to see whole experience:
Spoiler!
Quote:
This holiday season I’ve got a "present" - one of Amazon’s top-rated home security/surveillance IPCams branded by “FREDI”. YouTube is full of praising reviews from happy customers who have installed the product in their homes. Quick search made it obvious that same product has been rebranded by other home security and baby monitor vendors as well.
Connecting the product to WiFi required downloading an Android/iPhone app from a mobile app store... Red Flag #1: The app requested excessive privileges it didn’t need (ability to reroute outgoing calls, access to phone status, identity, storage, camera, location etc.) – An instant disable in my case. Mobile users that do not care about moble app permissions (up to 90% of mobile users perhaps) would likely just let it have its way.
Red Flag #2: Up on launching the app, it immediately connected to servers in China, then asked for my WiFi credentials it needed to setup the product. It was so persistent, that it provided no alternative way to configure IPCam without exposing WiFi credentials outside my network perimeter. (Confirmed via comprehensive scan of product's network interfaces.) Further investigation of camera’s internals showed that it has been manufactured by GWellTimes located in Shenzhen, China. Curious what will come next, I set up a whole new wireless network with its own credentials that App happily took (and likely stored on servers in Shenzhen).
Red Flag #3: The App insisted on being connected to the internet (with persistent access to Chinese servers on the other side) in order to make any configuration changes to the product located on my network. This effectively presents a backdoor and practically guarantees that any configuration parameters applied to the IP Cam (e.g. audio/video stream access and WiFi credentials) are backed up on vendor’s servers located overseas. Users who do not run a firewall solution on their phones (99% of mobile users perhaps) would not be able to detect this.
And finally, firmware update fiasco. Red Flag #4: Trying to perform a firmware update has been blocked by an Intrusion Prevention System due to download by a known malicious user agent within the products itself. Home networks that do not have intrusion prevention solution in place (99% of home users perhaps) – would not be able to detect this. Further investigation of firmware packages downloaded directly from manufacturer’s website were confirmed to contain malware by several AV engines…
To summarize: A popular home surveillance product contains backdoors accessible by overseas actors, requires excessive phone permissions, persistently seeks configuration data and WiFi credentials, while its firmware has already been flagged malicious by several security companies… Vendor’s mobile app has been downloaded over 5,000,000 times and is still available on Android / Apple store. There are plenty of “happy customers” deploying this to “secure” their homes, with no tools or background to detect the issue…
|