Don’t allow ANY electronic device to access the internet UNLESS YOU CHANGE THE FACTORY DEFAULT PASSWORD! This includes cell phones!
Change your security camera and security camera DVR passwords! Or disconnect them from the internet. Or both!
Might also want to power them off, then back on after changing the password. Call the manufacturer to see if your device has malware and what to do about it. Maybe install new firmware?
Story about how the latest internet attack (10/21/2016) was caused by people connecting security cameras and security camera DVR’s to the internet and not changing the factory default password.
Better yet: Never use any device at all without changing the factory-default password, because a factory-default password is equivalent to no password at all. Even better than that: Never use any device from any company that allows you to use it without changing the default password, because that’s a sign of poor security in general at that company.
On your DSL or wireless internet router, change the factory default passwords for administration and wireless access. (Be sure to write down your passwords as it is common for people to forget these!)
Enable IPv4 firewall “Stealth Mode”
And Enable IPv6 firewall “Stealth Mode”
Check with your internet provider to see if your router has the most current firmware.
Check out http://www.insecam.org/, It’s simply a collection of ‘private’ webcams that are connected to the internet with no password protection at all. Want to watch live footage from a grocery store in Turkey? How about your neighbor’s front porch in Sacramento?
It only takes 10 seconds to change the password on your camera/router/internet-connected-refrigerator. Do it, please.
NOTE: I originally included the links that would take you directly to the two webcams I mentioned above…then I decided that was skirting the line a bit too close. But if you’re really interested, you can find those, and thousands more, in just a few seconds at the site above.
I can barely convince my inlaws to stop clicking on every popup to install toolbars and other malware add-ons. There’s no way they are going to understand IPv4/6 firewall settings and what other appropriate security settings are for various devices.
There needs to be some organization like Consumer Reports or something which will evaluate the security of these internet devices and give their stamp of approval. Then I can tell my inlaws to only buy devices which have that sticker on the front.
What I want is a router which will beep when it notices suspicious behavior, such as connecting to foreign websites or sends more than 1 email per minute. Then when something bad happens and it’s beeping non-stop, at least the owner knows something is wrong. I think about my household with kids and friends with their laptops, phones, and other devices. There’s no way I can guarantee everything connecting to my network is secure. But if the router could also act as a warning system, at least I would know when I have a compromised device in my network.
The “security” on these devices is horrible. Many have undocumented open ports with root access and can’t be turned off! Others have “security” that is trivially bypassed.
Of course, firmware updates for virtually all of these devices are non-existent.
Even your router is probably both vulnerable and not update-able. Which means a “security upgrade” consists of buying a new one.
You should never add an IoT device unless you want the whole world accessing it. And not just accessing it, using it to send spam, do DDoS attacks as well as putting malware on all the other devices on your home network.
Esp., never get one of those Internet-connected door locks/security systems. Someone will turn off your security system and unlock your door.
Just get an old fashioned standard lock and key. It’s crappy security, but it’s a lot better than those.
And we are taking the word of “Flashpoint”, which describes itself as a group of “white hat hackers, multilingual maestros, and intel geeks” because…?
While the breathless Internet reports on this subject are honing in on security cameras (though supposedly it’s also routers and various other devices too), I have never heard of the Chinese company whose cameras are blamed for a large part of the problem, nor have I ever encountered any device whose default username/password were root/root.
…is there a practical way to be able to contact and warn some of these people and say “Hey, that video camera in the corner of your room is broadcasting you eating dinner with your family in the living room to the entire world?” Because that was the first video I clicked. It came up with some GPS co-ordinates, but they obviously weren’t accurate. (Went to a construction site.)
IP based geolocation is only marginally effective at best. The best it can do is determine where the device in question connects to the internet, which in almost all cases is not the house/office/street corner where it is physically located. Your connection at home almost certainly goes through your ISP before it gets out onto to the internet itself, so geolocation for any device in your home would actually pinpoint the ‘uplink’ from your ISP to the internet; it would be exactly the same for every customer of your ISP. And due to a decision made back in 2002 by a certain mapping company, you might very well find yourself ‘digital neighbors’ with about eleventy-jillion other people on a farm in central Kansas.
It came up with some GPS co-ordinates, but they obviously weren’t accurate. (Went to a construction site.)