Nurserycam horror show: 'Secure' daycare video monitoring product beamed DVR admin creds to all users

A parental webcam targeted at nursery schools was so poorly designed that anyone who downloaded its mobile app gained access to admin credentials, bypassing intended authentication, according to security pros – with one dad saying its creators brushed off his complaints about insecurities six years ago. Anyone could have …

[IGotOut]

Simple Answer.

Anything where "Think of the children" is concern, drop an email to the Daily Mail.

They love this shit, by the time the article is published, it will be Pedos (sic), the Chinese and ISIS watching naked children via online security cameras. Boris Johnson said to be fuming and asks for stricter border controls....except those that may have covid, then its ok, especially if it's a business trip, or you can afford the fine, or you're a MP, then just say sorry.

[Anonymous Coward]

Re: Simple Answer.

You're slipping, you didn't mention Brexit as well.

[Anonymous Coward]

Re: you didn't mention Brexit as well.

Brexit? What's that? We've always been at war with Eurasia!!

[AW-S]

Re: Simple Answer.

As of 5:00pm Saturday the BBC is reporting this story https://www.bbc.co.uk/news/technology-56141093 but it goes further than the security shortcoming and implies NurseryCam has suffered a data breach.

Perhaps this is to avoid or deflect fines from the ICO, because the NurseryCam service has now been shutdown.

"NurseryCam said it first became aware of the incident shortly after 17:00GMT on Friday. It added the service would remain suspended until a security fix was in place".

[Anonymous Coward]

bought one webcam 2 years

Reputable shop in Switzerland. All marks were ticked on the box. 200 CHF anyway.

When I read the config instructions, I couldn't believe what I was reading:

- USB cable was only for power, so no config here

- config guide:

- download an app for a smartphone (done by a chinses manufacturer)

- configure wifi just for the app (why it couldn't use my smartphone one was not said)

- wifi key could only be between 5 chars and 12. No idea why.

- then after press of buttons, the CAM would emit some sort sound, yes *morse* style then autoconfig, using the phone mic whatever that meant

Needless to say, the sound stuff never worked. One hour after, everything went back into parcel.

I did some research and this manufacturer, call Swisstel is known nowhere. And after looking again, I discovered the look and specs were *entirely* the same as some known reputable model.

Yup, counterfeit !

Went to the shop saying it doesn't work and they gave my money back.

I also told them they're fake, but they never wanted to believe me.

Shittest product I ever bought for 200CHF !

[Alan Brown]

Re: bought one webcam 2 years

" I discovered the look and specs were *entirely* the same as some known reputable model."

Because they're vitually ALL based on HiSilicon embedded DVR chips (used in both DVRs and IP cameras) using XiaongMai (XM Eye) monolithic block code

The stuff is a (badly encrypted) monolithic block embedded in a Linux system. The "moinolith" is full of GPL symbols, but XMEye have been screaming to all and sundry about "Piracy" and threatening researchers for a while

Neither Huawei, XiaongMai (or any of the reselelrs) respond to GPL requests and the only response I've had so far is the standard chinese fiction that GPL == Opensource ==public domain "therefore we can do what we want with it and we don't have to disclose anytning to YOU"

Incidentally I have virtually exactly the same response from local Chinese (PRC or Taiwan) researchers who are clearly using GPL complonents in their work.

It's clear that some kind of misinformation campaign has been going on about GPL which has taken root across chinese language countries. Remember all those GPL-violations cases in Europe against D-link, etc? These are exactly the same arguments as were raised back then.

[Oh Matron!]

FootfallCam

Makes the antics of Travis Kalanick, author of "How to nearly drive (sic) a buisness into the ground" look tame

[KarMann]

A wretched hive of scum & villainy

When I read the Footfallcam article the other day, and some kindly AC posted a link to their Companies House listing, I got nosy & curious and looked at their address on Google Maps, and lo and behold, also 'at this place' were a couple called Magic Mirror & NurseryWeb. I figured they probably had similar QC issues, and would be interesting to look into more deeply. Sure enough, here we are.

[iron]

> any Nurserycam video feed could be viewed by simply changing the URL in the web browser: a flaw known in infosec as sheer incompetent dumbassery

FTFY

I will be forwarding this article to all my relativces who have small children. Not that any of them will understand it or pay any attention but at least I will have tried.

[heyrick]

Forward it to the nurseries - don't they have some degree of liability for installing the system in the first place?

[Alan Brown]

Yes they do, and it's a _vicarious_ liability (which means they're liable even if they weren't aware of it)

Don't forward it to the nurseries, forward it to a few parenting groups and emphasise that the response of the company to being told they had a security problem was to go on the offensive against the reporter rather than fix it, so anyone using a nursery has an interest in knowing what's being used becausesome of the suppliers are in denial

[Doctor Syntax]

"Yes they do, and it's a _vicarious_ liability (which means they're liable even if they weren't aware of it)

Don't forward it to the nurseries"

The nurseries are the people to forward it to in the first instance, pointing out that they're using a product which opens them up to GDPR complaints from the parents. If they don't react then forward it to the parents. The probably non-technical but responsible nurseries will realise their problem and tackle it at stage one. It's the ones who don't who deserve a GDPR case against them at stage 2.

[very angry man]

you can sue them for shitloads for feeding the pedo's

"oh think of the children" lawyers make big bucks.

[Anonymous Coward]

There are different kinds of nurseries. A broad spectrum from the "daycare" kind that provides a couple of minimally trained year old girls to babysit a bunch of screaming toddlers for 8 hours a day, to the "Montessori school " kind which help the kids develop useful skills.

The thing that they all have in common is poor understanding of IT. Nursery staff generally do not have the skills to evaluate and test the security of IP cameras. So they buy in a system from companies who claim to be experts in that field. Unfortunately sometimes those companies are not really experts at all.

The whole IT industry is based upon vendors telling lies about their products and customers not really understanding what they are buying. As much as the buyer should beware, the responsibility for faulty products lies with the vendor.

[Alan Brown]

" So they buy in a system from companies who claim to be experts in that field."

the contractual liabities of those concerned is a matter for the lawyers of the nurseries and vendors to sort out - and it may fall back on company directors (who are NOT protected by limited liabilties laws - these poritect shateholders)

In short, if the nurseries find they're vicariously liabile then they have good reason to go after whoever sold them a system unfit for purpose (sales dweebs and/or directors)

[VulcanV5]

@iron: gosh, I never thought I'd find myself typing this:

Remember Mumsnet!

[Ben Tasker]

Scary

> El Reg has reviewed evidence showing the firm seemed more concerned with knowledge of the flaws being made public than with remediation, similar to last week's Footfallcam debacle (where Kao's fellow Footfallcam Ltd director, Edward Wong, threatened an infosec bod with a police report unless he deleted Twitter criticism of another product's poor design).

This is the bit that's _really_ scary. All products have bugs (some serious, like this, others minor).

What really sets companies/products apart is how they handle this reality. Do they

- Actively look for bugs/weaknesses and/or fix quickly when issues are reported to them

- Yell "nananana can't hear you" and/or "I'll sue you" at anyone who points out flaws

It's not just the flaws in Nurserycam/Footfallcam that should put them out of business, but the fact that they were aware of significant and trivial flaws in their product, and did nothing, and then when they were told about it again, tried to confuse the issue so that they could - again - do nothing.

That kind of "fuck you, I'm not fixing it" mindset does not belong anywhere near *anything* that gets even remotely close to kids (or, adults really).

[herman]

So, people get all upset when a camera that is made to be watched, is watched? Or are they annoyed because nobody watches the watcher?

[herman]

21 down votes for stating the bleeding obvious? All over the world, there are playgrounds outside in the open, that can be watched by all passers by. Please explain how watching a camera of an indoor playground is any different and hurts the watchee.

[VulcanV5]

Actually Herman, it's 24 now.

[Anonymous Coward]

the difference?

you can't stand in a public area perving over a playground. behind a cam feed however

[cybergibbons]

By that analogy, if there were cameras in your dining room, that would be fine, because there are public restaurants.

It hurts the people being watched because their reasonable expectation of privacy in a private place. Everyone has been told that the system is secure, and it isn't.

You've also missed that this is the place of work for the staff, who can be viewed out of hours.

And that the cameras are installed in receptions and offices as well.

And that some cameras have audio.

[Trigun]

I'm a bit surprised you can't seen the issue here. As others have said: privacy. This system is only supposed to allow parents to see that their children are being cared for and are safe. It's not for weirdo peeping toms or just the curious and the nosey to view.

The staff and the children themslves have a right to privacy outside of safety concerns.

[herman]

I'm just pointing out that a camera works only one way. The watchees are oblivious to the watchers. Therefore, there is no real harm done to the watchees by having a few extra watchers. It really is no different from a perv watching a playground down below with binoculars from the privacy of his 20th floor apartment. It is indeed as O'l William of the Wobbly Speare said: Much Ado About Nothing.

[yetanotheraoc]

What?

"... there is no real harm done to the watchees by having a few extra watchers." Funny then the company that sold the camera thought it necessary to state it wouldn't be possible. Everybody agrees there would be harm: daycare, parents, Nurserycam, government, commentards. And then there's you.

[0laf]

This is GDPR infose stage 2 - denial

Stage one was - ignore it

Most major vendors I've run into in the last 12-24 months have successfully completed GDPR stage 1 which was to completely ignore the legislation and pretend nothing was happening. This allowed them to avoid any additional costs for development work that would have been needed to actually be compliant with GDPR.

Since most existing customers were already in contracts the ICO allowed these to continue under the old DPA, so as far as the vendors were concerned all was well.

We're now well into stage 2 - Now that those old DPA 1998 contract are expiring savvy customers are now asking difficult questions about product compliance with GDPR (DPA 2018). Since those vendors did fuck all in the years they should have been getting ready for GDPR and preparing for the post DPA 2018 world their products now look woefully inadequate in terms of security. However not to worry, especially if you are a near monopoly provider. Just deny the insecurity in your products, state it's secure 'enough' safe in the knowledge your customer has nowhere to go and the ICO is pretty likely to do bugger all unless you get hacked. If you do get hacked don't forget your handy "Dido Harding" phrase book - sophisticated hack, personal data is our top priority yadda yadda yadda.

Personally I'm keenly awaiting stage 3 -blind panic.

This will come after a couple of major hacks when ministers feel they have to get of their arses and pass the blame onto someone. The ICO will pick a few juicy targets to take tro court and fall out should make enough waves in the market that someone might actually open the coffers enough to get things brought up to minimum standards.

BTW if you are a vendor and relying on username and password to protect a web exposed system processing personal or special category data it really isn't fucking good enough, and a PIN sent via email is not "taking consideration of the state of the art" under Article 32 of the Regulation.

If you don't really know what MFA is stop trying to bullshit the people who do know, you just look stupid

And for this bucch of muppets "Melissa Kao, a director of Footfallcam Ltd, the firm behind Nurserycam, insisted to The Register that what infosec researchers had found was "legacy non-functional codes" [sic] that were "there to distract hackers" '. I really wish I was there to hear to say that crap to the ICO

[Alan Brown]

Re: This is GDPR infose stage 2 - denial

" I really wish I was there to hear to say that crap to the ICO"

There's a real problem with the enforcement side though:

The ICO is (deliberately) not resourced to do much more than token enforcement, nor do ICO directors WANT enforcement taking place - particularly against any company which is part of the "chumocracy"

Various long-established people in the industy have been throwing thei rhands up in despair about dealing with the ICO - particularly under the current government where it's been clear for the last 8 years that the political appointees at the time are doing everything they can to _block_ most investigations, particularly if the company directors involved have "the right political contacts"

[Alan Brown]

Such an ethical company

I'm sure people are falling over themselves to do business with them....

After all, what could possibly go pearshaped?

[Doctor Syntax]

I wonder what they'd do if someone took "legacy non-functional codes" [sic] that were "there to distract hackers" literally and twiddled a few of these non-functional codes to not change the user IDs and passwords - which they obviously can't change if they're non-functional. At a guess scream that they've been hacked.

[G2]

obvious words

"obvious words followed by 888"? Why hide the crap under such a mellow phrase?

"admin888" is the default admin password for a LOT of Chinese-made IPTV stuff, including Huawei / Hikvision / Dahua NVRs and cameras.

It's not something specific to the nursery cams, they just re-packaged the standard stuff that everyone ships from China.

Some Chinese-made devices don't even allow you to change the admin password... the "change password" option is simply missing on those.

e.g. i saw this thing on some Mio MiVue WiFi dashcams... they don't allow changing the WiFi password for the dashcam ("12345678" - wifi is used for admin access to the camera)

Also, their app for windows PCs only runs with administrative rights. It also downloads and executes software from Mio's website without using https or even at least digitally signed executables.

It basically runs unsigned remote code directly, without any origin authentication for the executables.

All you have to do is spoof and change on-the-fly anything coming from http://download.mio.com/dvr/pctool/tw/version.ini

(yep, China doesn't do https - just in case they need to deliver remote execution state-controlled shitware)

... and if you feed it a high enough version number so that it trips the automatic update mechanism, their app will execute with administrative rights any executable that you feed it via that INI file, without even checking for a digital signature.

[Anonymous South African Coward]

Re: obvious words

Some Chinese-made devices don't even allow you to change the admin password... the "change password" option is simply missing on those.

I think what we need is some sort of database (bullet-proof preferably) which will have every single IP device, a list of its security shortcomings and a means on how to harden it.

The reason why I said "bullet-proof" is to prevent incensed companies trying to take said database down in order to punt more of their defective IoT junk - and they will try.

So, where do we start with this, and who will be willing to help/volunteer/etc?

[cybergibbons]

Re: obvious words

Why did I hide the password?

Because it isn't admin888.

The DVRs used don't have the default password of admin888, they enforce a change on setup. They aren't bargain basement DVRs.

[Alan Brown]

Re: obvious words

"The DVRs used don't have the default password of admin888, they enforce a change on setup"

You missed the admin default acounts and the port knocking trick they used to hide it after the last security advisories (password didn't change but the right tap is needed to open them)

[cybergibbons]

Re: obvious words

I'm confused - are you referring to generic DVRs or the NurseryCam system here?

[Alan Brown]

Re: obvious words

"admin888" is the default admin password for a LOT of Chinese-made IPTV stuff, including Huawei / Hikvision / Dahua NVRs and cameras.

XiangMai for the win.... (All using Huawei (HiSilicon) embedded chipsets)

[Allonymous Coward]

Well that was a hopeless cop-out by the ICO

^ see subject.

[Stuart Halliday]

About time we had a government system of testing security and issuing certs of hardware.

[VulcanV5]

Oh dear Elizabeth

What is it about females in corporate boardrooms that they think they can be more persuasively mendacious than male equivalents? As in this case, with the claim by Elizabeth of 'legacy non-functional codes to distract hackers'.

* An Apology:

Not 'Elizabeth', but Melissa.

Don't know how I could've got that muddled up.

[Michael Wojcik]

Re: Oh dear Elizabeth

Perhaps you were thinking of Elizabeth Holmes of Theranos infamy.

I don't really see any evidence that, in general or even in specific cases, female company officers are any more prone to thinking they can get away with fraud than male ones are. Certainly we see no shortage of obfuscatory bullshit from the latter.

[Anonymous Coward]

Seems standard behaviour with child service providers

In the UK a company handles loads of child data (rhymes with daby's bays). Try to report any sort of risks to them (like the child care provider being the only people able to set credentials for parent access) and you will receive abuse and threats, and a quick look online will reveal their tactic of denying any problem means they still have 'care' over a vast number of childrens' data and lots of shill reviews. At least mumsnet has some honest views about their rudeness and behaviour

[hoola]

WebCam And Video Everywhere

What is it with this obsession with have "live feeds" and Internet based video recording for monitoring, security etc? All this used to be CCTV and whilst there were some breaches, it was nothing compared to the endless problems we have now.

Everything has to be "connected". All the data is stored "in the cloud" because it is perceived to be cheaper. All sorts of people who should never ever have access are given access so that they can "monitor" something.

At my place of work we have cameras all over the place yet if there is an issue you are lucky if security actually get there in time to do anything or even better, if the footage is needed for evidence, apparently the quality is not good enough for evidential purposes.

Invariably if something needs investigating they cannot find the footage or it has been left so long it has aged out.

This is not an online system with data in the cloud (yet) however we still have issues with cameras that have default settings, reset themselves to defaults and become accessible. Theoretically they are supposed to be on separate vlans however IP cameras are just too easy to configure, mis-configure or default to an open state, recording. At least if the default was off, they would not be vulnerable.

[0laf]

Re: WebCam And Video Everywhere

Security Theatre.

Well known and established practice.

[IanRS]

Re: WebCam And Video Everywhere

Somebody once collided with my car in the company car park, cracking the bumper, but left no note. There were obvious cameras overlooking the area so I went to the security office to ask whether they had footage of the incident.

"We turn the cameras off during office hours."

You could not make this stuff up.

[yetanotheraoc]

Re: WebCam And Video Everywhere

"We turn the cameras off during office hours."

Translation: It was the security van that cracked your bumper.

[Alan Brown]

Re: WebCam And Video Everywhere

" All this used to be CCTV"

It still is. If you have rmeote access to the DVR or camera you have live or recorded access

[yetanotheraoc]

Re: WebCam And Video Everywhere

"Invariably if something needs investigating they cannot find the footage or it has been left so long it has aged out."

So they say. Yes, there is incompetence, but there are also cases where lost footage is expedient. At least the web cams have many eyes on them, but it wasn't ever supposed to be world + dog.

[Stoneshop]

Oh hello, Melissa

Downvoting every single comment (save the one on Brexit) fits your modus operandi perfectly, but kindof gives your account identity away.

[DevOpsTimothyC]

ICO should be shamed

"When an organisation buys in products or services that will be involved in the processing, they need to ensure that they choose ones that are designed with data protection in mind. This is part of a data protection by design approach and can help them to protect children's personal information. Organisations should consider these issues when doing their risk assessment."

What a deplorable cop-out by the ICO. While I agree that any place employing such a system should do it's due diligence the ICO should be giving heavy fines to any company that is targeting that market and failing so badly.

Trading Standards goes after companies which make dangerously faulty products, it seems like the ICO would be going after the customers for purchasing such faulty products.

[Alan Brown]

Re: ICO should be shamed

"The ICO should be giving heavy fines to any company that is targeting that market and failing so badly."

The ICO is politically controlled and actively avoids fining those with the right (fat brown envelopes and handshakes on golf courses) connections. Any mildly competent or publicly minded staff quickly get hounded out of the organisation

WRT trading standards: they defer this shit to the ICO

[Marty McFly]

Reclassified...

I thought the purpose of the nursery cam was to catch, record, and document any negligence in child care by the nursery. If that is the real purpose of the product, then it would seem the more eyes on the video, the better.

Bug now becomes Feature. Plus a competitive differentiator.

Who needs secure products when you have good marketing department?

[Anonymous Coward]

How much for de children? I want to buy your children

Poor little tackers

A whole life of internet based abuse lies ahead of them

[Anonymous Coward]

Nurserycam on the BBC

Aaannd, we're back in the news again

https://www.bbc.com/news/technology-56141093