Everything today is more connected than ever. Traditional devices we never dreamed of being networked are now connected to your home network making them a part of the World Wide Web. All these once-mundane items were never networked before. Now you can turn on your lights from your smartphone. There are even network refrigerators out there that will let you know when it is time to go buy more of whatever you like to put inside of them. My garage door opener can be attached to a networked device with some type of analog inputs to be triggered to open and close. Real time monitor for your heating and air conditioning, and the ability to adjust them is now used. If you have a burglar alarm that can be enabled and disabled with a mobile app., then when the alarm goes off you can get notifications so you can call the cops instead of the alarm company. You can save fifty bucks a month after all if you make the call yourself. Because of micronization of everything and anything you can think of, there are some types of microprocessors and Wi-Fi adapters built in or able to be added on to. It is great in the idea you can raise your AC temperature before you get home or flip on the lights. Unfortunately just because you hit the easy button does not make it secure.
Is this a Security Risk?
Allowing devices on your network to be accessed remotely from work or cell phone, for example, is a security risk. Basically a door is unlocked and opened for someone to come inside to your home. It is just a virtual door, but a great deal of information can be learned. Then even more frightening is that security experts think that physical damage could come to people from hackers. They could crank your thermostat up or down to a temperature that can actually hurt you. Cars with everything electronic such as brakes and steering can be hacked.
In this article from Forbes four cars were hacked using 20 dollars in equipment and some knowledge. The tricks range from opening windows to door locks. The scary part is they gained control of the steering and braking system. What that really means is a hacker could make you crash your car. That is not an exaggeration at all. Plenty of cars now seem to be able to steer themselves and brake for themselves. They are perfect examples of the downfall of having no security on the computer systems in the vehicles. Door locks are meaningless if I don’t need a key to unlock them. ABS does me no good if my brakes are disabled like my Wi-Fi on my cell phone. A lot of cars now have blue tooth to connect computers and cell phones. If you have ever connected something with blue tooth you know how easy it is. Consider this the next time you connect a Bluetooth device. Did I need to authenticate with a user name and password? Since we already know the answer is no, how secure do you think that is??? It is not secure at all.
Security cameras and remote access at your own home or business is great. It lets people know you watching and that you have a record of what is going on. The down side is in the process people forget to change something as simple as default passwords and user names. There is a lot of knowledge out on the Internet. It is very rare I when I cannot find the answer to a question online. I have written articles that all of our DVRs and NVRs and IP camera default log information is out there and not really difficult to find. In many cases we want you to find it so you can get into your new system to set it up. Between the forums and general knowledge base the information is available. If the system is never connected to a network then it is not possible to “hack” into the unit.
The Importance of Changing Passwords
On the flip side, once it is connected to the Net it is vulnerable. The first thing to do for protection is change the passwords – all passwords that you can. The default account “admin” is accessible over the network. The 8’s and 6’s is not available over the network for DVRs and NVRs. Keep in mind that every other account you create can be accessed through the Internet. On our DVRs, NVRs, and IP cameras the ports and IP addresses used are all the same. More importantly they are all common knowledge. If I know your IP address and log-in credentials, that is not really “hacking” when I log in as normal as I did not have to bypass any security to gain access. Changing default IP addresses is important as well. Depending on how the network is setup is if the IP addresses are compromised or not. The port numbers should be changed as well. Sure we can leave it on the default but again social engineering or “social hacking” anyone can find out the default ports. Combine ports with IP address and now I am in your system looking at the videos. Another device that needs to be configured properly is your router. Most routers by default do not have remote administration setup. Unfortunately more and more are coming with it on as connecting to a router wirelessly is considered remote access. The manufactures enable it since people want to make changes to routers from a computer connected wirelessly. That is really not good as once you see the router log in a page you have a very good idea as to the brand and make of router. Now I can search online for the default passwords. Should I gain access to your router I have access to your whole network. If you have to be wired to the router that means the person is in the building. To put this into perspective if I can login to your cameras I know if you are home or not. I can disable your system then show up at the house and take what I want without worry of being recorded or seen. This information can be disturbing to realize security that you want to use to keep you safe can be used against you to pilfer your belongings.
In closing another reminder of how important it is to safe guard your passwords is the new “old” virus HEARTBLEED. http://www.pcworld.com/article/2143080/tests-confirm-heartbleed-bug-can-expose-servers-private-key.html
Without being too technical the bug exploits the SSL or TLS. These protocols are used in the security layer of internet traffic. This can allow a hacker to see the username and passwords of whatever you log into. Not just your DVR can be comprised, bank accounts, credit cards, email accounts. Really anything you log into over the internet has been compromised. As of the writing of this article you, me and everyone else needs to change all their passwords on every account and every device connected to the internet. Being secure is often a tedious test of will against your opponent.