Author Topic: Blink security cam says they've shipped (Read 21004 times)

rcjordan · « **on:** January 31, 2016, 02:21:02 PM »

http://blinkforhome.com/

First mentioned here by Jason
http://th3core.com/talk/hardware-technology/monitoring-people-in-a-house/msg40169/#msg40169

bill · « **Reply #1 on:** February 04, 2016, 08:11:55 AM »

I'd be really careful about putting something like this on my primary WiFi. these IoT devices are often a huge security hole to your network...even if they're "security cameras". I didn't see mention of network security, encryption or any of the other security for the system itself and how it communicates to the mothership. Not a good sign.

If you're going to use these buy a cheap WiFi router just for this Blink system. Don't let this mingle with your primary WiFi. Better yet, buy a 2nd router (not WiFi) and daisy chain them to your primary router. That will prevent this from becoming a potential security hole itself. I don't trust these things.

ergophobe · « **Reply #2 on:** February 04, 2016, 04:11:38 PM »

>>daisy chain them to your primary router

That's what we do in our home for guest wifi. Guests log in via wifi, but on a router that is hardlinked to the main router. I imagine someone who really knows what he's doing can get access to the main router, but it would take a lot of effort.

But I do have a weather station on the main router. However, it only broadcasts... it doesn't accept inbound communication as far as I know (you have no ability to control it, update firmware or anything like that on the unit as far as I know). But you raise a good point.

bill · « **Reply #3 on:** February 04, 2016, 11:13:08 PM »

Unless you know what you're doing, guest networks run on the primary router can be compromised. True security requires a chain of at least 3 routers.

If your IoT device has any access to the outside internet there is a potential issue. You wouldn't think those lightbulbs were a threat but...

Here's a recent example of a camera system hack:

Quote

Why the Internet of Things is a security nightmare

The good guys over at Context Information Security have cracked Motorola’s outdoor security camera just to point out how the Internet of Things is still a completely unsecure industry that needs serious work.

The camera that got cracked was the Motorola Focus 73, and not only did the researchers manage to get inside, but they also managed to obtain the home network’s Wi-Fi password, take full control of the camera’s movement and even redirect the video feed.

What you need to consider is complete network separation for IoT devices.

Torben · « **Reply #4 on:** February 05, 2016, 07:29:20 AM »

I feel so safe when companies describe their products as non-hackable

rcjordan · « **Reply #5 on:** February 05, 2016, 12:48:23 PM »

>when companies describe their products as non-hackable

Yeah, I think even the general public writes that off as bullshit now.

Truth be told, I don't know enough about router set-up to address daisy-chaining, etc. I depend more on rural geography and distance, I guess. I'm going to have to address this one day and fix it, as the IOT -particularly on local networks- is creeping into my life.

In the meantime, Blink is a short-term solution for security and just used while while we travel. *IF* they release the firmware that lets it go local-only, I'll look at making it permanent.

JasonD · « **Reply #6 on:** February 05, 2016, 03:20:25 PM »

I'm much less concerned than most.

I say that on the basis that if the worst and a device (or devices)is owned within my network then what can be taken from me?

In practical terms. Some Bandwidth will be stolen.

No data of any value. No credit card information. No banking stuff etc.

I am only going to lose some b/w and only in the short term until I detect something weird going on, which I regularly check for.

Having an ultra secure router, daily checks for patches to it etc is my one area of strength, and when that's balanced against all comms being SSL and then sometimes VPN within the network, I feel I am unlikely to lose anything of value. If I can't sniff it easily, and it's my network, then I know someone else is going to have a nightmare too!

ergophobe · « **Reply #7 on:** February 05, 2016, 06:00:17 PM »

Having absolute crappy satellite internet that 90% of guests can't figure out how to use even when given the SSID and password is my main defense :-)

bill · « **Reply #8 on:** February 06, 2016, 12:35:44 AM »

Quote from: rcjordan on February 05, 2016, 12:48:23 PM

Truth be told, I don't know enough about router set-up to address daisy-chaining, etc. I depend more on rural geography and distance, I guess. I'm going to have to address this one day and fix it, as the IOT -particularly on local networks- is creeping into my life.

It's pretty simple, and it won't cost you much (You can get cheap routers for $15 and they'll work fine for this). There's really no special router configuration you need to do. No need to set them to bridging mode or anything; The basic NAT of each router will take care of everything for you.

Think of it as a "Y" connection rather than daisy chaining.

The setup with 3 routers is this:

Step 1:
Internet --> hub router

This hub router doesn't need to be WiFi. Just a plain old router. Plug your line from the Internet into the WAN port of this router. You're going to be plugging your new isolated network routers into this hub.

Step 2:
Internet --> hub router --> secure router

The secure router would be your primary WiFi/LAN router (Probably the one that you use now for everything). No changes necessary here. Everything should work the same. Just plug the WAN into one of the LAN ports on the hub router.

Step 3:
Internet --> hub router --> insecure router

The insecure router is where you run all your IoT stuff, like cameras, lightbulbs, etc. Again here just plug the WAN into one of the LAN ports on the hub router.
This network will be able to access the internet, but it won't be able to get into your primary secure network. It's totally isolated.

Rupert · « **Reply #9 on:** February 07, 2016, 06:30:42 AM »

Bill, so if I understand this correctly the big mistake most have, is the "Hub Router" is usually the one that has the wifi off it.

I have been looking through the net to try to find an image, is this close enough?

http://i.stack.imgur.com/kECmF.png

JasonD · « **Reply #10 on:** February 07, 2016, 12:24:53 PM »

Bill / Rupert.

Although the Y configuration could be theoretically more secure, in practice I doubt it is.

If any device on any of the networks gets hacked then the risk is the same as before. B/W loss.

A question that comes to mind is how you separate the networks and the devices on them and especially if devices on Network "Step 1" and "Step 2" can communicate with each other or not.

If they can then the theoretical protection is completely gone too.

Ultimately, I am of the view that it's simply more points of weakness when compared to one well set up router. However, I do appreciate it's just an opinion and if it delivers just peace of mind, then there is also value in that too.

bill · « **Reply #11 on:** February 07, 2016, 10:38:37 PM »

Quote from: Rupert on February 07, 2016, 06:30:42 AM

Bill, so if I understand this correctly the big mistake most have, is the "Hub Router" is usually the one that has the wifi off it.

I have been looking through the net to try to find an image, is this close enough?

Rupert, that's close, but that Switch wouldn't be providing the network isolation that you want. That might work for one leg of the "Y", but you wouldn't want to put your PC on that leg. A better diagram would be this:

Quote from: JasonD on February 07, 2016, 12:24:53 PM

Bill / Rupert.

Although the Y configuration could be theoretically more secure, in practice I doubt it is.

If any device on any of the networks gets hacked then the risk is the same as before. B/W loss.

A question that comes to mind is how you separate the networks and the devices on them and especially if devices on Network "Step 1" and "Step 2" can communicate with each other or not.

If they can then the theoretical protection is completely gone too.

Ultimately, I am of the view that it's simply more points of weakness when compared to one well set up router. However, I do appreciate it's just an opinion and if it delivers just peace of mind, then there is also value in that too.

JasonD this setup I explained has been described as bulletproof in terms of isolating the networks from each other. The routers constrain the attached devices to their own isolated LAN networks and it is impossible for one router network to access the other. They cannot route to one another via Ethernet (Ethernet is not routable, it's all MAC addresses) or spoof ARP packets between them in this configuration. If one network is compromised they're isolated and the bad guys are limited to traversing the network they're on. They can access the Internet, but not the other network.

If you have a fancy router with a firewall and you're using something like pfSense you could get away with doing all of this on one device. However, you'd have to know what you're doing there. The setup I suggest is a lot easier to implement and isn't very expensive either.

JasonD · « **Reply #12 on:** February 07, 2016, 10:49:05 PM »

> The setup I suggest is a lot easier to implement and isn't very expensive either

Agreed.

Rupert · « **Reply #13 on:** February 08, 2016, 09:44:18 AM »

cool thanks Bill.

ergophobe · « **Reply #14 on:** February 08, 2016, 04:32:40 PM »

Bill.... if all these connected devices are so dangerous, what's the difference, if any, between an LED lightbulb with wi-fi and a networked printer with wi-fi?

I ask because unlike the bulb, I can't isolate my printer and have it be worthwhile and in many cases I don't want it close enough to the router to connect via wire

(BTW, my printer is connected via USB but the truth is that I had it running with wifi then it quit and I could never get it working again).

The Core

News:

Author Topic: Blink security cam says they've shipped (Read 21004 times)

rcjordan

Blink security cam says they've shipped

bill

Re: Blink security cam says they've shipped

ergophobe

Re: Blink security cam says they've shipped

bill

Re: Blink security cam says they've shipped

Torben

Re: Blink security cam says they've shipped

rcjordan

Re: Blink security cam says they've shipped

JasonD

Re: Blink security cam says they've shipped

ergophobe

Re: Blink security cam says they've shipped

bill

Re: Blink security cam says they've shipped

Rupert

Re: Blink security cam says they've shipped

JasonD

Re: Blink security cam says they've shipped

bill

Re: Blink security cam says they've shipped

JasonD

Re: Blink security cam says they've shipped

Rupert

Re: Blink security cam says they've shipped

ergophobe

Re: Blink security cam says they've shipped