Google Exposes Web Surveillance Cams

An anonymous reader writes "Blogs and message forums buzzed this week with the discovery that a pair of simple Google searches permits access to well over 1,000 unprotected surveillance cameras around the world - apparently without their owners' knowledge." Apparently many of the cams are even aimable. Oops!

Security vs. Stupidity

[bigattichouse]

This just underlines the engineer's problem with making something secure, yet making sure every moron in the U.S. can plug it in and turn it on and have it basically work.

Re:Security vs. Stupidity

[ackthpt]

This just underlines the engineer's problem with making something secure, yet making sure every moron in the U.S. can plug it in and turn it on and have it basically work.

Well, it's really just another example of engineers doing the job right, only to then have a PHB of some ilk tell them, "Now I want to be able to watch this from my office or my cell phone or from home, etc." Where the Engineer exclaims, "Doh!" and does it because he/she's not paid to THINK.

X10 anyone?

[ackthpt]

This is why you should never trust some other company with your own surveillance needs. There are plenty of camera + software combinations that can do TCP/IP stuff and you can tinker with it yourself and set it up on your own apache server.

Sure, and if you're inexperienced or a moron then you can do it wrong, just as these people have. High quality tools can still be misused by dolts.

I am sure someone will post with OSS software solutions. Aside from that, how many people really need web-enabled surveillance? Just record it to HD or have it monitored live in closed-circuit fashion.

Does anyone remember the article, couple years back about people using X10 cams for survelience, which were easily monitored from, not a black suburban, but so much as a Yugo with a coathanger antenna out in the street? It's about understanding the deployment needs and big picture of security.

"hey, I can see myself in the bathroom in the internet.... uh..."

Simple solution

[Snags]

It should be obvious, but any web server that doesn't want to be on google should serve up the appropriate robots.txt file. This includes webcams in their default configuration.

Does it matter they are public?

[nurb432]

Since most of them are being used as simple security cameras for simi-public areas, there really isn't much secret data that is going to be discovered..

So you can watch cars in a parking lot.. Or people mill around the mall...Big risk there..

I don't see a big deal that most of them are not being locked down. Unless i missed something here..

Re:Run your own surveillance

[wankledot]

I work with IP video surveillance (among other things) for a living.

This is a good example of why you SHOULD trust some other company. Chances are that company knows more than you do about setting up a system. Choosing the right people to work with is obviously important. I wouldn't trust myself to set up an alarm system for my offices, I would hire someone who knew what they were doing.

Most of the good cameras out there have built-in webservers. Sending motion JPEG over a network from the embedded webserver on the camera is the most common and efficient way to manage a larger camera installation, especially if you are recording. If you have a school district with 10 sites, 5 cameras each, using a network video system and central recording is a fraction of the cost of a traditional CCTV or even DVR (digital recording of analog cameras) setup. Configuring the camera incorrectly leads to problems like this, taking a step backwards to CCTV or other technology is not the answer.

Re:Daycares with cams

[Anonymous Coward]

Christ....A little paranoid huh? What happens when the kid has to walk out in pubic, are you gonna shroud it so no one can look at the kid? People have eyes and see other people out in public....When your kid is on the playground at your cam free daycare, how do you know some sicko isn't watching them?

iSight

[Anonymous Writer]

I heard about this sort of security problem when CU-SeeMe first came out years ago and I'm surprised it has become an issue again. Apple's iSight has a built-in iris that closes when you twist the lens, and twisting the lens also doubles as a switch for turning the camera on and off as well as launching iChat AV. Plus, there's a little LED that lets you know when it's on. I always thought that webcams should always have a physical lens cap on them because just for that added security, and never considered getting one until the iSight came out.

Re:Security vs. Stupidity

[GrunthosTheFlatulent]

When given a choice, every manufacturer out there will make something easy to set up at the cost of being safe, out of the box. Just look at wireless access points: plug them in and they simply work. (Of course, you've just created a hotspot for your whole neighborhood) Clearly they have calculated that if they do not require you to go through the extra step of securing it, you are that much less likely to call them for tech support, or return the product.

How it should be?

[digitaltraveller]

As David Brin frames it - I've stolen his opinion for this post, the key issues are transparency and egalitarianism.
The fact that we can look is not the problem. The problem with surveillance cameras is when people can look at us, but we can't look back.

Wouldn't it be better if a women going to her car can look at surveillance cameras up the block to make sure she will arrive safely? Or a citizen's watch groups can virtually patrol it's own neighbourhood?

The key problem is when a select few can control and abuse the technology and possibly enforce the law selectively. For example, corrupt cops losing video evidence of them beating someone to death.

I'm not completely sold on the idea, but it's an opinion worth considering.
Transparent Society [davidbrin.com]

Re:Daycares with cams

[horza]

Maybe it's the paranoid dad in me, but while it may be nice to see what my kids and teachers are doing, it scares me that some pediphile may be watching what kids are doing, learning their favorite activites, and their overall daily schedule. The ped could even be a parent that has a kid registered at the school making access even easier. So in the end, I axed schools that has cams (especially wireless ones) and convinced my wife based on the reasons above.

You sound totally paranoid. The driver of your school bus could be a pedo. In fact don't take your kid to the beach, a pedo-infested hunting ground. Statistically walking down the street your kid may pass a few.

Despite what the media may say, the world is populated by mostly normal people. Teaching your kid the dangers and a bit of common sense, and a CCTV camera by the school gates where the kids are picked up, should ensure nothing happens. Please don't inflict your irrational fears on your kids, the media and certain Prominent Politicians will be doing far too much of that already.

Phillip.

Re:Security vs. Stupidity

[elpapacito]

It's not the job of engineers goddamit !

I'm sick and tired of hearing marketing, human resources, finance and 99% of the world of "business" come cry me a river when they complain system doesn't work as expected because they didn't know what the customer really wanted. Not even the customer knew what he wanted, they all came to me saying " it must be cheap and basically print me money "

Yeah sure and If I had the method I'd be working for you fools would I ?

Go ask Alan Greenspan you yahoos !

Re:Daycares with cams

[danila]

You are an idiot. It is an order of magnitude more likely that your child would be raped/coerced to sex by your brother, uncle, father, cousin or another relative. Not to mention that you are extremely likely to mess up the life of the child in the future with your paranoia. No, Cindy, you can't go on a hiking trip with your class, a pervert may be hiding in the woods. No, Cindy, you can't go to a prom, there might be a paedophile there. No, Cindy, I don't like that boyfriend of yours, he seems to be sexually attracted to young girls. Meanwhile you probably secretly fantasize [slashdot.org] about having sex with underage cheerleaders yourself...

Re:Google Links to Web cams

[Britz]

Great list. I tried a couple, it works.

Now suppose someone (like many Slasdoters at the moment will, since you were so nice to put up this list) browses a couple cams and witnesses a murder.

What to do? Who to call? How to get the culprit? Maybe save the victim? What is this cam is located in Barzil?

He would ask Slashdot for help.

And this would be the first crime solved on Slashdot. (or not)

Now what if some mean old Slashdot guy puts up a fake cam site with a video of some staged crime...

The implications ...

Think of more!

But why were they crawled?

[jtara]

OK, so you can do a Google search for part of the URL and find all of the cameras that Google knows about.

But why does Google know about them in the first place?

Google (or any other indexing bot) can't find web pages that don't have a link to them. And, typically, they can only find sites that have links from other sites, or that have been "suggested" to the search engine by a user.

So, somebody put a link to the webcam in a publically-accessible page somewhere. If somebody puts a link to a security cam or a nanny cam in their home page or blog, sure, they can expect the world to be looking in!

Re:Google stopped me

[kiddailey]

lol - it would seem to me that they their automated tools are mistaking a slashdotting for an infection.

Re:Security vs. Stupidity

[SamNmaX]

It's not the job of engineers goddamit !

I'm sick and tired of hearing marketing, human resources, finance and 99% of the world of "business" come cry me a river when they complain system doesn't work as expected because they didn't know what the customer really wanted. Not even the customer knew what he wanted, they all came to me saying " it must be cheap and basically print me money "

A big part of engineering is figuring out what the user wants. The user can't be trusted to automatically know exactly what it is he wants that's possible to do. If as an engineer you simply take what's initially asked for, you likely won't get far. If something is impossible, you have to explain to your customer that it is, and provide alternatives. Make sure everyone knows exactly what's going on. While marketers, customers, etc. all have their own faults in the process, you can't simply pass the entire buck to them.

As well, the issue of making something easy to use yet secure, as the grandparent post suggested, is not impossible nor impractical.

Re:Daycares with cams

[dj42]

I just thought I should point out this is one of those stats that loses its meaning out of context, sort of like "Most Car Accidents Occur Near Home, So Buckle Up Even For Short Trips". Well, yes, smartass, they do occur near home mostly. Why? Because 90% of car trips ARE NEAR HOME. IF you're constantly driving near where you live, it seems like it'd increase the chances of a wreck there, yes? Same with kids being hurt by their family. Who do they see more... random pedos walking down the street, or their family?... Seriously.