7

An awful lot of devices on the market for home automation have severe security flaws, such as hard-coded passwords (or no passwords at all!). To make it worse, it's hard to find information on the Internet about a device's security before purchasing, so it's easy to buy something only to find out that it's blatantly insecure.

This article suggests that the only option in this case is to return the device or throw it away:

So, if the device has no password, or you can’t change the password it uses, it’s always going to be vulnerable to attack. You’ll need to throw it out and buy a new one that was built with at least the ability to change its password.

I suspect it might be possible to reduce the risk by restricting access to my devices to certain remote IPs, although I'm unsure as to whether that would completely solve any future problems.

The product I'm interested in particularly is the Raysharp DVR, which allegedly uses hard-coded passwords and offers no way of changing the authentication credentials. What actions can I take to prevent unauthorised access while still being able to use the camera from outside my home network?

  • 5
    As Helmar has put it: packaging it back up and sending it back to wherever insecure devices come from – Ghanima Jan 14 '17 at 17:02
  • 3
    Tell us more about your IoT device. Where the default password is used? In web browser based portal? Do you need to be able to connect to this device from your home network or it itself just need access to the Internet with particular server? Perhaps you could set 'Demilitarized zone (DMZ)' on your router for that device (so it won't be reachable from your personal network) and don't forward ports to this device (so it won't be easily reachable from the Internet). – Defozo Jan 14 '17 at 18:09
  • @Defozo see my edit for answers to your questions. – Aurora0001 Jan 14 '17 at 19:34
4

There are two obvious points of entry for an attacker. One is the local network connection, the other is the WAN. Even if you defend against these, you need to ensure that there is nothing valuable which is known to the device since it provides an easy attack point for other devices.

A wired connection for the local network is most secure, but only if it is isolated from the rest of your network. If you have to provide a WiFi connection, use a SSID dedicated to this camera, with unique secrets.

In order to open access to the isolated, insecure network segment, you need to set up a VPN. Ideally, the VPN will be the only way to connect to this isolated segment. In practice, it will still be vulnerable to local attack.

Be sure not to connect the DVR to any other shared resources on your LAN such as networked storage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.