Hacker News Reader

Comment by trevyn | Hacker News Reader

"Hikvision has a long history of cybersecurity vulnerabilities affecting their products":

It's not pretty. You're bordering on negligence using Hikvision, much less recommending them.

IoT (and especially IIoT) devices are special beasts that really don't fit well into the existing network security models. For ones that need cloud access, they really shouldn't be accessible from the rest of the network, let alone the internet. They also shouldn't be able to talk to each other. This leads to either ACL hell, or VLAN hell (with a L2 wire type firewall or L3 router/firewall). There are some solutions like ForeScout that will do this for you automagically, and software defined networking also holds promise in making this less nightmare inducing, but for now it is a poorly addressed problem AFAIK.

This isn't news, but the best way to deal with cameras is to isolate them on a VLAN that has no route out. Just connect one NIC of your DVR solution to that VLAN, and broker all access thru the DVR. Only view cameras via the DVR software. You really shouldn't be putting your security footage into the cloud anyway, IMO. It creates too many unneeded dependencies in this age of cheap LAN/CPU/HD space. Replicating that footage into the cloud is defensible, but that should still all be moderated via the DVR solution. A UPS and Cellular internet connection could make cloud options more resilient.

Please correct me if I am unaware of some awesome way of doing this!

Thank you as I was unaware of this. At quick glance of what you shared, it doesn't seem like most users should be effected by this.

I'm assuming the typical setup is putting your cameras on a router & then using software like Blue Iris if you want to allow remote access to the videos. I would hope no one actually allows someone to connect directly to a camera using the camera's software over the internet.

Am I missing some larger vulnerability?

If your approach to network security is "putting your cameras on a router", I don't suppose you'd mind me attaching this little black box to your network?

That requires getting your box connected to my network through a network cable. I'm not saying that what I suggested is flawless security. I'm just asking if it is preventing the attacks in the link you included.

That is the wrong question to ask.

Can't you put those cams on a poe and your sec machine would have two nics, one to the poe, one to your house network? Dont route btwn nics.

I have Hikvision cameras, but they are on their own private lan with no Internet connection. These things phone home by default and disabling that functionality is kind of buried in the web interface.

Reply on news.ycombinator.com