Slovakia finds Russian backdoor in traffic speed cameras | Hacker News Reader

Slovakia finds Russian backdoor in traffic speed cameras

risky.biz

391 pointsdredmorbius155 comments

So they bought the cameras and some people pointed out they look exactly the same as Russian cameras. The government denied this but after they figured out the serial numbers matched the Russian cameras they started this investigation.

Good they investigated this before using them, but this sounds like a big fu...

This would be far more impressive if not for:

> multiple reports in Slovak media that linked the purchase to a Cyprus shell company with fake certifications.

We're talking about this as if it's some precursor to a James Bond plot, but it really fizzles after learning Nina in the sourcing department skipped the compliance paperwork. James Bond doesn't need to leave the bed!

Trojan exploits aside, I just assume that it'd be easier for someone in SVR/GRU to bribe an admin.

> Nina in the sourcing department skipped the compliance paperwork.

Well the interior ministry didn't really demand one (yes really) but the opposition people have read the documentation for the cameras and the hash of the supplied software was exactly the same as the hash for the russian simicon camera.

They bought tech from a bogus company. Putting that aside, we still don't know if RU exploited the backdoor.

Occam's razor says this was simply a custom batch that was available cheap.

With high probablity they are actually made in China. I don't think Russia makes their own chips for cameras.

Over 100 comments, zero mentions that government funds should be spent on devices with auditable open-source firmware. Anyone here? No? Then I'm the first one to say this.

SecureBoot is a funny one. It should be signed with the deployer's keys (Slovak), not the manufacturer's. Trusted boot probably wasn't a consideration here, really.

Ironically, a custom firmware can now be used thanks to the lack of a digital lock... if you still trust the hardware.

PS: Props to NBU for doing their job.

Would you be able to get those devices at all, especially at similar price as those with closed source firmware? R

"at all" -> I would like to believe a government tender to wield more power than just being at the mercy of commercial market offerings.

"similar price to closed source" -> Good argument. But what if the _lower price_ is only lower thanks to a vendor lock-in? Thus, over a long period of time, you don't get a better deal? Furthermore, here an expensive reverse-engineering project had to discover the backdoors? What was its cost? Why can't the government have this work done (new cameras) on a contract basis?

First step: "we want this and that, you may choose the hardware freely, but the project source code will be perpetually licensed to the government to use and extend upon." Second step: "we have this source code from the last contract, we want another 1000 of these traffic cameras with improved specs/features."

The belief, that the market will do anything right, perpetuates this system of outsourcing everything to the market. Though I don't think it can work any other way, because nobody among the government workers wants to bear responsibility and liability. It's much easier to give party B the money and then argue with them based on the paper trails. This is what they've been trained to do after all.

Maybe you trust the hardware and software and firmware to not be malicious or negligent (currently such assurances are extremely rare [1], so it's hard to overstate what a step up in security just this bare minimum would be), but what if it simply gets hacked by a nation-state level opponent? And there are so many ways to hack it - hardware and software supply chains, interdiction and replacement with compromised parts, attacking the software systems connected to it (maybe the camera is secure, but what about the computers it sends its signals to?), or the human systems, blackmailing an employee to insert a backdoored USB key somewhere...

Are traffic cameras worth the risk of giving away the movement of your key personnel, military and political, in the age of drone warfare and targeted strikes?

[1] https://news.ycombinator.com/item?id=49248678

Fair. I see, you are against traffic cams in general? One approach is to take away their networking capabilities. Dump the data from them manually, physical access :) like 26 years ago in the year 2000 AD. But the police and agencies will cry about losing real time access (and surveillance) capabilities.

While you raise good arguments against wide deployment, politics will not backtrack. Despite the loopholes, despite the vulnerabilities, despite real life precedents, the juggernaut will keep moving. Much like blackouts or internet outages (Canada) that make payments, digital communication impossible, people will not rely any less on cashless payments etc. That's the blackpill.

The Navy drones article is terrifying. The easier solution is to not have wars at all (lol) then the problem is reduced to only corporate espionage.

That was in fact the angle of the Fediverse post from which I first saw this story:

"Please use open source systems whenever possible so you can review the source code."

<https://floss.social/@mikebabcock/117134334377276076>

> the cameras expose live streams to anyone without a password and who knows their broadcasting IP.

Are these cameras in use in Russia? Can people outside of Russia look in at Russian traffic in this way?

There is a small number of cameras which broadcast the video publicly. For example, Moscow: [1] (Taganskaya square), [2] and Saint-Petersburg: [3] (Nevsky prospect and Gostiniy Dvor). Sadly the quality is not great and in reality those places look much better. For example, many of the small 2-floor buildings on Taganskaya square are over 100 years and have a nie classical architecture but one cannot see any fine details in the camera view.

[1] https://gidcam.ru/camera/moskva-panorama-centra-stolicy-s-ma...

[2] https://gidcam.ru/camera/moskva-volgogradskij-prospekt-i-plo...

[3] https://camguide.net/ru/europe/russia/saint-petersburg/nevsk...

Imagine somebody being able to track almost anyone using road side cameras. Good thing such things happen only in eastern Europe wink wink

I think i read Japan does this to CCTVs sold in China

Public Security Intelligence Agency (公安調査庁) apparently is sitting on a massive amount of data from China which imported their tech

[flagged]

You must be new to state sponsored malware. Recent false flags are a thing: 2018 Olympic Destroyer, Marble Framework, Silver Fox, MuddyWater Chaos

> Recent false flags are a thing: 2018 Olympic Destroyer, Marble Framework, Silver Fox, MuddyWater Chaos

How are any of those false flag? They're state sponsored, by different state actors.

I find it amusing that the biggest supporters or Russia in its current war of aggression against Ukraine are/were Hungary, Slovakia, and Serbia -- precisely the countries that should know better, since they were the principal recipients the "love and friendship" from Russia:

- Hungary: November of 1956

- Slovakia: "spring" of 1968

- Serbia: the Stalin's betrayal at the end of WW2

Older people in these countries have good memories of that time, employment and housing were basically a given, healthcare and public transportation were solved, etc. They're very easy to manipulate, promise them a 13th month of pension and they'll vote for you.

I don't think you understand how bad globalization fucked up these countries, people live with their parents until they're 30+, young people can't find decent jobs, etc.

Slovakia is heavily influenced by Russian propaganda, which started way before Corona times.

It's mainly the older people that are influenced by this, and a lot of young people either left the country already, or have concrete plans to leave.

It's really sad, how these old people are ruining the future of their children and grandchildren, really crazy.

You can say a lot about Russia, but they are very good with misinformation, it's a real threat for Europe.

My wife is from Slovakia, so I have front row seats on the whole situation. The kinds of misinformation these older people are willing to believe is really nuts.

> You reap what you sow, MFs!

Please don't post like this here. We're accustomed to better from you than this.

Thank you for this comment. You’re right.

We're glad to have you back in any case! A gumbyless HN is a sadder HN.

Next up, chinese solar inverter firmware.

To do what? Turn off the power in random individual houses?

The HN version of "I have nothing to hide."

Any idea what happens to the grid when a significant chunk of solar power suddenly disconnects?

Reply on news.ycombinator.com