10mo ago

South Korea removed 1,300 cameras from its military bases after discovering they're designed to feed back to a Chinese server

www.businessinsider.com

South Korea's military has been forced to remove over 1,300 surveillance cameras from its bases after learning that they could be used to transmit signals to China, South Korean news agency Yonhap reported.

The cameras, which were supplied by a South Korean company, "were found to be designed to be able to transmit recorded footage externally by connecting to a specific Chinese server," the outlet reported an unnamed military official as saying.

Korean intelligence agencies discovered the cameras' Chinese origins in July during an examination of military equipment, the outlet said.

55 comments

Don't all cheap IP cameras feed back to at least one server in China?
I bought two different no-name brands from Amazon several years back, and both models of them were trying to call home. I ran them on an isolated network, so they couldn't get anywhere, but they were persistent little buggers. Oh, and the root password to one of them was hardcoded to "1234567" lol
Tangent, but if anyone can recommend a good IP camera that just craps out an RTSP stream locally and doesn't phone home anywhere, DM me lol.
- Don't DM, reply so we may spread the word.
- I'm really surprised that military in such a technologically advanced country just connected random IP cams to the internet
  
  They were on sale!!!
  
  It's a big bureaucracy and procurement often just means going to the private sector and scooping up what's on sale.
  Non-zero chance the Koreans are running around with explosive pagers in their pockets right now.
  
  Right?!
  
  From the Yonhap article,
  The company that supplied the cameras is suspected to have falsified the equipment's country of origin, and the military is considering taking legal action against it.
  And also,
  military and intelligence authorities found out the surveillance cameras supplied by a South Korean company were produced in China during military equipment examinations
  The TLDR is that these cameras were supposed to be sourced domestically but the company behind it committed fraud to make a quick buck.
- Reolink, amcrest. Amcrest dont get anything starting with ASH in the model name.
  If you want ONVIF, be sure to check the specs, many cheaper models drop support, but not all.
  Some YI cameras have easily replaced firmware and can do rtsp too, but you have to do your homework on those models to be sure you're getting one that can be modded.
  You'll still want to (IMO) toss any of them in a vlan without internet access, and rather than provide that vlan access to an NVR on another vlan, I'd lean toward your NVR having a second connection to that vlan. I'm a huge fan of segmentation though, so YMMV.
  
  Yeah, that was my old setup: dedicated VLAN with the NVR and cameras in it. Had a firewall rule so I could access the NVR from regular LAN but nothing "got out" of the camera VLAN without being requested from the LAN first.
  At first I had the NVR in the LAN with FW rules to reach the cameras in their VLAN, but my FW at the time struggled with all the simultaneous streams going through it so I moved the NVR in with the cams.
  Maybe I'll just stick with my current setup of just getting old analog camera housings and sticking Raspberry Pi + camera module inside lol
  
  I can vouch for reolink, they have fairly straight forward nvr with decent cameras for the money. Been using their poe nvr system for around 5 years now and have never had an issue with it.
- Ubiquiti G3 and G4 cams do rtsp direct streams without needing Unifi Protect services on a unifi gateway device. G5 requires unifi prot but can rtsp from the protec gateway.
- Same with russian 'grandma phones' with big buttons. Some researches found thst although they don't provide any functionality besides basic phone\sms stuff, they do try to call their motherbase, sending all credentials and geoloc. IIRC there was no argument about them sending the content of smses and voicecalls, but it's troubling as it is.
  Russian as in sold there, they are chinese, sometimes with a local branding.
- Just get some raspberry pi camera.
  What to do about IR vision though?
  
  I don't currently have them, but there is (or was?) a NoIR version of the Pi cameras that didn't have IR filters. That should let the IR LED illuminators work same as most other cameras advertised with night vision.
- Not a plug and play solution. But if you aren't averse to tinkering. RPI zero with a CSI camera and v4lrtsp server. can get you done rather cheap. Depending on your needs.
  
  That's actually my current setup :)
  Got some old analog cameras at an estate sale, gutted them, and put some Pi + camera modules inside. Couldn't get the original optics to work with it, and they lack PoE, but they're otherwise doing well (3 years and going). Just occasionally have to reboot them more than I'd like.
  Haven't messed with v4lrtsp server, but zoneminder has been good to me. Will check that out.
How the fuck did that happen?
Dear south korean government
please hire me instead. I promise I'm so paranoid, this will never happen.
- Like every military operation, the job always goes to the lowest bidder, that is still overpriced, because it's just tax money. That's what always cracks me up about stuff that is marketed as military grade.
  
  It's still expensive because everything has to go through OPSEC.
- Capitalism. They just bought the cheapest reliable enough option they could find and didn't give two craps about infosec, because that's too expensive to actually properly do. Minimize the financial losses of an upfront purchase. (I worked more than enough jobs in hardware design to know what management cares about and what it doesn't)
  Also, big yikes for the Israel flag in your username.
  
  I think this is more of an OPSEC issue than an Infosec one, but both terms work.
- Suppliers lie.
  I know a guy who is the sole reason that software written by adversary> isnt being currently used in host countries most top secret defense environment>. His boss told him to lie if asked, and he refused to and informed end user>.
- I remember when, I think, Sony was hacked because of the movie « the interview ». It created enough of a news cycle shitstorm that our corporate overlords became excessively generous with our infosec budget and made it a tier 1 priority.
  It went for measly .5% to a whooping 25% of IT expenditure.
  On the other hand to really show they didn't understand anything about it they recruited an experienced CISO and fired him a month later because an accountant's workstation was hit by a ransomware. The guy barely had the time to start building a plan and launch a bunch of audit but still got the full blame for decades of neglects. (He eventually sued them and settled).
China is the only country that gives you lifetime free cloud storage for your devices
- Whether you like it or not
Stuff like this is why I have to tell our Chinese CFO why we don't want Huawei network devices. Yes Jeff, I know they are cheap as shit, you cheapskate, but you don't put the cheapest solution in place to run your critical systems on!
- Yes Jeff, I know they are cheap as shit, you cheapskate
  Remind me again why you'd want an Apple (made in China) or OnePlus (made in China) or any of the other 70% of all cell phones available in the US? Are you just a big fan of paying extra for the same technology?
  Or are you more wedded to phones made in Malaysia, India, or Vietnam for some peculiar reason?
  you don’t put the cheapest solution in place
  No shortage of high end Huawei models. They've been competitive with Samsung for nearly a decade.
Not if they were configured correctly. I.e. on their own, non-Internet connected VLANs.
- I think you misunderstood the previous comment. Not the devices need to be configured correctly, but the network they're connected to.
  
  If the network the cameras connect to has no way to reach the Internet, then the cameras can't reach the Internet.
If they found out it goes to a specific server, why not just block the server and maybe isolate the network from the internet? I guess its easier to replace them but what's to say the replacements can't have the same flaw if other precautions aren't in place, like how do you even get to installing cameras on military bases without thoroughly vetting the firmware on them fist?
- This is just bad spy craft. You don't tell the person who bugged you that you found their bug. You mess with their head by setting up false flags.
  Like have maps of China and what look like troop movements.
  Or details about tank man.
  
  Maybe this is a double head fake and they have compromised the server in China?
- Why not have the cameras on a VLAN that has no Internet access?
- Just use a system that connects to a server on base and nothing else
- I wonder if this was the case. From the bloomberg article,
  "No data has actually been leaked," they added.
  And from Yonhap,
  found to be designed to be able to transmit recorded footage externally
  So maybe they were designed that way, but it didn't work because the cam network was offline?
  Keep in mind that this was on the border with North Korea, so, they'd (the South Korean military) have a very high level of paranoia on being hacked to begin with.
I wonder if my toiletcam feeds to that server too.
- Share the URL if you find out it does
  
  What's a URL?
PW;DR
So if they purchased Ring cameras that are feeding everything to American AWS servers it would be ok?
Seems stupid that in a military install they're using cloud shit
- Well, they did remove it when they found out. But....
  Look. I'm looking at a Thinkpad. Lenovo owns that line now. I dunno if they can push firmware updates to old, pre-Lenovo models, but they can to current versions. Those things are pretty common in a business setting. AFAIK, the US has never raised any issues with Lenovo and security a la Huawei. But if there was an honest-to-God, knock-down, drag-out war, I assume that Beijing is gonna see whether it can leverage anything like that. And I've got, what...a microphone? A camera? Network access? Maybe interesting credentials or other things in memory or on my drive? I mean, there are probably things that you could do with that.
  Then think of all the personal phones that military people have. Microphone. Camera. Network access and radio. Big fat firmware layer.
  My guess is that if you did a really serious audit of even pretty secure environments, you'd find a lot of stuff floating around that's potentially exploitable, just due to firmware updates. If you exclude firmware updates, then you're vulnerable to holes that haven't been patched.
  Okay, maybe, for some countries, you can use all domestic manufacturers. I don't think that South Korea could do that. Maybe the US or China could. But even there, I bet that there are supply chain attacks. I was reading a while back about some guy selling counterfeit Cisco hardware. He set up a bunch of bogus vendors on Amazon. His stuff got into even distribution channels with authorized Cisco partners, made it into US military networks.
  https://arstechnica.com/information-technology/2024/05/counterfeit-cisco-gear-ended-up-in-us-military-bases-used-in-combat-operations/
  Counterfeit Cisco gear ended up in US military bases, used in combat operations
  That guy was just trying to make a buck, though I dunno if I'd have trusted his products. But you gotta figure that if that could have happened, there's room for intelligence agencies to make moves in that space. And that's the US, which I bet is probably the country most-able to avoid that. Imagine if you're a much smaller country, need to pull product from somewhere abroad.
  
  Look. I'm looking at a Thinkpad. Lenovo owns that line now. I dunno if they can push firmware updates to old, pre-Lenovo models, but they can to current versions.
  China aside, Lenovo has lost all semblance of trust after the whole Superfish debacle. Sure it's been more than a decade now but their response to that and the fact that it was even approved internally calls a lot into question. I wouldn't dare go near any of their devices.
Media Bias Fact Check | bot support

55 comments