[quasirandom]

> It really comes down to how it's used

I absolutely agree. The thing that concerns me is these cameras sitting on the internet. It says something about how overworked the security team is. I trust that they have good faith, but I don't know if they have the resources they need.

[adolph]

What is a specific credible concern about cameras with public API?

[Teknoman117]

People other than the ones you agreed to let monitor you, well, monitoring you. Also, it's a major risk to the company itself, who knows what can be read off of employees screens if they're compromised.

[adolph]

Yeah, it seemed far fetched to me at first but I guess surveillance might be useful to a 3rd party. I read an article a while back on how people make equity trades based on data found through satellite images of refinery tanks and whatnot. I guess unsecured internal surveillance cameras could allow an outsider to find out if a company was really busy or just faking it.

[gostsamo]

Every IOT device is an attack vector against the network.

[adolph]

I wonder if there is a way to dumb down IOT devices so they can’t be an attack vector like that.

[gostsamo]

Lock the memory so that update is physical only and restart regularly to avoid no-memory malware. Not 100% secure and very inconvenient, so people prefer to isolate IOT in its own network and preferably have a good network security like putting the devices behind VPN/firewall/other gatekeeper.

Actually, if you want to have IOT access outside of the network, the best approach is to close all ports and for the device to initiate connection with a control server. The device is dark when scanned while a heartbeat signal will ensure connectivity. This will require a good security on the control server, but that is okay because server security is much better understood and does not suffer from the constraints of the embedded software.

[josefx]

Someone wanting to break in can check if anyone is there or see where easy to steal stuff is kept? Or on a larger scale you might leak when and how security guards make their rounds.