Hacking security camera with an old smart bulb

TheTechieGuy hacked a real security camera just with a bulb that was thrown away! You may think it's not possible but watch this video, and you''ll find out how much information a smart bulb can contain. (P.S That much that it can hack you)
Watch the full video: • Don't use security cam...
#securitycamera #Hack #Sumsub #Shorts
Sumsub - empowering compliance and anti-fraud teams to fight money laundering, terrorist financing, and online fraud.
More about us:
sumsub.com
/ sumsubcom
/ sumsubcom
/ admin

[@Sumsubcom]

Watch the full version of this cool experiment: kzbin.info/www/bejne/a4vGp2djfbVjmtE

[@CALMAOFICIAL]

❤❤❤

[@pfoxhound]

So he bought a programmer, desoldered memory chip. Looked all over for the necessary data... Not an easy job.

[@HossanMonjorulof]

The link doesn’t work though 😂

[@user-28qhfk65]

This is actually kinda clever

[@__Rizzler__]

bro thinks hes arthur morgan

[@ohnoanyway7791]

Bro plzz .. I just followed you 2 days ago..now I'm in trauma 💀

[@jimmy3797]

don’t worry about it, it’s super unlikely.

[@user-xf7mu7ub9d]

That's why you should be careful when you throw away something. Criminals love dumpster diving.

[@kyllax]

@@jimmy3797 no.

[@scienceMicroguy77]

Better yet don't put any cameras inside your house whatsoever. Don't use any smart bulbs. Don't use any Amazon echoes.

[@apfelfreund6859]

Cameras yes. But localized.....no connection via internet

[@scienceMicroguy77]

@@apfelfreund6859 Unless it's a hard wired camera it's hackable.

[@tinostarks]

@@apfelfreund6859 so when they break in and steal your cameras where are your cloud saves of the break-in?

[@NeFjuS]

@@tinostarks in my virtual machine, that uploads it on the cloud :)

[@Comrade_YG]

This is the same reason why we never use smart security devices in our home, because they’re so weak and easy to hack.

[@dblbogy397]

For this to work it has to be a perfect storm. You have to go thru their trash for years until one of those bulbs go bad. It's easier to drive up and down the street with a garage door modulator and see what opens and then break in.

[@Bomkz]

you could also sit nearby, wait for someone's device to connect 99 the wifi, and sniff out the credentials

[@greatestone4eva]

​@@Bomkzdamn we're all fucked

[@Bomkz]

@@greatestone4eva I'd advice you not to really worry about it tbh. You really shouldn't worry about it unless you make yourself a target. i.e. are a politician with access to juicy data, or have a lot of money or generally a person of interest that would make somebody want to take time out of their day to hack your stuff. you're pretty likely not even close to being remotely worth it, mean that in a non offensive way.

[@haroldgar12]

I don’t understand what the smart bulb has to do with hacking the wifi

[@SteveGillham]

@@haroldgar12 For the Smart Bulb to work properly (ie be a smart Bulb), The bulb needs to connect to the home Wi-Fi, thus it needs the store the Wi-Fi credentials within the bulbs onboard chips. By taken the bulb and then recovering the Wi-Fi credentials the attacker can then uses those stolen credentials to connect to the persons Wi-Fi network, and then scan any other device(s) on the home network for vulnerabilities, then the attacker can attempt to exploit those vulnerabilities and gain access to those devices.

[@fuzzyg18]

I struggle to even log into my ring doorbell

[@Very_Grumpy_Cat]

Who the hell dispose of electronics in a trashcan, it must be disposed of in electronic waste

[@JaakkoF]

Secured eWaste now it seems, as even a mundane light bulb can contain secure credentials and passwords.

[@transientaardvark6231]

agree on the principle, but that actually makes the exploit easier. Now you know where to find loads of bulbs. And they will also tell you the SSID and google happens to have a geographic map saying where that ssid is.

[@jenius00]

Unfortunately I suspect most people do.

[@bernhardvonbarret1729]

the song of Deus Ex was playing in my mind while the hack was ongoing XD.

[@nickolassmaltz9546]

This is why we can't have nice things.

[@50PullUps]

This implies that anyone within the company, who also knew the WiFi password, could also run a port scan and access the cameras. Good grief, there are a lot of rotten, incompetent IT people out there. 🤦‍♂️

[@zadekeys2194]

May I assume you are not in I.T? There is no need for the WiFi password to do a port scan. :) You can port scan the WAN or plug into the network, both of which require no WiFi PW. This is why ACL / whitelisting of Mac addresses is essential. Nothing is bullet proof. Best you can do is educate yourself, monitor your network, segment the network and never assume that you can't be a victim.

[@zadekeys2194]

Also, many internet facing devices are running out of date firmware which often opens them to existing or zero-day CVE's. Even a disgusted TV, old phone etc etc can be used to get a Mac address, that can then be cloned to try access the network. Assuming that the Mac address is toll in the whitelist :)

[@wraithfvcker]

​@@zadekeys2194Not all devices are forwarded to WAN though, so unless they are made publicly available, you will still need access to the internal network. Which is what i believe was done here, the camera was only internally accessible.

[@neww0lf611]

Underpaid not incompetent

[@zadekeys2194]

@@wraithfvcker correct, not all devices are forwarded to the wan. A vulnerable router is all you need to find, and then a bit of patience to exploit it and hopefully gain access to the device or Lan.

[@OrbitalRoc]

people you waste money on smart bulbs deserve what comes to them.

[@Haessige]

You dont put a bulb in the garbage in the first place, especially not a smart bulb...

[@mr_redstone6699]

That smart bulb got its revenge for getting thrown out LOL 😂😂

[@elhombreloco3680]

I don't consider finding a smart light bulb in the thrash as "easy"

[@KJ-xt3yu]

Given enough time on the market, "smart home" devices become a low hanging fruit.

[@LironSegev]

Thanks for sharing. The full video goes into more details for all the keyboard warriors 😂

[@CM-xr9oq]

Good luck. Coming across a light bulb is sometimes trash is not going to be something you will often come across. Same with the whole "reset your printer's wifi info before you sell it". The chances of someone who buys your old printer also finding your home address is very unlikely. Not to mention, that buyer would also have to be a hacker

[@transientaardvark6231]

not all 2nd hand printer buyers are hackers, but all hackers are 2nd hand printer buyers ;)

[@d13x001]

Saying "aaannnd done" does not do all the hackinbg for you lol

[@Renarification]

guy was cheking garbage for 1year, waiting for broken smart bulb, 😂😂😂

[@terrifictomm]

The first time I heard a bunch of engineers going orgasmic (as disgusting as it sounds) about the Coming of the Internet of Things I was rightly terrified and I wondered that no one was concerned about the loss of privacy and personal security.

[@Dog_gone_it]

"On another episode of Let's Teach Criminals"

[@Boo-pv4hn]

This should be illigal, companies have a duty of care, this is a huge failure

[@vici._]

I don't get it, why is their password stored on a lightbulb? Also, how did he access the camera with just the ip? I have a security camera as well but you need to be on the same wifi to access it.

[@ankitkumar6130]

He hacked the wifi bro and then learnt what software is used in the cctv camera he then googled for any already existing exploit and then used it to view the camera

[@notcamer0n]

Smart devices have memory and storage so the smart lightbulb still had wifi credentials on a chip. Once they grabbed the password from the lightbulb they could log onto the network. That’s when they scanned, found the camera IPs on the same wifi, and could then see how they could go about accessing them

[@vici._]

Ah, this makes a lot more sense now. Thanks!

[@s_l_v_m_r]

The crucial problem here is that the camera has default credentials, and this could cause trouble. Powerful search engine as Shodan can track camera in the world and if you don't have at least a strong password could be a problem ☠️

[@notcamer0n]

@@s_l_v_m_r Yes and no. By default (generally at least) routers won’t port forward. So your cameras aren’t accessible outside your private network in most cases. If you or someone gets into your network and changes the configuration yeah it’s definitely a major security issue that’s discoverable in Shodan. All default credentials that can be changed should. Ideally to secure passwords.

[@highrider9168]

And this is why my cameras are wired and locally stored. 😂😂😂

[@mauromortier7808]

I used shodan for a bit and found some open cameras aswell. Pretty fun to make an alarm go off and see the owners react

[@smaslan9601]

🤘HACK THE PLANET 😂

[@clubcyberia8572]

back in my day, we called it dumpster diving.

[@LoneWolf0648]

behold the wonders of the modern smart home. ill keep my wired cameras and dumb thermostat... my microwave doesn't need an update...

[@alexschubert]

The hardest part is getting on their network. Do you think he wore gloves when he went through their garbage?

[@ololh4xx]

ya i'll be sure to look out for people who seem to want to go through my garbage next time im throwing out a dead smart device, that one time per 365 days 😂

[@RapSolo]

There's no such thing as a strong password. The dude who suggested it wrote a whole book explaining why it's pointless.

[@prahladboro6132]

Him: I DONT LIKE THIS SMART BULB Me: Give me I use it Him: ok Me in mind: Hehehehehe I will hack my neighborhood WiFi

[@verumignis4778]

No need to steal the light bulb, with an external antenna and a phone with nethunter you can just grab credentials off nearby devices

[@KJ-xt3yu]

Passive monitoring vs active intent... ones legal, the other is federal issue.

[@TheManLab7]

This is why I take everything apart to see if it's a simple fix so it can be repaired, but if not. Then I stick the PCB in the microwave for 10sec, even though 5 is more than good enough.

[@Ron-op8es]

there’s no water in electronics, would that even work

[@sushai1742]

what??? im so confused does microwaving a pcb for 10 seconds really render it useless?

[@Aera223]

imo 5-8s seems to be the balance ⚖️ between fire risk and data erasure

[@moon.walker]

​​@@sushai1742yeah kinda (it fries the components) can be still repaired though if no important part was damaged, best bet is to completely crush it with a hammer and then throw it in the microwave.

[@BossModeGod]

Hey. Guys... Tfs a PCB please..?

[@willierants5880]

Just create an IOT zone where nothing else lives and has no access to your internal network. Job done. C'ya.

[@jaywulf]

5 seconds in the microwave should fix the smart lightbulb

[@marc-andreservant201]

By the way, we have reasonably secure microcontrollers now. There should be no excuse for a Wi-Fi password to be extractable from discarded devices without the owner's credentials.

[@topherkrock]

There are ways to do this in half the time it takes to get a bulb out of the garbage.

[@Wheresmy240]

How "easy" it is. Thats a lot of work for no potential payoff.

[@howlingcommandose]

Basically you need to be a hacker.

[@audujoel1736]

basement dwellers at work. There should call him stalky

[@petiertje]

One of the reasons I don't use 'smart' devices. My phone is to much enough already, no need to have everything else from my life being stored by something somewhere.

[@MrAntiKnowledge]

And that's why you don't need smartbulbs, smart coffeemaker, smarttoiletbrush or any other "totally fine but we can charge you double and make it worse by making it smart-product"

[@leenaright3949]

Research this online.."can LED lightbulbs collect and transmit data ?"

[@JonsRegularStuff]

New excuse for sticking bulb where sun doesn't shine

[@hamoostaffat]

If you throw away a digital chip that has had your info on it without turning it to dust first your at risk, may only be small or near zero for some of us but its still possible to do

[@fanshaw]

If they have to tell you its "smart" it isn't.

[@NathanHedglin]

What a bright 💡 idea 😂

[@bjw8qsrmhgxn4wwk30]

Connecting to anyones network no matter how secure or open is illegal.

[@roqueluis5]

Moral of the story wired cameras are better. Never use wifi security cameras

[@simonrad]

its easier then that you'll be surprised how many public wifi networks have default camera passwords

[@imp_raziel]

So it's not old bulb, lol

[@InsideOfMyOwnMind]

Now we have to grind the numbers off of the bulbs we throw out. I want to live to be 200 just to see where we go.

[@johnmclain250]

And this is why my wifi uses a manually added device white-list, and all cameras are hardwired.

[@juggernaut6498]

This is why you use closed network cameras 😂

[@nobeltnium]

well he was able to login into their wifi and scan the whole net with nmap. In this scenario closed network doesn't help

[@nasserqamshui]

Bulbs got a network 😅

[@Pterodactyl-kn3ve]

Let’s not forget about Brandon Jackson who in (June?) 2023 was locked out of his Amazon devices because Amazon thought he was racist.

[@francischabot1412]

Even if you can somehow access the wifi network using the bulb which is already a big fail it's kind of even more fail that anybody having access to the wifi network would be able to log into the camera system.

[@thomasandrews9355]

From a company attack, I could see this. From a personal attack...unlikely any normal criminal has the means...I guess its possible but so is becoming a millionare.

[@jays_jae]

Nice! Good pwning, love seeing it. I hope he informed them about the vulnerability

[@tld8102]

oh shit. does this mean the smart bulbs i’ve returned to the store?

[@KJ-xt3yu]

Yes, every time, unless you ask for clarification on the process to validate weather or not.

[@stevenbarkley5067]

It is not if you will be hacked, it is are you worth protecting?

[@dankdigital4058]

I threw away that bulb to follow the person that stole it by implanting a tracker and malware to allow me to connect to anyone that tries this.

[@_sl1de_]

A fucking smart bulb ?!?!😂

[@sauerkraut3496]

To say it's easy to hack someone is relative. It's not like anyone could just do it then and there. Regardless, it's better to be aware Abt. these things.

[@alex140666]

is that a smart bulb though? looks like a regular LED bulb.

[@Chozo4]

It is a basic light bulb by ecosmart. The stuff shown is just the typical power use, lumens, colour temp, etc.

[@gasovensforqcult]

Why would the smart bulb bought at a random retail store contain info like a hardwired IP address, SSID, BSSID, MAC address of the person who eventually bought it after the bulb was discarded? Oh, I see you have a video. Let me watch it and maybe that answers my Q

[@taurohkea2169]

smart bulb? why do you need that?

[@shaikhowais8651]

That's why i never go for exchange offers 😕 just keep my phones in a box in some corners or break other stuff before giving them out

[@paladingeorge6098]

Thank god we are storing login tokens in light bulbs. Where would be in the world right now without that?

[@Wowaniac]

this is why YOU NEVER Connect your phone to a free wifi its not secure and once you do anyone on that network has access to your device!

[@chevalsauer]

Easy when you know how, just like anything

[@bromine_35]

Remember to smash the chip

[@zadekeys2194]

Use Access Control Lists or Blacklist the Mac address when you throw away a network device.

[@jessewilliams6459]

Just told my grandma to do that. Solved all of her problems and she knew what a Mac address is.

[@zadekeys2194]

@@jessewilliams6459 your Grandma is a true G. G is also for Google ;)

[@blankeyezero]

One question: why is he scavenging someone else' garbage

[@andrews6882]

That isn’t a smart bulb. I’m assuming you just used a random video of a LED bulb though

[@KJ-xt3yu]

trash light bulb yes, an in use device that isnt yours...NO. just dont.

[@Thefabfarm250]

Yeah all those first steps were pretty unnecessary if it’s a simple IOT camera there’s a bunch of websites you can just go and view them like the one in the last clip.

[@djbass5715]

Bro I did kinda similar to this.. so my school had this projectors for the lesson and stuff so when I scanned the network with nmap and angry ip scanner I found every projector on the network, after I pasted the IP of one of them I got the sign in page, and can you believe it it had the default credentials that I got from the manual that is open source, and at the end I could project my things or change the setting of them also freez and unfreeze the screen(but I've never done it because I didn't want to get in trouble)

[@highestsettings]

That's how easy it is if you have a shit router and you throw away smart devices without any care in the world.

[@robertbrzheintzbrz147]

Reminds me of the movie “the net”. As a pro one can only laugh about it.

[@crazeeaz]

Well, if it's "that easy" I might as well just put my wifi password on a framed card iny living room.

[@keivah-gaming4973]

That's why I remove the insides of things like these before I throw them away. And typically keep the logic board.

[@mxdanger]

Alternatively just click the factory reset button.

[@thefool7992]

Real life watch dogs

[@fbi8265]

Most cameras i find are password protected and ultta hard to exploit lol

[@error-un3fo]

Reaver is the easiest way to get into a network you just need a good directional arial and the network to have wps enabled.

[@nickgardner6340]

damn, all cuz their lightbulbs connect to the internet... that's so crazy...🙄

[@jdubbau4895]

And now you've given a detailed instruction on how to repeat the process, and it's on the internet! You just gave the hackers their silver platter

[@freeloaderuser6793]

All this is public knowledge. The execution itself though is a whole other shitstorm. You can literally search up how to make a bomb on the internet. Doesnt mean you'll be able to make one.

[@shawnsustrich7981]

This isnt really anything groundbreaking. Its basic opsec

[@fatcat7msk7ru]

🧐 hmmm.. got some free bulbs from random people.. ok got it, burned at the utilisation barrel. 🙄

[@Nyziko]

Wait, you said this was easy? Don't know if that's an insult to all other normal people without that knowledge, or it's just bragging

[@timothypryor7952]

Heck yeah. Nice dumpster dive breach.

[@nwk2VGtxbs26_eiXlo2wnQ]

Why can't I get one decent recommendation?

[@Jon6429]

Checks for house key under flower pot

[@Dan-codes]

Microwave everything.

[@xxcyberxx4137]

I have a 2 Bardi Smart Bulb one of them is 7watt and the one currently I'm using is 12w so I gotta yeet the Smart Bulb when it's dead and broken?

[@sangwonpark8967]

completely trash it before throwing it away

[@Animatron11]

No! Dispose of it in electronic waste! They are made of materials harmful for the environment

[@nakibahmed6960]

I stopped using any thing that has a smart name before device. If use something called smart devices before throwing away Fully destroyed first.

[@DavidKSanders]

"That's how easy it is". All you have to do is wait outside their house and wait till one of their smart devices breaks and they throw it away. Then you just need a rummage through their trash and pull it out! Hope that smart device isn't broken enough that you can't get the credentials out of it. Or that smart device was designed by an idiot who stored this information non-encrypted. What this comes down to is an almost unrealistic problem.

[@giorgiodiz8069]

Wtf are you talking about? There is not something like smart bulb with info from your router.

[@giorgiodiz8069]

@@FoxtrotYankeeHotel kiddo go to sleep and stop talking shit, makes you looks like a retard

[@KJ-xt3yu]

🍿 wifi password saved to the bulb, some even have router capabilities.

[@giorgiodiz8069]

@@KJ-xt3yu Hahaha yes sure

[@Bomkz]

actually is. in a different way though. You create a fake network with the same SSID, the bulb tries to connect to it, and it reveals the password during that.

[@relaxmed3517]

Omg the smartbulb thats brilliant

[@terrykiser7603]

So he's telling everyone how to do it. Smh

[@godn99]

No info about electricity yet....? Not yet....