Security Flaws in California's Digital License Plates (Reviver)

[MunkyTool]

Was always suspicious of these.

"A team of security researchers managed to gain “super administrative access” into Reviver, the company behind California’s new digital license plates which launched last year. That access allowed them to track the physical GPS location of all Reviver customers and change a section of text at the bottom of the license plate designed for personalized messages to whatever they wished, according to a blog post from the researchers."

https://www.vice.com/en/article/wxn9...e-gps-location

[jmack]

It's a feature, not a flaw.

[detroitm2]

Just like any other piece of technology, theres bound to be flaws. This isn't really surprising. These were fixed well ahead of public release.

[NYG]

Lol @ blindly trusting any new technology.

The amount of people who have Alexas, ring cameras and stuff is wild. Those things are such huge security breaches.

"it duznt mattur cuz evrythin traks u even ur fone" or "if u hav nuthin 2 hide then who cares" <- pick whichever terrible logic to justify bad decisions

[Tyga11]

Originally Posted by NYG

Lol @ blindly trusting any new technology.

The amount of people who have Alexas, ring cameras and stuff is wild. Those things are such huge security breaches.

"it duznt mattur cuz evrythin traks u even ur fone" or "if u hav nuthin 2 hide then who cares" <- pick whichever terrible logic to justify bad decisions

I have ADT security cameras. Are you saying they are at risk of hacking from criminals or the government? Or both?

What is your solution? Not to have cameras?

[CarsAndGuitars]

Originally Posted by Tyga11

I have ADT security cameras. Are you saying they are at risk of hacking from criminals or the government? Or both?

What is your solution? Not to have cameras?

If I may stray back on topic, why does a license plate have GPS capability - regardless of it being government-issued?

[NYG]

Originally Posted by Tyga11

I have ADT security cameras. Are you saying they are at risk of hacking from criminals or the government? Or both?

What is your solution? Not to have cameras?

Dedicated server inside of your home.

[detroitm2]

Originally Posted by CarsAndGuitars

If I may stray back on topic, why does a license plate have GPS capability - regardless of it being government-issued?

Its not government issued, Its just authorized for use in US states.

The GPS is used to track the vehicle in the event that its stolen. (it also has LTE capabilities)

[zx10guy]

Originally Posted by Tyga11

I have ADT security cameras. Are you saying they are at risk of hacking from criminals or the government? Or both?

What is your solution? Not to have cameras?

Your own cameras that are not cloud attached nor dependent on it. I have security cameras on my home but the system is totally autonomous not requiring any stupid cloud server. As an extra measure, I have the cameras isolated on a specific part of my network where the cameras don't have access to anything else on my network nor have Internet access. If I want to view the live feed from the cameras or recorded video remotely, I connect to an SSL VPN server I set up in my network.

[G35POPPEDMYCHERRY]

Originally Posted by zx10guy

Your own cameras that are not cloud attached nor dependent on it. I have security cameras on my home but the system is totally autonomous not requiring any stupid cloud server. As an extra measure, I have the cameras isolated on a specific part of my network where the cameras don't have access to anything else on my network nor have Internet access. If I want to view the live feed from the cameras or recorded video remotely, I connect to an SSL VPN server I set up in my network.

you must have something to hide

[detroitm2]

Originally Posted by NYG

Dedicated server inside of your home.

You'd still want/need offsite storage if you want any kind of redundancy. In-home storage wont do you any good if your house is burned down, or the storage device is stolen.

Your point is valid, but the idea that you can keep everything "in house" likely isnt realistic from a redundancy standpoint.

[zx10guy]

Originally Posted by detroitm2

You'd still want/need offsite storage if you want any kind of redundancy. In-home storage wont do you any good if your house is burned down, or the storage device is stolen.

Your point is valid, but the idea that you can keep everything "in house" likely isnt realistic from a redundancy standpoint.

I'm in process of setting up a site to site VPN tunnel between my primary home and vacation home. I have a Dell VRTX blade server with two M630 blades. Once I get the network sorted between the homes, I'll stand up my Equallogic iSCSI SAN with 16TB of storage. I'll then replicate the video data to that storage array.

[detroitm2]

Originally Posted by zx10guy

I'm in process of setting up a site to site VPN tunnel between my primary home and vacation home. I have a Dell VRTX blade server with two M630 blades. Once I get the network sorted between the homes, I'll stand up my Equallogic iSCSI SAN with 16TB of storage. I'll then replicate the video data to that storage array.

I don't see a ton of benefit of using a site-to-site VPN for this. Unless you're trying to encrypt a wide variety of traffic. Though it will likely make it a bit easier to implement the storage array replication.

I'd probably just do something simple over SSL/SSH to get the same level of encryption as your VPN.

Both methods will achieve what you're seeking though

[zx10guy]

Originally Posted by detroitm2

I don't see a ton of benefit of using a site-to-site VPN for this. Unless you're trying to encrypt a wide variety of traffic. Though it will likely make it a bit easier to implement the storage array replication.

I'd probably just do something simple over SSL/SSH to get the same level of encryption as your VPN.

Both methods will achieve what you're seeking though

The reason I'm doing a site to site is because there are things I want to be able to access over there and vice versa depending on where I am physically located. One thing which will be nice is to get my IP phones at my vacation home running through the site to site to work with my call manager at my primary home. Currently, I'm using a unique layer 2 extension solution between locations. And yes, I'm planning on using Equallogic SAN replication across the tunnel as I have a PS6100 at my primary home and a PS4000 at my vacation home. I'm trying to get OSPF working between the two locations but I think I'm running into a SonicWall limitation on requiring a static public IP. So I'm going to try coding in static routes to get the routing working.

[detroitm2]

Originally Posted by zx10guy

The reason I'm doing a site to site is because there are things I want to be able to access over there and vice versa depending on where I am physically located. One thing which will be nice is to get my IP phones at my vacation home running through the site to site to work with my call manager at my primary home. Currently, I'm using a unique layer 2 extension solution between locations. And yes, I'm planning on using Equallogic SAN replication across the tunnel as I have a PS6100 at my primary home and a PS4000 at my vacation home. I'm trying to get OSPF working between the two locations but I think I'm running into a SonicWall limitation on requiring a static public IP. So I'm going to try coding in static routes to get the routing working.

Ah, yeah. That would fall under the "I wanna do other things" option.

I've had good luck with Fortinet hardware in the past setting up site-to-site links. (Though I have a close friend who was a vendor, so I may be a bit bias)

[zx10guy]

Originally Posted by detroitm2

Ah, yeah. That would fall under the "I wanna do other things" option.

I've had good luck with Fortinet hardware in the past setting up site-to-site links. (Though I have a close friend who was a vendor, so I may be a bit bias)

I do have a Fortinet firewall. But it's being used in my primary home as the gateway into my management network. Yeah, my "home" network is overkill, but it's how I design networks when I was building data centers. I installed a Palo virtual firewall but haven't gotten around to do anything with it yet.

[Murf the Surf]

Originally Posted by NYG

Dedicated server inside of your home.

Yup, the problem is people want real time monitoring and then give up the privacy to get it.

[zx10guy]

Originally Posted by Murf the Surf

Yup, the problem is people want real time monitoring and then give up the privacy to get it.

I think it's more of people's perception of value and also not understanding that easy comes at a cost. I get why these things are appealing. I helped set up a Ring doorbell camera for someone. It was stupid easy. But non cloud connected devices do require some level of technical expertise to implement. And for whatever reason, home IT is something that many people refuse to spend money on getting a company to set it up for them if they lack the skills. Hence this growing industry of the easy button network devices.

Another thing that people don't understand aside from the security issues, is that they really don't own the equipment. That device is only functional as long as that cloud server is up and running or supports their hardware. Once either goes away, you're stuck with buying new hardware regardless of if that hardware is working and satisfies your needs.

[Murf the Surf]

Originally Posted by zx10guy

I think it's more of people's perception of value and also not understanding that easy comes at a cost. I get why these things are appealing. I helped set up a Ring doorbell camera for someone. It was stupid easy. But non cloud connected devices do require some level of technical expertise to implement. And for whatever reason, home IT is something that many people refuse to spend money on getting a company to set it up for them if they lack the skills. Hence this growing industry of the easy button network devices.

Another thing that people don't understand aside from the security issues, is that they really don't own the equipment. That device is only functional as long as that cloud server is up and running or supports their hardware. Once either goes away, you're stuck with buying new hardware regardless of if that hardware is working and satisfies your needs.

My sister has a couple of Nest cameras outside of her house. Kind of interesting that she gets a chime on her phone when ever anyone is at the front door, but she also gets a chime anytime the neighbours cat walks through her back yard.

I'm very reluctant to use any of the smart devices in my home. Our new furnace and heat pump came with a proprietary smart thermostat, and that's it for us at this point. I do like that I can monitor the house temp while were away from home. We are heading south for a couple of months so it does offer some piece of mind.

[zx10guy]

Originally Posted by Murf the Surf

My sister has a couple of Nest cameras outside of her house. Kind of interesting that she gets a chime on her phone when ever anyone is at the front door, but she also gets a chime anytime the neighbours cat walks through her back yard.

I'm very reluctant to use any of the smart devices in my home. Our new furnace and heat pump came with a proprietary smart thermostat, and that's it for us at this point. I do like that I can monitor the house temp while were away from home. We are heading south for a couple of months so it does offer some piece of mind.

The behavior of your sister's Nest cameras shows that Nest has a weak human recognition software/algorithm. Blue Iris is known to have very good human recognition limiting false positives.

I agree on the smart/IoT devices. Won't use them if I can avoid them. I do have a smart thermostat too. It's at my vacation home. It allows me to precondition the house before I arrive and the same as you keep tabs on it temp wise. The thermostat is from Honeywell. Figure they wouldn't be as nefarious as the big players with snooping. The thermostat saved my butt when I was getting temperature alerts that my house was too cold. It was during the really cold winter season we had a few years ago. Thought the furnace was just catching up with heating the house. Temps kept falling based on the alerts I was receiving. This prompted me to make an immediate trip out where I found the furnace not working.

[W Cole]

Originally Posted by Tyga11

I have ADT security cameras. Are you saying they are at risk of hacking from criminals or the government? Or both?

What is your solution? Not to have cameras?

Closed circuit cameras is the solution