Slovakia finds Russian backdoor in traffic speed cameras (risky.biz)

312 points by dredmorbius 7 hours ago

PinkSheep 2 hours ago

Over 100 comments, zero mentions that government funds should be spent on devices with auditable open-source firmware. Anyone here? No? Then I'm the first one to say this.

SecureBoot is a funny one. It should be signed with the deployer's keys (Slovak), not the manufacturer's. Trusted boot probably wasn't a consideration here, really.

Ironically, a custom firmware can now be used thanks to the lack of a digital lock... if you still trust the hardware.

PS: Props to NBU for doing their job.

srdjanr an hour ago

Would you be able to get those devices at all, especially at similar price as those with closed source firmware? R

gumby 6 hours ago

Slovakia has had a longstanding pro-Russia political stance and supports Russia’s invasion of Ukraine (and opposes the EU sanctions).

You reap what you sow, MFs!

https://en.wikipedia.org/wiki/Slovak_opposition_to_sanctions...

xX_Hacker_Xx an hour ago

opposition to sanctions does not imply pro-Russia stance.

slovakia also doesnt support Russia’s invasion of Ukraine. you made that up.

its crazy that such a lie is a top comment.

Gud 26 minutes ago

It is literally a pro Russian action, to be against sanctioning Russia for their war against Ukraine.

Tell me how it’s not advantageous for Russia to enable trade with them.

xX_Hacker_Xx 17 minutes ago

chimpontherun 5 hours ago

I find it amusing that the biggest supporters or Russia in its current war of aggression against Ukraine are/were Hungary, Slovakia, and Serbia -- precisely the countries that should know better, since they were the principal recipients the "love and friendship" from Russia:

- Hungary: November of 1956

- Slovakia: "spring" of 1968

- Serbia: the Stalin's betrayal at the end of WW2

codedokode 5 hours ago

Hungary and Slovakia are largest importers of Russian natural gas in Europe. France is third as I remember.

alterom 2 hours ago

vkou 5 hours ago

Geopolitical decisions aren't made by countries, they are made by individual people.

Sometimes those people are a plurality that organically endorses that decision and votes some representative in. Sometimes those people are a plurality that has been brainwashed by compromised media to do it. Sometimes those people are just a small ruling elite that get voted in by people who didn't think very hard about those particular geopolitical decisions and just want, I don't know, their political and cultural enemies brutalized and $1.99 gas.

toasty228 3 hours ago

Older people in these countries have good memories of that time, employment and housing were basically a given, healthcare and public transportation were solved, etc. They're very easy to manipulate, promise them a 13th month of pension and they'll vote for you.

I don't think you understand how bad globalization fucked up these countries, people live with their parents until they're 30+, young people can't find decent jobs, etc.

hbarka an hour ago

kakacik 2 hours ago

esseph 2 hours ago

alterom 2 hours ago

>precisely the countries that should know better, since they were the principal recipients the "love and friendship" from Russia

Goes to show that 1984-style conditioning really does work, decades later.

Remarkably, it can even be passed through generations, as it gets ingrained into the mentality of how parents raise children: "The nail that sticks out gets hammered down. Don't rock the boat."

Which was a survival trait in those times.

The current incarnation of Russian propaganda is different, but is even more virally poisonous:

> I'm not political. Politics is dirty. There's nothing you can change anyway. "Two sides" is an illusion. Everybody is lying and has an ulterior motive. Only naive fools believe otherwise, only naive fools ever trust. You can't know anything for sure. What you think is true is actually a lie. The only thing that's real is who you're with. That's the only truth. That's the only thing to look for in anything anyone says, that's the only thing one really says. That's what makes something true or false. The words uttered don't matter at all.

You might have seen this kind of mentality spouted by your friends on either side of the political spectrum.

Remarkably, whatever the political persuasion of people who have it is, the end result is the likes of Orban/Fico coming to power.

Sadly, this thing not only spreads, it also sticks.

If you know of an antidote, please tell me what it is.

inglor_cz 5 hours ago

The Slovaks ultimately got federalization of Czechoslovakia from the crisis (1969), which both distracted them and made their memories less negative.

As far as Hungary goes, I asked my friend who studied Hungarian history. He explained to me that while the Soviet invasion was very traumatic, the subsequent Kádár "goulash socialism" was a lot more lenient on the people than all the other Soviet Bloc regimes, and that the Hungarians made an incorrectly confident conclusion that losing a small war to the Russians is not catastrophic.

Of course, this is NOT the experience of basically anyone else who happened to be in a similar situation. A potential puppet regime of Russia in Ukraine wouldn't look like Kádárs by any means, it would rather look like the Kadyrovian microstate in Chechnya, minus the Islam of course.

spiderfarmer 5 hours ago

My brother visited some of these countries. He said most people there are oblivious to what happened to their countries. They simply don't care. It also didn't help that everyone he met (agricultural sector) was a day-drinker.

That's why they're doomed to repeat it. Again and again.

Blah1113 2 hours ago

Loughla 4 hours ago

dismalaf 4 hours ago

A lot of Eastern European countries have oligarchs who largely made their fortunes with help from the Russians. In Czechia one such example is the prime minister Andrej Babiš, who was a bureaucrat in a state owned business who then sold it to himself in the 90s (with the help of some "Swiss" money) and became a billionaire. He's consistently been as pro-Russia as he thinks he can get away with (the positive is that Czechs hate Russians a lot).

Also in these countries there's a lot of old people who have never been able to adapt to living in a free, capitalist society, so for them, there's some nostalgia for communism.

pmontra 3 hours ago

ReptileMan 5 hours ago

Are there any other wars that are not of aggression? What do you gain by parroting the legalese speak? Implying that it is extra bad and extra illegal war? Not your run of the mill PG-13 war? This one is X-rated kids.

Everyone knows who the attacker is - just some people root for Russia for their own reasons. Usually tied to the internal politics of their countries - like hating for unrelated reasons the political actors from their states that happen to support Ukraine.

Cpoll 4 hours ago

drysine 2 hours ago

And Japan was the sole recipient of nuclear "love and friendship" from the US

vrganj 6 hours ago

One could say that Fico himself is a Russian backdoor...

koonsolo 3 hours ago

Slovakia is heavily influenced by Russian propaganda, which started way before Corona times.

It's mainly the older people that are influenced by this, and a lot of young people either left the country already, or have concrete plans to leave.

It's really sad, how these old people are ruining the future of their children and grandchildren, really crazy.

You can say a lot about Russia, but they are very good with misinformation, it's a real threat for Europe.

My wife is from Slovakia, so I have front row seats on the whole situation. The kinds of misinformation these older people are willing to believe is really nuts.

fmajid 3 hours ago

Old people are ruining their grandchildren’s lives everywhere, not just in Slovakia.

fallingbananna 3 hours ago

It's rooted in the education system to this day.

The majority of school teachers grew up under the Soviet side of cold war propaganda.

And in history education in particular, we are told that "we" have always looked towards Russia as a role model, to fight Hungarian nationalism (since the country was just part of Hungary for most of its history).

koonsolo 3 hours ago

deepfriedchokes 3 hours ago

Sounds like boomers everywhere.

shevy-java 2 hours ago

That's wrong. Even the pro-Russia politicians did not support the genocide Russia commits against Ukraine. And they are not even in the majority right now anyway; people are not going to elect bribed russian tools anymore. You could see this in Hungary. The rest will follow - everyone sees the daily genocide Putin commits here. No amount of bribe money will convince regular people from what they can see with their own eyes here.

kstenerud 4 hours ago

That's a pretty harsh and uninformed take. Russia operates by capturing foreign governments and making their leaders beholden to Russia's interests. When it succeeds, it happens regardless of what the populace actually wants. They've been grooming Trump (along with a dozen or so other potential up-and-comers) since the 80s (Trump was considered a long shot and too unpredictable, but fortune favors the prepared - better weak support of their enemies than full belligerence).

The Belarusians aren't too thrilled that Russian troops are operating in their country either, but Lukashenko needs Russian support to stay in power, so he walks a tightrope. Notice how noncommittal he is about pretty much everything...

koonsolo 3 hours ago

In the case of Slovakia, it's purely Russian misinformation that was able to capture a large part of the population, mainly older people. First anti-EU, then anti-vax, and now anti-Ukraine and anti-EU.

greenavocado 6 hours ago

You must be new to state sponsored malware. Recent false flags are a thing: 2018 Olympic Destroyer, Marble Framework, Silver Fox, MuddyWater Chaos

pbrum 4 hours ago

Silver Fox is a very vaguely defined Chinese cybercrime group of malware and actors...or are you referring to something else?

sofixa 5 hours ago

> Recent false flags are a thing: 2018 Olympic Destroyer, Marble Framework, Silver Fox, MuddyWater Chaos

How are any of those false flag? They're state sponsored, by different state actors.

lenkite 4 hours ago

It would be extremely stupid of Russia not to spy on Slovakia. If they had properly spied on Ukraine, they could have turned around 2014 and all of Nuland's "regime change" machinations. They have learned their lesson well now - do as the Americans do and spy on everyone - and most especially the "friendly" nations - by any and all means.

znnajdla 3 hours ago

"learned their lesson well now" - I don't think Russia has learned any lessons at all since Ukraine. Russia's sheer incompetence keeps getting worse and worse, as Prigozhin exposed on the inside. The war went from total failure to achieve any objectives for 5 years, to now 4 hour lines in Moscow to fill up your car at the gas station - i.e. Russia went from "failing to capture Kyiv in 3 days" to now "getting hit in the center of Moscow regularly".

Given the level of incompetence that Russia has demonstrated on both the political and military front, I highly doubt it could've turned anything around in Ukraine even if knew everything about 2014.

Paradigma11 an hour ago

That does not make much sense. In 2014 Yanukovic was in power, who had been bought off by Russia. Lets not forget that Yanukovic ran on a pro EU platform and then reversed a day or so before signing the EU association agreement. Naturally the people went to the streets and eventually Yanukovic fled. Not sure what you would have wanted to spy on.

bdhdhduuyd 6 hours ago

So they bought the cameras and some people pointed out they look exactly the same as Russian cameras. The government denied this but after they figured out the serial numbers matched the Russian cameras they started this investigation.

Good they investigated this before using them, but this sounds like a big fu...

caminante 5 hours ago

This would be far more impressive if not for:

> multiple reports in Slovak media that linked the purchase to a Cyprus shell company with fake certifications.

We're talking about this as if it's some precursor to a James Bond plot, but it really fizzles after learning Nina in the sourcing department skipped the compliance paperwork. James Bond doesn't need to leave the bed!

Trojan exploits aside, I just assume that it'd be easier for someone in SVR/GRU to bribe an admin.

kakacik 2 hours ago

Current government is extremely pro-russian to the point of treason, and people involved in this case double so.

This wasn't some oversight of the proverbial Nina in any way. They just did sloppy job from both sides covering tracks, not uncommon with current government. They are loud (and racist, xenophobic, and often dumb), not competent smart people.

tpm 20 minutes ago

> Nina in the sourcing department skipped the compliance paperwork.

Well the interior ministry didn't really demand one (yes really) but the opposition people have read the documentation for the cameras and the hash of the supplied software was exactly the same as the hash for the russian simicon camera.

locknitpicker 4 hours ago

> We're talking about this as if it's some precursor to a James Bond plot, but it really fizzles after learning Nina in the sourcing department skipped the compliance paperwork.

That's exactly the sort of thing that James Bond would do.

codedokode 3 hours ago

With high probablity they are actually made in China. I don't think Russia makes their own chips for cameras.

NuclearPM 6 hours ago

A big what?

GauntletWizard 6 hours ago

A big fuck-up, but some people prefer (nobly even if I don't abide by the same rule) to keep some words out of their mouths.

amelius 4 hours ago

bdhdhduuyd 6 hours ago

fuck up

Animats 4 hours ago

> the cameras expose live streams to anyone without a password and who knows their broadcasting IP.

Are these cameras in use in Russia? Can people outside of Russia look in at Russian traffic in this way?

codedokode 3 hours ago

There is a small number of cameras which broadcast the video publicly. For example, Moscow: [1] (Taganskaya square), [2] and Saint-Petersburg: [3] (Nevsky prospect and Gostiniy Dvor). Sadly the quality is not great and in reality those places look much better. For example, many of the small 2-floor buildings on Taganskaya square are over 100 years and have a nie classical architecture but one cannot see any fine details in the camera view.

[1] https://gidcam.ru/camera/moskva-panorama-centra-stolicy-s-ma...

[2] https://gidcam.ru/camera/moskva-volgogradskij-prospekt-i-plo...

[3] https://camguide.net/ru/europe/russia/saint-petersburg/nevsk...

thisisnotauser 3 hours ago

The comments here seem to presuppose that somehow Slovakia is the only ones who would need to worry about this, and not, say, any town with Flock in it

sorokod 2 hours ago

"Кордон.Про" product page on the simicon site

https://simicon.ru/rus/product/gun/cordon_pro.html

tomas789 6 hours ago

Imagine somebody being able to track almost anyone using road side cameras. Good thing such things happen only in eastern Europe wink wink

somenameforme 5 hours ago

Most cameras are insecure by default. Check out: http://www.insecam.org/en/ or https://www.shodan.io/ The first isn't even using default access creds, which I suspect is what was 'discovered' in this case, but cameras that immediately hook up to the internet with 0 restrictions to access.

lifestyleguru 6 hours ago

For the goal of recording a cat scratching their car or catching an imaginary thief neighbour (a magpie or fox stole that thing that one time, you dullard) people will plug into Chinese, Russian, and American video surveillance networks in no time and pay for it.

physhster an hour ago

It's almost as if electing a pro-Russia politician has consequences...

pvaldes 2 hours ago

What's the purpose of this? Opening a way to make the cameras going rogue and starting to fine everybody in a particular period of time to create massive discontent, administration chaos, and unrest? maybe just before an election? Aren't this cameras connected with some government computers?

tpm an hour ago

Perhaps. What actually happened is that we have a demented interior minister in a unbelievably corrupt but also pro-russian government. So it's really anybodys guess if it's just pure corruption (the interior ministry wanting to buy some traffic cameras and someone bribing to get the contract while buying the cheapest they could find which were these russian ones) or indeed some covert russian operation (the responsible minister wouldn't know about it, he's too dumb for that, but there might be other government people who did know). In any case in a functioning state this would end up with the minister leaving his post at least. Not in Slovakia.

tokai 5 hours ago

It seems like a silly mess. But its easier than it sounds to end up in such a situation. We're are a lot of HN Kagi users that just have to trust that the Yandex collaboration is fully watertight.

ojciecczas 3 hours ago

Fits perfectly in the russian thinking scheme, always infiltrating their neighbours and trying to get more. Fucking parasites.

shevy-java 2 hours ago

The problem I see is that Putin fully committed to the war. It is not only clear that he has no interest in ending the war, despite the lip service, but will continue to create problems and cause issues. This backdoor here is not an isolated problem - it is a systemic, concerted problem. All retaliatory moves are handicapped by orange Agent Krasnov being an asset for Russia. The EU needs to stop outsourcing its security. That includes having a nuclear arsenal available for all member states.

koonsolo 3 hours ago

It wouldn't surprise me if the Russian misinformation inside Slovakia is able to spin this into an anti-EU, anti-Ukraine story.

lifestyleguru 5 hours ago

Slovakian prime minister is doing proud photos with Putin despite the ongoing war so the backdoor looks like a desired feature not a bug or fuck up.

irishcoffee 6 hours ago

Next up, chinese solar inverter firmware.

hansoolo 4 hours ago

Do they even need that since, when most of the converters are attached to the Chinese cloud?

irishcoffee 3 hours ago

I made the logical leap that the firmware enables this. I don’t have the code in front of me, so that may have been an incorrect leap.

victorbjorklund 6 hours ago

To do what? Turn off the power in random individual houses?

jwr 4 hours ago

I think synchronized operations could really disrupt the grid — think thousands of inverters switching backfeeding to the grid on/off, causing waves and disruption. Or thousands of inverters having their grid sync disabled, simultaneously operating to shift the frequency of the grid (very bad).

wongarsu 6 hours ago

I'd be worried about the inverters in large commercial solar plants. On a sunny day you could easily cause a blackout by turning enough solar capacity off at once. Maybe shut down the entire grid when the sudden power imbalances trip the self- protection in half the grid. That's a pain to recover from. Spain went through that not too long ago

But maybe rapidly switching residential solar on and off in a coordinated way can also do funny things to grid equipment

rollulus 6 hours ago

Any idea what happens to the grid when a significant chunk of solar power suddenly disconnects?

victorbjorklund an hour ago

hsuduebc2 4 hours ago

Spooky23 an hour ago

If you had enough systems under control in an area, you could probably create a brown out or some other type of scenario by turning off 1000 houses on the right day.

nom 5 hours ago

nah, the ones connected to the grid... you turn them all off during peak sun hours at the exact same time

same issue with large loads like boilers, this stuff should never be connected to the internet, but it is

if you can control enough load on the grid you can do real damage

randoot 6 hours ago

DDoS, anonymizer proxy, and turn off power in large commercial installations. They kinda deserve it for investing in solar. US holds all the power in social media, can't blame China if they want to utilize their lead in solar for something too.

Hopefully mutually assured annoyance keeps everyone at bay.

bdhdhduuyd 6 hours ago

To set roofs on fire?

In the end it's all about trust. Right now I don't see why China would like to burn down their market.

cyanydeez 6 hours ago

emdash 6 hours ago

Some of those are networked I think?

tomas789 5 hours ago

vkou 4 hours ago

To piss away decades of hard-earned trust in its products for some short-term one-time political 'pwn' of the enemy.

If that goal sounds stupid to you, that's because it is. I would expect some countries that are not China to act with such a capricious lack of foresight.

irishcoffee 3 hours ago

newsclues 6 hours ago

Track usage patterns to know when people are at home and then rob them.

2OEH8eoCRo0 6 hours ago

The HN version of "I have nothing to hide."

giancarlostoro 6 hours ago

LogTrim 6 hours ago

The detail that gets me is the Ministry saying the cameras were safe because they'd be on a closed network, while the backdoor can apparently be triggered via SMS from hardcoded phone numbers.

That's a pretty good demonstration of why "it's not exposed to the internet" isn't a security boundary if the device itself has an out-of-band communications path.

Add Secure Boot being disabled and unauthenticated live streams and this seems less like one unfortunate backdoor and more like nobody established what the trust boundary was supposed to be in the first place.

PinkSheep 2 hours ago

"Not exposed to the internet" means exfiltration is hard in this case. If I were to dream about defense in depth, these SIM cards should be monitored for traffic anyway or have filtering rules at carrier level. Because at the end of the day, Russian numbers or not, mobile networks are insecure.

yodon 5 hours ago

Zero chance of vulns in flock, so we're good in the US /s

juliusceasar 4 hours ago

Russia to Slovakia is Israel to USA. Puppet state.

toasty228 4 hours ago

Most people talking about Slovakia wouldn't even be able to put it on a map or know what currency they use, but they become instant geo political expert.

They don't even know how to pronounce Fico properly... Give me a break lmao

juliusceasar 3 hours ago

That is your argument? Omg, the level of it...