Slovakia finds Russian backdoor in traffic speed cameras (risky.biz)
312 points by dredmorbius 7 hours ago
PinkSheep 2 hours ago
Over 100 comments, zero mentions that government funds should be spent on devices with auditable open-source firmware. Anyone here? No? Then I'm the first one to say this.
SecureBoot is a funny one. It should be signed with the deployer's keys (Slovak), not the manufacturer's. Trusted boot probably wasn't a consideration here, really.
Ironically, a custom firmware can now be used thanks to the lack of a digital lock... if you still trust the hardware.
PS: Props to NBU for doing their job.
srdjanr an hour ago
Would you be able to get those devices at all, especially at similar price as those with closed source firmware? R
gumby 6 hours ago
Slovakia has had a longstanding pro-Russia political stance and supports Russia’s invasion of Ukraine (and opposes the EU sanctions).
You reap what you sow, MFs!
https://en.wikipedia.org/wiki/Slovak_opposition_to_sanctions...
xX_Hacker_Xx an hour ago
opposition to sanctions does not imply pro-Russia stance.
slovakia also doesnt support Russia’s invasion of Ukraine. you made that up.
its crazy that such a lie is a top comment.
Gud 26 minutes ago
It is literally a pro Russian action, to be against sanctioning Russia for their war against Ukraine.
Tell me how it’s not advantageous for Russia to enable trade with them.
xX_Hacker_Xx 17 minutes ago
chimpontherun 5 hours ago
I find it amusing that the biggest supporters or Russia in its current war of aggression against Ukraine are/were Hungary, Slovakia, and Serbia -- precisely the countries that should know better, since they were the principal recipients the "love and friendship" from Russia:
- Hungary: November of 1956
- Slovakia: "spring" of 1968
- Serbia: the Stalin's betrayal at the end of WW2
codedokode 5 hours ago
Hungary and Slovakia are largest importers of Russian natural gas in Europe. France is third as I remember.
alterom 2 hours ago
vkou 5 hours ago
Geopolitical decisions aren't made by countries, they are made by individual people.
Sometimes those people are a plurality that organically endorses that decision and votes some representative in. Sometimes those people are a plurality that has been brainwashed by compromised media to do it. Sometimes those people are just a small ruling elite that get voted in by people who didn't think very hard about those particular geopolitical decisions and just want, I don't know, their political and cultural enemies brutalized and $1.99 gas.
toasty228 3 hours ago
Older people in these countries have good memories of that time, employment and housing were basically a given, healthcare and public transportation were solved, etc. They're very easy to manipulate, promise them a 13th month of pension and they'll vote for you.
I don't think you understand how bad globalization fucked up these countries, people live with their parents until they're 30+, young people can't find decent jobs, etc.
hbarka an hour ago
kakacik 2 hours ago
esseph 2 hours ago
alterom 2 hours ago
>precisely the countries that should know better, since they were the principal recipients the "love and friendship" from Russia
Goes to show that 1984-style conditioning really does work, decades later.
Remarkably, it can even be passed through generations, as it gets ingrained into the mentality of how parents raise children: "The nail that sticks out gets hammered down. Don't rock the boat."
Which was a survival trait in those times.
The current incarnation of Russian propaganda is different, but is even more virally poisonous:
> I'm not political. Politics is dirty. There's nothing you can change anyway. "Two sides" is an illusion. Everybody is lying and has an ulterior motive. Only naive fools believe otherwise, only naive fools ever trust. You can't know anything for sure. What you think is true is actually a lie. The only thing that's real is who you're with. That's the only truth. That's the only thing to look for in anything anyone says, that's the only thing one really says. That's what makes something true or false. The words uttered don't matter at all.
You might have seen this kind of mentality spouted by your friends on either side of the political spectrum.
Remarkably, whatever the political persuasion of people who have it is, the end result is the likes of Orban/Fico coming to power.
Sadly, this thing not only spreads, it also sticks.
If you know of an antidote, please tell me what it is.
inglor_cz 5 hours ago
The Slovaks ultimately got federalization of Czechoslovakia from the crisis (1969), which both distracted them and made their memories less negative.
As far as Hungary goes, I asked my friend who studied Hungarian history. He explained to me that while the Soviet invasion was very traumatic, the subsequent Kádár "goulash socialism" was a lot more lenient on the people than all the other Soviet Bloc regimes, and that the Hungarians made an incorrectly confident conclusion that losing a small war to the Russians is not catastrophic.
Of course, this is NOT the experience of basically anyone else who happened to be in a similar situation. A potential puppet regime of Russia in Ukraine wouldn't look like Kádárs by any means, it would rather look like the Kadyrovian microstate in Chechnya, minus the Islam of course.
spiderfarmer 5 hours ago
My brother visited some of these countries. He said most people there are oblivious to what happened to their countries. They simply don't care. It also didn't help that everyone he met (agricultural sector) was a day-drinker.
That's why they're doomed to repeat it. Again and again.
Blah1113 2 hours ago
Loughla 4 hours ago
dismalaf 4 hours ago
A lot of Eastern European countries have oligarchs who largely made their fortunes with help from the Russians. In Czechia one such example is the prime minister Andrej Babiš, who was a bureaucrat in a state owned business who then sold it to himself in the 90s (with the help of some "Swiss" money) and became a billionaire. He's consistently been as pro-Russia as he thinks he can get away with (the positive is that Czechs hate Russians a lot).
Also in these countries there's a lot of old people who have never been able to adapt to living in a free, capitalist society, so for them, there's some nostalgia for communism.
pmontra 3 hours ago
ReptileMan 5 hours ago
Are there any other wars that are not of aggression? What do you gain by parroting the legalese speak? Implying that it is extra bad and extra illegal war? Not your run of the mill PG-13 war? This one is X-rated kids.
Everyone knows who the attacker is - just some people root for Russia for their own reasons. Usually tied to the internal politics of their countries - like hating for unrelated reasons the political actors from their states that happen to support Ukraine.
Cpoll 4 hours ago
drysine 2 hours ago
And Japan was the sole recipient of nuclear "love and friendship" from the US
vrganj 6 hours ago
One could say that Fico himself is a Russian backdoor...
koonsolo 3 hours ago
Slovakia is heavily influenced by Russian propaganda, which started way before Corona times.
It's mainly the older people that are influenced by this, and a lot of young people either left the country already, or have concrete plans to leave.
It's really sad, how these old people are ruining the future of their children and grandchildren, really crazy.
You can say a lot about Russia, but they are very good with misinformation, it's a real threat for Europe.
My wife is from Slovakia, so I have front row seats on the whole situation. The kinds of misinformation these older people are willing to believe is really nuts.
fmajid 3 hours ago
Old people are ruining their grandchildren’s lives everywhere, not just in Slovakia.
fallingbananna 3 hours ago
It's rooted in the education system to this day.
The majority of school teachers grew up under the Soviet side of cold war propaganda.
And in history education in particular, we are told that "we" have always looked towards Russia as a role model, to fight Hungarian nationalism (since the country was just part of Hungary for most of its history).
koonsolo 3 hours ago
deepfriedchokes 3 hours ago
Sounds like boomers everywhere.
shevy-java 2 hours ago
That's wrong. Even the pro-Russia politicians did not support the genocide Russia commits against Ukraine. And they are not even in the majority right now anyway; people are not going to elect bribed russian tools anymore. You could see this in Hungary. The rest will follow - everyone sees the daily genocide Putin commits here. No amount of bribe money will convince regular people from what they can see with their own eyes here.
kstenerud 4 hours ago
That's a pretty harsh and uninformed take. Russia operates by capturing foreign governments and making their leaders beholden to Russia's interests. When it succeeds, it happens regardless of what the populace actually wants. They've been grooming Trump (along with a dozen or so other potential up-and-comers) since the 80s (Trump was considered a long shot and too unpredictable, but fortune favors the prepared - better weak support of their enemies than full belligerence).
The Belarusians aren't too thrilled that Russian troops are operating in their country either, but Lukashenko needs Russian support to stay in power, so he walks a tightrope. Notice how noncommittal he is about pretty much everything...
koonsolo 3 hours ago
In the case of Slovakia, it's purely Russian misinformation that was able to capture a large part of the population, mainly older people. First anti-EU, then anti-vax, and now anti-Ukraine and anti-EU.
greenavocado 6 hours ago
You must be new to state sponsored malware. Recent false flags are a thing: 2018 Olympic Destroyer, Marble Framework, Silver Fox, MuddyWater Chaos
pbrum 4 hours ago
Silver Fox is a very vaguely defined Chinese cybercrime group of malware and actors...or are you referring to something else?
sofixa 5 hours ago
> Recent false flags are a thing: 2018 Olympic Destroyer, Marble Framework, Silver Fox, MuddyWater Chaos
How are any of those false flag? They're state sponsored, by different state actors.
lenkite 4 hours ago
It would be extremely stupid of Russia not to spy on Slovakia. If they had properly spied on Ukraine, they could have turned around 2014 and all of Nuland's "regime change" machinations. They have learned their lesson well now - do as the Americans do and spy on everyone - and most especially the "friendly" nations - by any and all means.
znnajdla 3 hours ago
"learned their lesson well now" - I don't think Russia has learned any lessons at all since Ukraine. Russia's sheer incompetence keeps getting worse and worse, as Prigozhin exposed on the inside. The war went from total failure to achieve any objectives for 5 years, to now 4 hour lines in Moscow to fill up your car at the gas station - i.e. Russia went from "failing to capture Kyiv in 3 days" to now "getting hit in the center of Moscow regularly".
Given the level of incompetence that Russia has demonstrated on both the political and military front, I highly doubt it could've turned anything around in Ukraine even if knew everything about 2014.
Paradigma11 an hour ago
That does not make much sense. In 2014 Yanukovic was in power, who had been bought off by Russia. Lets not forget that Yanukovic ran on a pro EU platform and then reversed a day or so before signing the EU association agreement. Naturally the people went to the streets and eventually Yanukovic fled. Not sure what you would have wanted to spy on.
bdhdhduuyd 6 hours ago
So they bought the cameras and some people pointed out they look exactly the same as Russian cameras. The government denied this but after they figured out the serial numbers matched the Russian cameras they started this investigation.
Good they investigated this before using them, but this sounds like a big fu...
caminante 5 hours ago
This would be far more impressive if not for:
> multiple reports in Slovak media that linked the purchase to a Cyprus shell company with fake certifications.
We're talking about this as if it's some precursor to a James Bond plot, but it really fizzles after learning Nina in the sourcing department skipped the compliance paperwork. James Bond doesn't need to leave the bed!
Trojan exploits aside, I just assume that it'd be easier for someone in SVR/GRU to bribe an admin.
kakacik 2 hours ago
Current government is extremely pro-russian to the point of treason, and people involved in this case double so.
This wasn't some oversight of the proverbial Nina in any way. They just did sloppy job from both sides covering tracks, not uncommon with current government. They are loud (and racist, xenophobic, and often dumb), not competent smart people.
tpm 20 minutes ago
> Nina in the sourcing department skipped the compliance paperwork.
Well the interior ministry didn't really demand one (yes really) but the opposition people have read the documentation for the cameras and the hash of the supplied software was exactly the same as the hash for the russian simicon camera.
locknitpicker 4 hours ago
> We're talking about this as if it's some precursor to a James Bond plot, but it really fizzles after learning Nina in the sourcing department skipped the compliance paperwork.
That's exactly the sort of thing that James Bond would do.
codedokode 3 hours ago
With high probablity they are actually made in China. I don't think Russia makes their own chips for cameras.
NuclearPM 6 hours ago
A big what?
GauntletWizard 6 hours ago
A big fuck-up, but some people prefer (nobly even if I don't abide by the same rule) to keep some words out of their mouths.
amelius 4 hours ago
bdhdhduuyd 6 hours ago
fuck up
Animats 4 hours ago
> the cameras expose live streams to anyone without a password and who knows their broadcasting IP.
Are these cameras in use in Russia? Can people outside of Russia look in at Russian traffic in this way?
codedokode 3 hours ago
There is a small number of cameras which broadcast the video publicly. For example, Moscow: [1] (Taganskaya square), [2] and Saint-Petersburg: [3] (Nevsky prospect and Gostiniy Dvor). Sadly the quality is not great and in reality those places look much better. For example, many of the small 2-floor buildings on Taganskaya square are over 100 years and have a nie classical architecture but one cannot see any fine details in the camera view.
[1] https://gidcam.ru/camera/moskva-panorama-centra-stolicy-s-ma...
[2] https://gidcam.ru/camera/moskva-volgogradskij-prospekt-i-plo...
[3] https://camguide.net/ru/europe/russia/saint-petersburg/nevsk...
thisisnotauser 3 hours ago
The comments here seem to presuppose that somehow Slovakia is the only ones who would need to worry about this, and not, say, any town with Flock in it
sorokod 2 hours ago
"Кордон.Про" product page on the simicon site
tomas789 6 hours ago
Imagine somebody being able to track almost anyone using road side cameras. Good thing such things happen only in eastern Europe wink wink
somenameforme 5 hours ago
Most cameras are insecure by default. Check out: http://www.insecam.org/en/ or https://www.shodan.io/ The first isn't even using default access creds, which I suspect is what was 'discovered' in this case, but cameras that immediately hook up to the internet with 0 restrictions to access.
lifestyleguru 6 hours ago
For the goal of recording a cat scratching their car or catching an imaginary thief neighbour (a magpie or fox stole that thing that one time, you dullard) people will plug into Chinese, Russian, and American video surveillance networks in no time and pay for it.
physhster an hour ago
It's almost as if electing a pro-Russia politician has consequences...
pvaldes 2 hours ago
What's the purpose of this? Opening a way to make the cameras going rogue and starting to fine everybody in a particular period of time to create massive discontent, administration chaos, and unrest? maybe just before an election? Aren't this cameras connected with some government computers?
tpm an hour ago
Perhaps. What actually happened is that we have a demented interior minister in a unbelievably corrupt but also pro-russian government. So it's really anybodys guess if it's just pure corruption (the interior ministry wanting to buy some traffic cameras and someone bribing to get the contract while buying the cheapest they could find which were these russian ones) or indeed some covert russian operation (the responsible minister wouldn't know about it, he's too dumb for that, but there might be other government people who did know). In any case in a functioning state this would end up with the minister leaving his post at least. Not in Slovakia.
tokai 5 hours ago
It seems like a silly mess. But its easier than it sounds to end up in such a situation. We're are a lot of HN Kagi users that just have to trust that the Yandex collaboration is fully watertight.
ojciecczas 3 hours ago
Fits perfectly in the russian thinking scheme, always infiltrating their neighbours and trying to get more. Fucking parasites.
shevy-java 2 hours ago
The problem I see is that Putin fully committed to the war. It is not only clear that he has no interest in ending the war, despite the lip service, but will continue to create problems and cause issues. This backdoor here is not an isolated problem - it is a systemic, concerted problem. All retaliatory moves are handicapped by orange Agent Krasnov being an asset for Russia. The EU needs to stop outsourcing its security. That includes having a nuclear arsenal available for all member states.
koonsolo 3 hours ago
It wouldn't surprise me if the Russian misinformation inside Slovakia is able to spin this into an anti-EU, anti-Ukraine story.
lifestyleguru 5 hours ago
Slovakian prime minister is doing proud photos with Putin despite the ongoing war so the backdoor looks like a desired feature not a bug or fuck up.
irishcoffee 6 hours ago
Next up, chinese solar inverter firmware.
hansoolo 4 hours ago
Do they even need that since, when most of the converters are attached to the Chinese cloud?
irishcoffee 3 hours ago
I made the logical leap that the firmware enables this. I don’t have the code in front of me, so that may have been an incorrect leap.
victorbjorklund 6 hours ago
To do what? Turn off the power in random individual houses?
jwr 4 hours ago
I think synchronized operations could really disrupt the grid — think thousands of inverters switching backfeeding to the grid on/off, causing waves and disruption. Or thousands of inverters having their grid sync disabled, simultaneously operating to shift the frequency of the grid (very bad).
wongarsu 6 hours ago
I'd be worried about the inverters in large commercial solar plants. On a sunny day you could easily cause a blackout by turning enough solar capacity off at once. Maybe shut down the entire grid when the sudden power imbalances trip the self- protection in half the grid. That's a pain to recover from. Spain went through that not too long ago
But maybe rapidly switching residential solar on and off in a coordinated way can also do funny things to grid equipment
rollulus 6 hours ago
Any idea what happens to the grid when a significant chunk of solar power suddenly disconnects?
victorbjorklund an hour ago
hsuduebc2 4 hours ago
Spooky23 an hour ago
If you had enough systems under control in an area, you could probably create a brown out or some other type of scenario by turning off 1000 houses on the right day.
nom 5 hours ago
nah, the ones connected to the grid... you turn them all off during peak sun hours at the exact same time
same issue with large loads like boilers, this stuff should never be connected to the internet, but it is
if you can control enough load on the grid you can do real damage
randoot 6 hours ago
DDoS, anonymizer proxy, and turn off power in large commercial installations. They kinda deserve it for investing in solar. US holds all the power in social media, can't blame China if they want to utilize their lead in solar for something too.
Hopefully mutually assured annoyance keeps everyone at bay.
bdhdhduuyd 6 hours ago
To set roofs on fire?
In the end it's all about trust. Right now I don't see why China would like to burn down their market.
cyanydeez 6 hours ago
emdash 6 hours ago
Some of those are networked I think?
tomas789 5 hours ago
vkou 4 hours ago
To piss away decades of hard-earned trust in its products for some short-term one-time political 'pwn' of the enemy.
If that goal sounds stupid to you, that's because it is. I would expect some countries that are not China to act with such a capricious lack of foresight.
irishcoffee 3 hours ago
newsclues 6 hours ago
Track usage patterns to know when people are at home and then rob them.
2OEH8eoCRo0 6 hours ago
The HN version of "I have nothing to hide."
giancarlostoro 6 hours ago
LogTrim 6 hours ago
The detail that gets me is the Ministry saying the cameras were safe because they'd be on a closed network, while the backdoor can apparently be triggered via SMS from hardcoded phone numbers.
That's a pretty good demonstration of why "it's not exposed to the internet" isn't a security boundary if the device itself has an out-of-band communications path.
Add Secure Boot being disabled and unauthenticated live streams and this seems less like one unfortunate backdoor and more like nobody established what the trust boundary was supposed to be in the first place.
PinkSheep 2 hours ago
"Not exposed to the internet" means exfiltration is hard in this case. If I were to dream about defense in depth, these SIM cards should be monitored for traffic anyway or have filtering rules at carrier level. Because at the end of the day, Russian numbers or not, mobile networks are insecure.
yodon 5 hours ago
Zero chance of vulns in flock, so we're good in the US /s
juliusceasar 4 hours ago
Russia to Slovakia is Israel to USA. Puppet state.
toasty228 4 hours ago
Most people talking about Slovakia wouldn't even be able to put it on a map or know what currency they use, but they become instant geo political expert.
They don't even know how to pronounce Fico properly... Give me a break lmao
juliusceasar 3 hours ago
That is your argument? Omg, the level of it...