Thieves Hacking Security Cameras?

The FBI is investigating fifteen store robberies in eleven states, committed via phone and internet. The perpetrators hack the store's security system so they can observe their victims. They then make customers take their clothes off and get the store to wire money. From the article, "A telephone caller making a bomb threat to a Hutchinson, Kan., grocery store kept more than 100 people hostage, demanding they disrobe and that the store wire money to his bank account. ... officials were investigating whether the caller was out of state and may have hacked into the store's security system. "If they can access the Internet, they can get to anything," Hutchinson Police Chief Dick Heitschmidt said. "Anyone in the whole world could have access, if that's what really happened.""

Dumber than dumb

[BobTheLawyer]

Has there ever been a more stupid quote than:

"If they can access the Internet, they can get to anything," Hutchinson Police Chief Dick Heitschmidt said. "Anyone in the whole world could have access, if that's what really happened."

Re:Dumber than dumb

[Anonymous Coward]

Not TOO far from the truth. Often the security cameras are accessible to anyone with a browser and without password protection or with a password that's ridiculously easy to guess.

Internet security system ..

[rs232]

"officials were investigating whether the caller was out of state and may have hacked [kpho.com] into the store's security system"

"If they can access the Internet, they can get to anything"

"Anyone in the whole world could have access, if that's what really happened"

What kind of idiot would connect the security system to the Internet so that 'they' could get to anything. Didn't they put it on a private VPN or use a password even?

"The FBI was looking into whether the calls to the banks and stores were being placed from overseas"

I thought DCSNet [slashdot.org] was designed to provide instant access to such information. Provides absolutly no evidence of any such hacking. Sounds to me like a low level extortion plot apart from the mention of the (scary) Internet and hackers (even more scary). Since when do sophisticated thieves use Western Union and wire themselves $3,000 with a $150 service charge. Who paid the charge I wonder.

We get bomb threats here all the time, so don't take any notice ...

"hacked" by simply using Google?

[Speare]

There are many store monitor camera systems that are installed with poor defaults and wide open access. Several makers' web interfaces have easy formulaic URLs to select different store views, and these commonly can be searched with plain old web search engines. This was a fun thing to do a few years back, with whole sites dedicated to lists of web cams that were likely not intended for global viewership. Without any real evidence that the web cameras were "hacked" I think it's a big stretch to assume any skill was involved here.

Re:CCTV

[Lumpy]

Although it is possible to hack these systems, it is a remote chance if configured properly like anything else.

They rarely are. as a Technology specialist company that also does cameras, we find that 9 times out fo ten the default passwords are set for the administration access of the DVR and even the IP cameras.

Out of the last 35 jobsites over 30 of them still had defaults set that would allow access in one way or another. Yes these were installed by "professional companies". some of them had administrator password changed but the guest / user account was still wide open.

Re:Duh

[Opportunist]

That's no wonder. What happens here is the combination of some unhealthy factors.

1. The cheapest guy gets the job. Now, the cheapest is never the best, and rarely even good enough to actually do it good.
2. As soon as it "works", stop working on it. As soon as the picture somehow appears on the screen of the manager, he's satisfied. He does not care about whether someone else can see it. If he is, his wannabe-admin will lie to him because he'd have to fix it in his (unpaid) overtime and the manager can't test it anyway.
3. The admin does not care. Even if he did (and why the hell should he?), he cannot. He does not know what dangers lurk in the shadows. He goes by try and error to patch the thing together somehow, i.e. he runs into an error, copy/pastes the error message into Google and goes from there.

Re:Why were they made to disrobe?

[Random832]

Probably testing the waters (i.e. make sure they're intimidated into doing whatever the thieves say) before giving them bank account information to do the wire transfers.

Re:Dumber than dumb

[5KVGhost]

I don't see anything controversial about that case. If you actively participate in a violent crime and someone dies then you're just as responsible as the person who pulls the trigger. Don't want to be responsible for a murder? Then don't be a getaway driver for a gang of doped up armed robbers. It's not difficult.

One of the dumber scams I've ever read about

[Master of Transhuman]

Yeah, wire me the money - I'll get it someday when the police aren't looking...

This was a hoax, a prank. Somebody was just having fun jerking people around.

And see how easy it was. Anybody remember the Chinese Fire Drill in the book "Illuminatus?" Act authoritative - or threatening in this case - and spew out some orders, and everybody falls right into line like lemmings.

The first response to the bomb threat should have been, "Fine - set it off. We'll settle up later, asshole."