Login
You're viewing the dmv.community public feed.
  • The Sleight Doctor 🃏🍉ApostateEnglishman@mastodon.world
    Oct 14, 2026, 1:35 PM

    @cyberquixote It's scary. I've temporarily seized control of a CCTV camera in the states, just to demonstrate to colleagues how easy it is. I could spin, tilt, and zoom - full control from an office in England. All I did was find a vulnerable internet-facing device using Shodan...and looked up the default admin password. A child could do it.

    What if I hadn't just been making a point? What if it had been a camera in someone's bedroom? Or a control system that was part of, say, a power plant? 🤯

    💬 1🔄 1⭐ 0

Replies

  • Cycy@fedicy.us.to
    Oct 14, 2026, 3:08 PM
    "You'll be able to remove the reactor core's cooling rods from the convenience of your cell phone!"

    "Wow!"
    💬 1🔄 0⭐ 0
  • The Sleight Doctor 🃏🍉ApostateEnglishman@mastodon.world
    Oct 14, 2026, 3:16 PM

    @cy I mean, probably not. But then again, look up the Lake Risevatnet Dam attack that happened in Norway, 2025. This was only possible because the web-based control panel used by engineers was connected to the public internet, rather than an isolated network.

    Which is, as we're discussing, completely insane.

    @cyberquixote

    💬 1🔄 1⭐ 0
  • Cycy@fedicy.us.to
    Oct 14, 2026, 3:24 PM
    Ah yes web-based controls, one of the first excuses to break your security. These days they just tell you the panel is controlled by an app. And what are you going to do, not have controls on your dam?

    These days children have to have an app to be allowed to attend school. And all my medical records are authorized with an app. They even have an iPad to lend to people (me) who don't have a cell phone. It's just ludicrous.
    💬 1🔄 0⭐ 0
  • The Sleight Doctor 🃏🍉ApostateEnglishman@mastodon.world
    Oct 14, 2026, 3:43 PM

    @cy Right - and as I probably don't have to explain to you (given that you have a PGP key in your bio!), these sorts of control systems are often sitting ducks even if the default admin password isn't publicly available to those who know how to do an advanced search.

    Many of them will readily succumb to an automated brute force attack using one of the several password-cracking tools packaged with Kali, BlackArch etc.

    'Cos they're not indexed by regular search engines, so the security is lax. 🫣

    💬 1🔄 1⭐ 0
  • Cycy@fedicy.us.to
    Oct 14, 2026, 4:18 PM
    One of these days I'll find someone else with a PGP key in their bio 🤞
    💬 0🔄 0⭐ 0