FOSCAM cameras compromised. Affected models should be disconnected.

In a press release yesterday afternoon, Foscam officially announced their branded cameras manufactured by China-based Shenzhen Foscam have severe security vulnerabilities “which leave users vulnerable to hacks which allow attackers to remotely take-over cameras, live stream, download stored files and even compromise other devices located on the local network.”

Foscam recommends “disconnecting your current Foscam branded cameras from the internet until these issues have been resolved”

The models affected are:

  • Foscam R2
  • Foscam C1
  • Foscam C1 Lite
  • Foscam C2
  • Foscam FI9800
  • Foscam FI9826P
  • Foscam FI9828P
  • Foscam FI9851P
  • Foscam FI9853EP
  • Foscam FI9901EP
  • Foscam FI9903P
  • Foscam FI9928P

“The vulnerabilities affect “Foscam” branded cameras and cameras manufactured by China-based Shenzhen Foscam only. The vulnerabilities DO NOT affect Amcrest or FDT branded cameras which are produced by a separate factory and R&D team led by US-based Amcrest (formerly Foscam US and now Amcrest), which is totally unrelated to China-based Shenzhen Foscam.”

There is a damning report by FSecure [.pdf download] on the exact vulnerabilities found on the affected Foscam cameras. For starters, there’s hidden Telnet functionality, hidden hard-coded credentials for the web user interface, the FTP server account to the cameras have a hard-coded password, and the configuration back-up file is protected by hard-coded credentials. Any one of those is a very bad thing, but for all of those hard-coded backdoors to be on every camera system and on all models coming from one location? “Suspicious” would be a kind word.

Like I ranted about master passwords and again on master backdoors, hardware and software with embedded hard coded and/or universal master passwords are a big problem. Regardless of the original intent of having a master password and/or backdoor, once that “core” password gets out, that product is now fair game for anyone for any purpose anywhere anytime.

Good thing everyone on the internet is kind and rational. Oh, wait, that was just that one day back in 1989. Nevermind.

Wouldn’t a Universal Basic Income depend heavily on the “kindness of strangers” to work?

So here I am, late on Saturday night, waiting from remote for one final server to reboot, when I started thinking about Universal Basic Income.

Maybe it’s the coffee.

Anyhow, the more I thought about it, the more I wondered how a Universal Basic Income would work without the “kindness of strangers”.

Here’s my two cents… and five big problems.

Problem #1: Assuming UBI is granted for everyone who makes under $500k annually, and let’s say just as a hypothetical the UBI is set at $12,000 annually, what’s going to stop employers from deducting the total UBI ($12k in this scenario) from all employee paychecks? I can already hear the… “You’re still making $40k annually! What’s the problem? So we’re paying you $28k instead of $40k, but what’s the big deal? You’re still getting $40k annually with UBI factored in. And, hey, you now pay less taxes since your take-home is less! We need that $12k per to invest and build our business!” Companies will get a spike in their bottom line deducting the UBI rate per employee and the employees are gaslighted into thinking that’s OK.

Problem #2: Again, assuming the UBI is set at $12k, what’s to stop rent and housing increases? Landlords can set the low-end roach infested hole in the walls that were around $400 to the current small one-bedroom rate ($800-$1k) since “everyone can afford that with UBI”, and everything above that level will skyrocket in price. Home ownership will also be affected by this renting spike to keep the “investment” of owning a home more valuable than renting.

Problem #3: Taxation. Let’s say someone invests a significant percentage of their UBI in a profit making enterprise. Does the government get to collect tax assuming the UBI was non-taxable to start with? Or will the proceeds from a UBI funded enterprise be treated as “additional income”?

Problem #4: UBI scams. You see all the title company loan and “settlement cash now” kinds of commercials all over the place. A borrow-against futures industry that’s not well regulated and geared toward taking advantage of the uninformed and those with poor money management skills. What’s to stop this industry from focusing on setting up a “borrowing against the UBI” system? I can hear this too… “We will advance you $24k for your next two years of UBI today! Get the money you deserve now! Don’t worry about the 170% interest.” A much deeper financial trap will be possible with the existing non-regulated borrow-against the futures industry still running wild.

Problem #5: Retirement and death. Would a UBI be factored into retirement / social security plans? Assuming someone works to retirement age and draws from their Social Security fund as well as any Roth or 401k investments, will that individual still be eligible for UBI? And if someone dies before retirement age or of unnatural causes, would UBI be treated as a benefit to their surviving family as social security is now? Or would UBI be a “living” benefit only?

Of course, none of these things might happen, but they all tie into my original “kindness of strangers” (IE: employers and the government) concern. With automation and AI gaining traction at an exponential rate, though, something like UBI needs to be in the works to stave off the mass unemployment rate that will arrive in our lifetime.

It’s time for a TRUTH : CLIMATE ad campaign

I remember the days when smoking a cigarette was very common. Lighting up in a bar or at a restaurant was no big deal. You could even smoke at your desk at work! 

Try lighting a cigarette in any of those places now. 

In today’s society, smoking is seen as something completely unacceptable. A big of that shift was a relentless barrage by the American Lung Association and the “truth” ad campaign.

Despite the dominant shift in the acceptance of social smoking, the “truth” ad campaign is still ongoing, with this as one of their most recent commercials.

With all the recent problems on climate change, I think it’s time for a “Truth : Climate” ad campaign.

Too many people are entrenched on both sides of the climate change issue, with neither side willing to budge. Aside from the problem of the widening chasm and open hostilities, the core problem is that until there is a clear and overwhelming majority on one side, no progress can be made. The stalemate will fester and rot away part of our collective souls.

NY, WA and CA just announced a pact among their states to back the Paris Climate Accord of their own volition. Seed money for a nationwide  “Truth : Climate” ad campaign could start with them. Create and release a relentless nationwide onslaught of hard fact ads with a focused single point in each to inform and educate those who are against the Paris Climate Accord.

Of course, those that believe the climate change is all a big worldwide hoax should form their own group to inform and educate scientists and climatologists on their folly. Like the old saying goes, what’s good for the goose is good for the gander.

Until there is a complete and overwhelming societal shift on how climate change is (or is not) affecting us, we will be stuck at a stalemate that benefits neither side. It can be done. Just try lighting a cigarette in a restaurant to see what happens with a persistent educational push for societal change.

One Login password manager hacked

If you use One Login for your password storage, get ready for a bad weekend. The company announced their services have been hacked.

In an article on Ars Technica, the company said hackers compromised “customer data… including the ability to decypt encrypted data”.

If you have used One Login to save your passwords, you need to go through what you saved with them and change your password for all accounts they have.

On a side rant, using an online password manager is always a bad idea. Sure, it is convenient, but that also makes it a much bigger target for the bad guys. Thousands of unique bank accounts, account passwords and “real world” information like social security numbers and home security codes all in one place? I recommend using a local offline password manager instead.

New research site shows your city and state spending

There’s a new website that lets you check on the demographics, government spending, financial overview, debt, and general information of any city and/or state in the United States.

Head over to cleargov.com and type in any place you want information about. Some locations will have multiple years to choose from and additional information available if you are a government employee.

According to the information on the “about” page, the site was “launched in June of 2015 with the goal of helping average citizens better understand how their tax dollars are spent and how their local government is performing. Our vision is that through better understanding citizens will want to get more involved in their local government and help drive positive change.”