<story><title>0day vulnerability in firmware for HiSilicon-based DVRs, NVRs and IP cameras</title><url>https://habr.com/en/post/486856/</url></story><parent_chain><item><author>whalesalad</author><text>When you see how small some of these devices are it makes you realize how easy it would be for a malicious actor to bug just about anything you own. A simple cell phone charger becomes a listening device that could have an LTE modem hiding in it.&lt;p&gt;People are worried when they find a raspberry pi sitting in the network rack - and rightfully so - but fail to realize that you can achieve pretty much the same thing by hiding in plain sight.&lt;p&gt;Imagine how much you could fit into a 6-port commodity surge protector.</text></item></parent_chain><comment><author>Zenst</author><text>&amp;gt;  A simple cell phone charger becomes a listening device that could have an LTE modem hiding in it.&lt;p&gt;You can already get USB cables that have a hidden mic and sim, so if powered you can phone up and listen in.  Those a very cheap and google shows this, but this is more adventurous.&lt;p&gt;As for targeting hardware and security - how many people would question a fancy free mouse or keyboard arriving in the internal post as it happened to of been dropped of at reception.  Great pentesting trick btw.&lt;p&gt;As for chips with `hidden&amp;#x2F;undocumented` remote activated features.  If it was documented, would it be bad or something you can use or actively block off.  When they are undocumented, well - hard not to think the worst.  But then, CPU&amp;#x27;s today, not fully documented when you can&amp;#x27;t hack away at the microcode and management and whatever else is DRM&amp;#x27;d out of your reach.&lt;p&gt;If Intel was a Chinese company instead of American - how would Americans feel about Intel chips?  That is an interesting thought exercise.</text></comment>
<story><title>0day vulnerability in firmware for HiSilicon-based DVRs, NVRs and IP cameras</title><url>https://habr.com/en/post/486856/</url></story><parent_chain><item><author>whalesalad</author><text>When you see how small some of these devices are it makes you realize how easy it would be for a malicious actor to bug just about anything you own. A simple cell phone charger becomes a listening device that could have an LTE modem hiding in it.&lt;p&gt;People are worried when they find a raspberry pi sitting in the network rack - and rightfully so - but fail to realize that you can achieve pretty much the same thing by hiding in plain sight.&lt;p&gt;Imagine how much you could fit into a 6-port commodity surge protector.</text></item></parent_chain><comment><author>adrianpike</author><text>Glade plug-ins are innocuous, roomy inside, and have convenient constant 120v.&lt;p&gt;Take a peek next time you&amp;#x27;re in a semi-public space if there&amp;#x27;s any that are suspiciously not-smelly.</text></comment>