382
this post was submitted on 06 Nov 2025
382 points (99.7% liked)
World News
50674 readers
3174 users here now
A community for discussing events around the World
Rules:
-
Rule 1: posts have the following requirements:
- Post news articles only
- Video links are NOT articles and will be removed.
- Title must match the article headline
- Not United States Internal News
- Recent (Past 30 Days)
- Screenshots/links to other social media sites (Twitter/X/Facebook/Youtube/reddit, etc.) are explicitly forbidden, as are link shorteners.
- Blogsites are treated in the same manner as social media sites. Medium, Blogger, Substack, etc. are not valid news links regardless of who is posting them. Yes, legitimate news sites use Blogging platforms, they also use Twitter, Facebook, and YouTube and we don't allow those links either.
-
Rule 2: Do not copy the entire article into your post. The key points in 1-2 paragraphs is allowed (even encouraged!), but large segments of articles posted in the body will result in the post being removed. If you have to stop and think "Is this fair use?", it probably isn't. Archive links, especially the ones created on link submission, are absolutely allowed but those that avoid paywalls are not.
-
Rule 3: Opinions articles, or Articles based on misinformation/propaganda may be removed. Sources that have a Low or Very Low factual reporting rating or MBFC Credibility Rating may be removed.
-
Rule 4: Posts or comments that are homophobic, transphobic, racist, sexist, anti-religious, or ableist will be removed. “Ironic” prejudice is just prejudiced.
-
Posts and comments must abide by the lemmy.world terms of service UPDATED AS OF OCTOBER 19 2025
-
Rule 5: Keep it civil. It's OK to say the subject of an article is behaving like a (pejorative, pejorative). It's NOT OK to say another USER is (pejorative). Strong language is fine, just not directed at other members. Engage in good-faith and with respect! This includes accusing another user of being a bot or paid actor. Trolling is uncivil and is grounds for removal and/or a community ban.
Similarly, if you see posts along these lines, do not engage. Report them, block them, and live a happier life than they do. We see too many slapfights that boil down to "Mom! He's bugging me!" and "I'm not touching you!" Going forward, slapfights will result in removed comments and temp bans to cool off.
-
Rule 6: Memes, spam, other low effort posting, reposts, misinformation, advocating violence, off-topic, trolling, offensive, regarding the moderators or meta in content may be removed at any time.
-
Rule 7: We didn't USED to need a rule about how many posts one could make in a day, then someone posted NINETEEN articles in a single day. Not comments, FULL ARTICLES. If you're posting more than say, 10 or so, consider going outside and touching grass. We reserve the right to limit over-posting so a single user does not dominate the front page.
We ask that the users report any comment or post that violate the rules, to use critical thinking when reading, posting or commenting. Users that post off-topic spam, advocate violence, have multiple comments or posts removed, weaponize reports or violate the code of conduct will be banned.
All posts and comments will be reviewed on a case-by-case basis. This means that some content that violates the rules may be allowed, while other content that does not violate the rules may be removed. The moderators retain the right to remove any content and ban users.
Lemmy World Partners
News !news@lemmy.world
Politics !politics@lemmy.world
World Politics !globalpolitics@lemmy.world
Recommendations
For Firefox users, there is media bias / propaganda / fact check plugin.
https://addons.mozilla.org/en-US/firefox/addon/media-bias-fact-check/
- Consider including the article’s mediabiasfactcheck.com/ link
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Ok this sounds bad, but I have a question...
Was the camera system accessible from the internet?
If not, this issue is far too overblown.
Usually, there's a network for IP cameras, with a central server holding the video. There's then, usually, a firewall to anything outside that, and frequently just a hardline to a monitoring system. (another computer with lots of monitors, typically.)
Most modern systems can VPN to the firewall and run a client there via remote desktop, and then access the monitoring system that way; but the server itself is not.
As to the complexity of the password, typically there's different levels of permissions. The basic ones would just let you monitor real time, probably review recordings, and maybe rip those recordings. (but not change settings, or otherwise delete anything.) A place like the Lourve would have multiple guard stations connecting in on the local network; with dozens of guards watching cameras at any given time; and would each need their own account/logins if you wanted to make the password actually complex.
a large part of the problem is just the sheer amount of people that would need to have acounts- the lourve says they have ~1300 'reception and security' staff. (for the record, reception would also be part of the security envelope... though they probably wouldn't need the password.)
anyone dialing in from off sight would likely have their own password (and have elevated permissions to allow that.). Frequently, by remote desktoping into a system on the local network.
You'll also notice theyre not saying the security system was actually compromised- even if the cameras were pointed the right way, they'd still have gotten in and out because the windows were a point of vulnerability. They might have been able to respond faster, but they were in and out in ten minutes. a camera wouldn't be able to stop that, if you account for normal human reaction times... if they'd even notice the 'contractors'.
Also, this was found by an audit years ago. Doesn't mean it was fixed, but doesn't mean it was still the same during or after the theft.
At least it wasn’t the default password.
I’ve known clients that have never removed the default admin account, with a default admin password… and looked at me like I had a horn growing out my ear…
I'll admit it, I have systems at work with weak or default passwords. But they don't handle any sensitive information, and exploiting them wouldn't get you any additional privileges on the network.
that's just it... any vulnerable system lets them get their nose in the door, then the camel starts snooping around the tent for whatever it can get. Eventually, they find away to something juicy.
The thing is, whether we're talking about digital or physical security, the weakest thing in any system is the humans. The sloppy passwords (c'mon it should have been Louvre25! lol.) is a human thing. clicking that phising scam is a human thing. kipping off to the egyption bedroom for tryste with receptionist is a human thing.
the simple password isn't the problem. The people being complacent is.
Until someone figures out how to use this non critical system to exploit other parts of your network. An ssh shell on an internet connected coffee machine in a bank would make a great starting point to gain access to more critical systems for example.
There was a story a few years back about a casino getting hacked through a smart thermometer in a fish tank.
the Target hack went in through the HVAC system.
I hate to say it man, but this assumes someone is going above and beyond to lock down the cameras.
I used to have a milestone implementation where I work. There was a security PC in a security office that has the cameras on and always logged in but nobody shuts down requests for camera access for other users. The flimsiest of justification is all that is necessary for the highest level of leadership to give the go ahead. We do manufacturing and everyone thinks these low quality grainy security cameras are a replacement to going on the floor and actually watching how things are working so dozens of non-security people had access.
When I started everybody was using the same local account to log in. I migrated us to AD authentication (with exception of the security PC) but anybody could still technically reach the camera system from the network.
Absolutely anybody could just enter the IP of a camera on the network though and view what it sees. Every camera had default passwords. We even had some fun brands like Hikvision that were banned in 2022 by the FCC. We had a firewall from the outside world, but a guest network that was not isolated at all.
We've migrated to a different solution that cost hundreds of thousands of dollars and over a year of replacing cameras, but still probably a third of people in the org have access to the cameras for bullshit reasons and leadership doesn't care to shut it down. Thankfully none of them are admins and nobody but myself and a couple of others have any kind of admin level permissions now, but my point is that it's the wild west out there in terms of IT processes... and often Shadow IT from groups like a security team that isn't truly tech-savvy ends up running something like this.
If money didn't flow like water due to a total lack of purchasing controls and nobody complaining about expenditure at the time, we'd still be using the same old security cameras. I can't imagine the Lourve having much of a budget. museums are run like shitty nonprofits and are held together with string and bubblegum in the US.
This, Camera are useless at stopping/preventing crime. Thanks to the Camera 5 persons have been charged and wait their trial in jail but camera won't prevent a jackasss to steal something in a museum