Hack My House: Opening Raspberry Pi to the Internet, but Not the Whole World

If you’ve followed along with our series so far, you know we’ve set up a network of Raspberry Pis that PXE boot off a central server, and then used Zoneminder to run a network of IP cameras. Now that some useful services are running in our smart house, how do we access those services when away from home, and how do we keep the rest of the world from spying on our cameras?

Before we get to VPNs and port forwarding, there is a more fundamental issue: Do you trust your devices? What exactly is the firmware on those cheap cameras really doing? You could use Wireshark and a smart switch with port mirroring to audit the camera’s traffic. How much traffic would you need to inspect to feel confident the camera never sends your data off somewhere else?

Thankfully, there’s a better way. One of the major features of surveillance software like Zoneminder is that it aggregates the feeds from the cameras. This process also has the effect of proxying the video feeds: We don’t connect directly to the cameras in order to view them, we connect to the surveillance software. If you don’t completely trust those cameras, then don’t give them internet access. You can make the cameras a physically separate network, only connected to the surveillance machine, or just set their IP addresses manually, and don’t fill in the default route or DNS. Whichever way you set it up, the goal is the same: let your surveillance software talk to the cameras, but don’t let the cameras talk to the outside world.

Edit: As has been pointed out in the comments, leaving off a default route is significantly less effective than separate networks. A truly malicious peice of hardware could easily probe for the gateway.

This idea applies to more than cameras. Any device that doesn’t need internet access to function, can be isolated in this way. While this could be considered paranoia, I consider it simple good practice. Join me after the break to discuss port forwarding vs. VPNs.

Continue reading “Hack My House: Opening Raspberry Pi to the Internet, but Not the Whole World”

Hack My House: ZoneMinder’s Keeping an Eye on the Place

Hacks are often born out of unfortunate circumstances. My unfortunate circumstance was a robbery– the back door of the remodel was kicked in, and a generator was carted off. Once the police report was filed and the door screwed shut, it was time to order cameras. Oh, and record the models and serial numbers of all my tools.

We’re going to use Power over Ethernet (POE) network cameras and a ZoneMinder install. ZoneMinder has a network trigger capability, and we’ll wire some magnetic switches to our network of PXE booting Pis, using those to inform the Zoneminder server of door opening events. Beyond that, many newer cameras support the Open Network Video Interface Forum (ONVIF) protocol and can do onboard motion detection. We’ll use the same script, running on the Pi, to forward those events as well.

Many of you have pointed out that Zoneminder isn’t the only option for open source camera management. MotionEyeOS, Pikrellcam, and Shinobi are all valid options.  I’m most familiar with Zoneminder, even interviewing them on FLOSS Weekly, so that’s what I’m using.  Perhaps at some point we can revisit this decision, and compare the existing video surveillance systems.

Continue reading “Hack My House: ZoneMinder’s Keeping an Eye on the Place”

Hack My House: Running Raspberry Pi Without an SD Card

Many of us have experienced the pain that is a Raspberry Pi with a corrupted SD card. I suspect the erase-on-write nature of flash memory is responsible for much of the problem. Regardless of the cause, one solution is to use PXE booting with the Raspberry Pi 3. That’s a fancy way to say we’ll be booting the Raspberry Pi over the network, instead of from an SD card.

What does this have to do with Hacking My House? As I discussed last time, I’m using Raspberry Pi as Infrastructure by building them into the walls of every room in my house. You don’t want to drag out a ladder and screwdriver to swap out a misbehaving SD card, so booting over the network is a really good solution. I know I promised we’d discuss cabling and cameras. Think of this as a parenthetical article — we’ll talk about Ethernet and ZoneMinder next time.

So let’s dive in and see what the Preboot Execution Environment (PXE) is all about and how to use PXE with Raspberry Pi.

Continue reading “Hack My House: Running Raspberry Pi Without an SD Card”

Hack My House: Raspberry Pi as Infrastructure

I finally had my own house. It was a repossession, and I bought it for a song. What was supposed to be a quick remodel quickly turned into the removal of most of the drywall in the house. There was a silver lining on this cloud of drywall dust and loose insulation. Rather than constantly retro-fitting cabling and gadgets in as needed, I could install everything ahead of time. A blank canvas, when the size of a house, can overwhelm a hacker. I’ve spent hours thinking through the infrastructure of my house, and many times I’ve wished for a guide written from a hacker’s perspective. This is that guide, or at least the start of it.

What do you want your smart house to do? And what do you want to be able to do in your smart house? For example, I wanted to be able to upgrade my cheap 120 V welder to a beefier 240 V model, so adding a 240 V plug in the garage was a must. As a bonus, that same 240 V circuit could be used for charging an electric car, if ever one is parked there.

“Ethernet everywhere” was my mantra. Try to imagine everywhere you might want to plug in a desktop, a laptop, an access point, or even a VoIP phone. I decided I wanted at least two Ethernet drops to each room, and tried to imagine the furniture layout in order to put them in convenient places.

Continue reading “Hack My House: Raspberry Pi as Infrastructure”