Thread by @robertgraham

So as a techy, I want to comment on this. Hikvision cameras do have issues -- such as phoning home to the Amazon cloud.

https://twitter.com/stewartbaker/status/1017150612549570562

Streaming video from a home surveillance camera to your mobile phone is tough because both sides have firewalls blocking incoming connections. So instead, both create outgoing connections to Amazon cloud, which then passes video from one to the other.

What's going on here isn't clear in the product description. All you, the user, know is that you an use your app to stream video from your security camera.

It's also usually all encrypted with SSL/HTTPS, so you don't have visibility into exactly what it's sending to the cloud. Though, you can tell if it's currently streaming or not, purely by volume of traffic.

Not all cameras do this, but sending encrypted data to cloud servers is such . normal thing it wouldn't immediately be evidence of something malicious.

Streams to the cloud aren't end-to-end encrypted, which means when you stream to your phone, they can grab a copy of it, with no evidence they've done so.

However, if all you want are internal streams, you can microsegment and firewall the cameras so there's little chance of "phoning home to China".

BTW, when masscanning the Internet, Hikvision cameras are one of the more popular devices I find exposed to the Internet -- because of the difficulty of getting video streams through firewalls, they are left exposed by default.