NEST cam review and warning

[The Original Ralph]

background, i used to have a few security cameras set up, early 2000s, and when they worked, they were decent but difficult to set up, and when they'd go offline, a pain to have to reset, and it happened a lot.

Got to looking around and found the NEST wifi IP cameras on amazon, and it was the only brand of security cam with an incredible number of 5 star reviews - iirc, 2900 reviews with 98%+ being five starts. Got it, after the physical installation, it took a total of 10 minutes to configure for someone with "fred flintstone" computer skills - decent image (1920x1080) with some neat features: two way audio comm (but not full duplex), push notifications to my cellphone when motion or sound is triggered. Then the negatives - NEST makes it cameras first stream your video upstream to their server and then back to your computer. Hellacious bandwidth use, plus you cannot record video at your computer or NAS - they want you to subscribe to their cloud storage ($100 annual) - IF YOU DON'T, YOU LOOSE the motion detection & alerts, the two way communications and a couple of other features, leaving you only with a live stream video.

Even with the two way comm, it's basically, effectively worthless - when there's someone at the door, i have to hit the microphone icon to talk to them, which de-activates the microphone at the camera - but it does sound a chime note which makes the visitor look up at the camera. But as the stream first goes to Nest's server, it takes 2 seconds for the sound to reach the camera's speaker. I have to release the microphone icon for the microphone at the camera to activate. But the problem is, the visitor has to wait until a 2nd chime sounds, before speaking - and they don't know this. So i'll see their lips moving but not hearing what they're saying - i end up having to add the instruction to them to wait until they hear another chime before speaking. Too much hassle and i end up going to the door to tell the magazine salesman, Jehovah's witnesses etc to go away.

One neat feature was that when that chime at the Ft door would sound, instinctively the visitor would look up to see what was making the noise, so the camera would get a good shot of their face.

Then yesterday I was talking to a friend that works in gov't, something to do with surveillance, and he told me "when we find a target using a NEST camera, we're happy - real easy to hack into their computer thru the NEST cam".

Even after the 30 day subscription ends, the camera still streams to NEST, so apparently NEST/Google is saving/collecting data from the video stream. As google owns NEST, i assume this data is handed over to the NSA to add to their collection.

It's a shame as the ease of set up, and the features were selling points

and btw, i tried Blue Iris and it has to pull the video stream from NEST which is how i learned the video feed still streams to the NEST server after the 30 day trial cloud subscription, and Blue Iris can't stream/capture/save the audio (either way) at all unless i upgrade to win 10 and use microsoft edge - apparently it needs "RTMPS" streaming capability which win 7 and Firefox do not have.

SO now i'm on the hunt for a setup that is completely wired, with it's own NVR & display that will stay off my network and isolated from the internet.

 

[c4s2k3]

Thanks for the review. I've been looking to add a couple of IP cameras to my house and have been disappointed to find this growing trend of "cloud" streaming as a requirement. It's one thing to require cloud services for full functionality (which BTW makes such products security non-starters for me), but it's even more distressing to see that some newer camera models do not even properly implement simple http or rtsp streaming anymore, making them useless to stream to your own local camera server. Some models are strictly tailored to be used with their proprietary mobile apps, making any use with a PC-based server an afterthought at best. Many of these cameras are cheap, and clearly aimed at people who just want to use their phones/tablets to access the camera.

I understand the "cloud" is a simple way to allow access to the camera from anywhere for an average consumer. I (and I'm sure many others on Tom's) have no problem configuring my router and port forwarding to access a camera inside my network but this is beyond most people's ability or knowledge. Many don't don't actually manage their own networks, as their ISP's provide everything. Since UPnP is almost universally available, this is a legitimate use case for cloud-based streaming. Nothing wrong with trying to cater to a particular demographic, but it seems to me they could easily broaden their user base by properly implementing more traditional local streaming in addition to whatever they implement for their own apps and cloud services. I suspect some of these new cameras actually do implement local streaming but finding how to get to it is like pulling teeth. The manufacturer simply does not want you to know.

I've tried a couple of these cameras recently and as I said, they are *cheap* One seemed to have a more complete web-based management UI and seemed to have http and rtsp streaming, then found it still connects to their own "cloud" and requires you to register an account and attempts to connect to the manufacturers servers on its own. Disappointing from a security perspective to be sure.

The second one was much worse. Nice small, simple camera decent Amazon reviews that indicated it also had a web-based configuration UI and local streaming. Once I received it I found it had neither one of those features. Some research revealed the camera used to have web UI and local http/rtsp streaming but, they deliberately removed them with firmware updates. This obviously left some existing customers who were using them to stream to local servers very unhappy. Whatever hardware/software these customers were using to monitor the cameras could no longer receive streams from the cameras, rendering them useless.

 

[The Original Ralph]

right now i'm looking at Amcrest, Foscam and Dahua cameras - they all seem to function great with Blue Iris software with Amcrest indicating they had input from Blue Iris and worked closely with them in structuring their camera management. Blue Iris did offer improved control re motion sensitivity, motion zones etc that the NEST software didn't, and blue iris seems to configure itself with most cameras - (not with the NEST though).

Blue Iris support is fairly decent - three requests in a row answered within approx 24 hours. In researching various IP camera forums, a lot of the users and reviewers really rave about the Dahua cameras, in terms of quality, features (motorized lenses) and general bang for the buck. Problem is a) they're chinese, b) their units sold thru their US distribution network generally run close to 2X what they units sold out of china/hong kong but purch'd there, there is no support from their USA office. Plus there's the concern one friend, and he's pretty knowledgeable (used to be design engineer at Alcatel) gave me re the chinese are famous for writing "back door" code into their products - but i would think all these units are being mfgr'd in china so....

 

[c4s2k3]

Yes, this is pretty much what I am finding as well. They are all Chinese-made and many have security holes. This is the reason I don't want to see the camera trying to connect to anything outside my network. Some of these Chinese cameras, as it turns out, have gained some notoriety for their security holes. One camera I tried was a a Vstarcam C7837WIP sold under some other name. Physically, it looked like it might be a Foscam PTZ knock-off and it actually had a web-based UI much like an old Foscam model I run currently. After I acquired it I found articles specifically calling it out for easy exploits:
http://www.securityweek.com/remotely-exploitable-flaws-found-popular-ip-cameras
https://threatpost.com/two-popular-ip-cameras-riddled-with-vulnerabilities/127172/

I'd be willing to pay more if I could be assured the camera is secure, provides web UI for configuration of advanced settings, and provides a solid local stream, but such devices seem increasingly hard to find. They all want to get you to support their new "cloud" revenue stream.

 

[The Original Ralph]

this question might seem banaly simple but i really am not much above "fred flintstone" capability - i've built two computer rigs now, but it's been pretty much "build by the number" affairs

am i safe in assuming a stand alone system, ie nvr w/display and the cameras wired to the NVR, with no internet connection would be safe? I realize the NVR might want to connect to register with the mfgr, as well as the cameras, but i'm thinking that would be done when i temporarily run an ethernet cable to the NVR for whatever time it takes to register, then disconnect it

 

[c4s2k3]

Yeah, I would assume such a setup would be safe since it would be completely isolated from your network and internet. But definitely confirm the NVR does not require connection to a network to operate. I've seen some NVR descriptions (in Amazon IIRC) that seemed to indicate the NVR needed a network connection to operate.

 

[The Original Ralph]

thanks - it occurred to me after i asked, that i like the push notifications which means i'd have to run Blue IRIS as i haven't seen

Thinking thru further, i suppose i could set up a small separate computer with it's own internet connection (ie a 2nd ISP account, and the cheapest i see would run $40-45 monthly) and let whoever have access to a computer dedicated to camera feeds

it's a shame there isn't a way to create a firewall to prevent outward comm that isn't approved

 

[c4s2k3]

I don't really have the expertise, but I believe with proper firmware on a router, you should be able to set up a separate network that shares the internet connection. With router firmware such as OpenWRT or DD-WRT it may be possible to create such a network and assign it to a specific physical LAN port on the router. I've never actually tried to do this so I don't know the details. Depending on your setup, might be considerably cheaper than a second ISP drop.

 

[The Original Ralph]

thought i'd come back and post this as an FYI - before pulling the trigger on a dahua camera, i thought i'd down load their configuration tool to take a look at it - scanned it after extracting with Emsisoft (my virus/malware guard) and nothing. Opened it and Emsisoft threw a fit with 4 items described as CryptoMalware - i deleted them. The for the hey of it went over to MajorGeeks.com and when thru the list of utilities they offer to clean your computer - one of the utilities found 2 files in the HKey root, that had something to do with "Dchpxxx" - ie call home files. Btw - that config tool was downloaded from Dahua USA's web, not china

I did the same with Hikvision's file, and found no issues - i've pulled the trigger on a Hikvision camera

mulling it some, i noticed there were only one forum (ip cam.something) and they seemed to be total cheer boys for dahua, and i noticed they got a lot of samples for their editors to review so that has me wondering if they're just a paid shill for them, plus they seemed to encourage sourcing them from china or hong kong, which admittedly offered a great price advantage, but zero USA warranty service or support. There were a couple of other bloggers that similiarly seemed to be shilling for the distributor they got their cameras from for review - otherwise i saw no sources on the net