Feeds

'Video-hams' tap into insecure surveillance cams

i-Spy

Security for virtualized datacentres

Surveillance cameras outfitted with internet technology are open to tampering and interception, security experts warn.

IP cameras, widely available from around £70 and not to be confused with web-cams that connect directly into PCs, connect into corporate computer network or domestic broadband systems and are capable of transmitting live footage or individual images across the internet. However these systems are often set up without bothering to configure security settings (such as password protection), an omission that means nominally private cams can be viewed over the net by so-called "video hams".

By using search engines such as Google, snoopers can locate and view hundreds of unprotected cameras, according to Robert Schifreen, IT security consultant and author of the book Defeating The Hacker. Insecure cameras can be easily located using search strings such as "inurl:CgiStart?page=Single" or "axis inurl:view/index.shtml", to produce interesting results (as illustrated by Schifreen here).

The problem is compounded by the inclusion in many systems of so-called "PTZ" features, which allow surveillance cameras to be panned, tilted and zoomed remotely so that the operator can focus on a person or activity of particular interest. Wi-Fi versions of video surveillance cams have made it possible to install systems in a wider number of locations, further exacerbating the issue.

"Allowing your company's surveillance system to be visible over the internet is just asking for trouble", said Schifreen. "There are serious privacy issues in allowing the general public to watch your staff going about their work behind closed office doors. Allowing your competitors to see how your company operates is madness. And unfettered access to PTZ facilities makes it simple for a thief or shoplifter to divert a camera away from where he intends to strike."

"We're not talking about hobby webcams here, which were always intended to be viewable by the general public", Schifreen added. "The systems being targeted by video hams are private surveillance cameras. All of which come with security facilities such as password protection built in, if only the purchasers were aware of them."

Users deploying IP camera for surveillance ought to enable the camera's in-built password protection, rather than allowing images to be openly accessible to anyone who knows how to use a search engine. In corporate environments, video surveillance traffic needs to be kept to the confines of internal networks, using appropriate firewall rules. ®

Beginner's guide to SSL certificates

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.