“Our neighbours recently installed an IP-based security camera. My wife and child were very impressed as they saw them remotely view live footage from their home. Everything looked safe, she smiled. But I wondered, is that footage safe too?,” Altaf Halde, Managing Director, Kaspersky Lab South Asia, shared a hypothetical scenario.
Think about it. How many security cameras record your face on an average day? Cameras in your residence building, your office premises, public roads, ATMs, restaurants, and everywhere else that you practically step — have you ever wondered that your innocent footage could be fodder for crimes?
This prodded Altaf to dig deeper. And what he found was scary.
In the past few months, there have been innumerable cases where CCTV footage was compromised. Sometimes to mild, and sometimes to serious repercussions.
Last year, a website streamed live footage from 73,000 ‘security cameras’ from the world over. Thousands of these were from India. Earlier this year, it was reported that 3 out of 5 security cameras at ATMs are unsecure.
Imagine if someone could just break into its stream and captured all those ATM PINs? A quick Google search could tell you how to hack into CCTV cameras, with video aids. If an Indian cosmetic surgeon’s camera footage was leaked, as it did in a popular Moscow clinic, it would be news for months and would perhaps end many careers.
So, what threat does surveillance pose?
“Several, actually! Have you ever thought that while you use the CCTV footage to track criminals, criminals in turn, could be using your footage against you? If footage of a person, who doesn’t want to be seen in certain places, reaches a criminal, he could be paying ransom money for the rest of his life, to keep that footage from surfacing,” said Halde.
A porn actress recently suffered immensely due to such footage. Active image board users found the actresses’ social network profiles and contact information with the help of facial recognition services such as FindFace, and used it to bully her.
In India, the CCTV segment accounts for over 50 per cent electronic security equipment market. And this is expected to grow at a growth rate of over 20 per cent. With the advent of better cameras, we are seeing better quality images even in night vision cameras. IR cameras have further helped improving the quality. While this is great for us, it comes with its own threats.
Altaf had a lot more interesting things to say. Read on:
Modern surveillance systems are so advanced they no more need to see faces to recognise people. They can analyse the way one walks and behaves too! Although such sophisticated systems are used generally by the government, they do exist and hence, could reach anyone with the means and intent to use it. While the government essentially uses it for public safety, advanced merchants could use these to make big money.
“The average IP-based cameras, the ones you and I use, come with almost zero security. It’s extremely simple to hack into the system and steal footage. Each camera, to be available online, has its own little website that enables you to view it in another part of the world. This web interface comes with a full-fledged management console that helps you to change the angle of the footage, zoom in and even enable sound. This advanced console comes with risks. The footage from these can be easily traced by specialised search systems such as Shodan and Censys,” said Halde.
So, does that mean you can do nothing to secure your cameras?
Fortunately, there is a lot. Start with telling your security system representative to prioritise security over convenience. Then, ensure you regularly update firmware and always strong passwords that you change regularly. You’ll easily find how to do this, on the product’s website or in the user guide. But do not count a lot on your strong password. Vendors have been known to frequently delay firmware updates and vulnerability patches for months. Big companies too, have been guilty of this. The advantage with big names, however, is that they tend to respond better to the government’s persistent calls for better user security.
Another important thing you can do is to disable unused features, especially cloud services. Many cameras today come with a default cloud setting that few use, but it exposes everyone to numerous threats. Cloud features offer tempting things – remote access to the footage via smartphone and storage for CCTV footage. But currently, their security level is tough to assess and hence makes it a dangerous thing.
You could even take more advanced precautions like enabling HTTPS access to the camera. Of course, in this case you are likely to use a self-issued certificate, which would provoke repeated browser alerts, but at least it is something. You could also tweak your home router to isolate your internal network from the outside; enabling exclusive access to only some select device functions. One more option is an intermediary device in the form of NAS storage. Even a basic IP camera comes with video surveillance software. Of course, in this case you should enable secure access as described above.
Did you know that almost every device has a webcam now?
And every webcam comes with numerous security threats. So what can you do? Basic precautions will work. Like, plug in your stand alone camera into the USB only when you need it. On your inbuilt laptop camera, tape the lens when not in use. If you think that looks tacky, you can buy cool lens covers for it that are available widely in the market.
For your smartphone, use a non-transparent cover for your rear camera and a tape over for the front. Of course, anti-virus for smartphones is no more a luxury, it is mandatory for security.
Many countries have strict regulations for cameras in public places. In Russia, for instance, an entryway is considered to be the property of the community. So camera installation requires approval of residents. But in India, the laws are fluid in this regard and almost everyone does what they please.
So be smart, be cautious. Sure, get those security cameras installed. They provide immense benefits, often warding off potential burglars and helping to identify one when the need arises. But before you do, make sure you’ve studied the systems, analysed all risks and taken all necessary precautions to avoid falling victim. In the unfortunate case that you do fall victim, remember that you always have legal recourse. Just remember it is a very complex area that leaves an immense lot to interpretation and even luck.
So be aware, be educated and remain secure. Your security systems needs more help than you think. And you must get it!
