The Security of Video Surveillance Systems Questioned

The same useful features that enable security administrators to monitor surveillance cameras from any Web browser are also fraught with security vulnerabilities, according to a security services company. Gotham Digital Science recently posted a blog write-up that described how an unauthorized person could gain remote access to a closed circuit television video system. Doing so would allow that user to view video being captured with the camera, gain access to archived video footage, and, if supported by the particular model of camera, control the direction of the camera. Also, the company reported, many of the organizations running video surveillance may never know that an attacker has gained access to the system.

According to Justin Cacak, who penned the blog entry, the vulnerability can be tested with the use of a new tool added to the Metasploit Framework, a part of the Metasploit open source security project that allows testers to develop and execute exploit code against a specified target. So far the tool has been run against surveillance gear from MicroDigital, Hivision, and CTRing, as well as a "substantial number of other rebranded devices," the blog entry stated. Many of these systems are rebranded by other vendors and sold under different names in the United States

A common problem is that often the password that provides remote access to the device is never changed. "Typically, in over 70 percent of cases the device is still configured with the default vendor password which allows trivial access to real time video, the ability to control PTZ (pan-tilt-zoom) cameras, and access to any archived footage," Cacak wrote.

During its testing, in cases where the default password had been changed, the company used a network proxy to intercept and modify network data for non-proxy-aware applications, allowing researchers to determine valid and invalid users and authentication responses. That in turn allowed them to develop software that could validate user accounts, exclude non-valid ones, and use "brute force logins" to gain entry to the video systems.

"It is likely that other manufacturers and CCTV devices are similarly vulnerable," Cacak noted. Gotham recommended that organizations protect themselves against unauthorized breaches by changing default passwords, using strong passwords, filtering access to trusted hosts, and exposing the video system to the Internet only "if absolutely necessary."

The company also suggested that security professionals try out the new Metasploit module, available in the Metasploit Framework, to scan their networks for vulnerable systems.

About the Author

Dian Schaffhauser is a former senior contributing editor for 1105 Media's education publications THE Journal, Campus Technology and Spaces4Learning.

Featured

  • stylized human profiles, tablets, and floating icons

    From Feedback to Flexibility: 5 AI Tools Teachers Should Try

    As a fifth-grade teacher and AI School Champion in the St. Vrain Valley School District, I've seen firsthand how artificial intelligence (AI) is transforming education. Here are five AI-enabled tools I've found especially powerful in my classroom and professional practice.

  • computer monitor with a bold AI search bar on the screen

    Google Rolls Out AI Mode in Search

    About a year after introducing AI Overviews for its flagship search offering, Google has announced broad availability of AI Mode in Search.

  • portable Wi-Fi hotspot rests on a stack of books and a laptop in a library

    Senate Votes to Rescind E-Rate Program Funding Loaner WiFi Hotspots for Schools and Libraries

    The Senate has passed a joint resolution to overturn "Addressing the Homework Gap Through the E-Rate Program," a July 2024 expansion to the FCC's E-Rate program that allowed schools and libraries to utilize E-Rate resources to loan out WiFi hotspots to students, school staff, and library patrons.

  • silhouetted student stands before the White House, surrounded by abstract digital graphics of brains, circuits, and AI elements

    White House Sets Sights on AI Education

    A new executive order from President Donald Trump aims to advance America's position in artificial intelligence technology by incorporating AI into education and providing AI training for educators.