IP Cameras - the gateway for Cyber Attacks

CCTVs are one of the most preferred ways for cyber attackers to penetrate corporate networks, as they are inherently vulnerable and serve as the easiest entry point for attackers. The security cameras we see in use today by plenty of organizations are higher-quality cameras; equipped with image and sound processing capabilities. Their recording systems offer text decoding and facial recognition capabilities. The information from these cameras is uploaded to the cloud, either for telemetry purposes or to receive the value from analytics capabilities provided by AI services.

Security cameras or Internet-connected security cameras have become more and more IP-based. A direct consequence of this trend is cyber attacks and other types of threats against network cameras, which are just like every other device on the network. The security camera market is projected to grow from its current market value of more than $8 billion to over $20 billion by 2025.

Every day, hundreds of thousands of security cameras are installed and connected worldwide. These products are being developed by manufacturers quickly, equipped with smart sensors and advanced software that include features like night vision, distance detection, heat and motion detection. At the other end of the spectrum are less advanced home cameras that can be managed through smart phone applications.

With CCTV systems connected to IP infrastructure along with associated devices, the networks are at a risk of being hacked, especially those on the legacy networks. The devices are left connected to the Internet and are left on default credentials. In this case, the attackers can develop software that scour the internet searching for vulnerable devices, which they then take control using their own malicious software.

The sensitive data that passes through the security cameras can expose operators to various privacy-related issues and raises serious concerns regarding the ability of foreign entities to watch or listen to sensitive information. In the United States, a directive has been issued prohibiting the use of certain security cameras at all federal agency’s sites.

The directive refers to communication equipment and cameras and requires the dismantling and replacing of existing equipment. Similar voices are also being heard in several European countries, as examples have surfaced where some cameras can act as an active or dormant agent, used at will.

Security cameras are connected to both the corporate network and the Internet, capturing, and transferring large amounts of data to recording systems that sit within the organization or in the cloud. Clever attackers gain the ability to reach any computer on the network and run remote commands. Attackers are even penetrating organizations and deciding to lie dormant for months until deciding the right time to strike.

Dr. Deepak Kumar Sahu, President & CEO, VARINDIA