Professional Documents
Culture Documents
Though advances have been made in recent years, many CCTV cameras remain
troublingly vulnerable to attack. Malicious actors have developed a wide range of
techniques to circumvent security protocols and gain access to video surveillance
systems.
Some use very simple exploits (that take mere minutes), while others prefer more
sophisticated intrusions (that infiltrate even hardened systems). Though their
methods may vary, talented hackers can make their way into your home security or
enterprise surveillance network. Once inside, they can use remote access to watch the
world through your cameras—or potentially even take control of them.
Raising the bar on security is the whole point of installing CCTV cameras in the first
place. So, these vulnerabilities largely defeat the purpose of investing in a
surveillance system.
TThe entire industry received a wake-up call to this reality following the revelation in
2017 that more than half a dozen Hikvision brand wifi cameras were being
accessed through a backdoor password reset flaw.
The problem created embarrassing headlines (the hashtag #hakvision circulated on
social channels). And ICS-Cert, an agency within the U.S. Department of Homeland
Security, characterized the vulnerability as “remotely exploitable” with a “low skill
level to exploit.”
Despite this incident raising overall awareness, many organizations are still woefully
behind when it comes to safeguarding their camera systems. To better prepare, all
enterprises should understand the following three methods that are among the most
commonly used by criminals to gain unauthorized access to CCTV cameras.
Hack Method #1: Default Password Access
Anyone looking to break into CCTV cameras can start by simply looking for its IP
address online and logging in. By using engines such as angryip.org or shadon.io,
they can obtain that signature information and begin trying passwords that will grant
access to the wireless camera itself or, if a router is attacked, entire security systems.
In theory, this should be difficult and IP security should protect network data, but the
shocking reality is that these passwords are often identical to the default factory
settings provided by the manufacturer. In the case of the Hikvision hack, it was
known to be “12345” with a username of “admin.”
Changing default passwords for a new security camera system should be a no-brainer
in this day and age. So the lesson here is to not overlook the small details. All the
firewalls and hardened network protocols in the world won’t help if an unauthorized
user can simply log in with a commonly-used or factory-set password to gain remote
access to indoor outdoor surveillance.