News is breaking that popular wireless security camera designed to safeguard businesses and homes was vulnerable to a spying hack.The flaw meant it was possible to hijack video and audio streamed from other people’s properties by making a minor tweak to Swann Security’s app. Researchers found the problem after the BBC reported a case where one customer had received another’s recordings.
Adam Brown, Manager of Security Solutions at Synopsys:
“I personally have experience with Swann cameras – I used to have one, albeit different from the one in the report. I found that the camera feed itself could be accessed directly from the network the camera was on, and there was some access control over that video feed – a hardcoded password as I remember – this is bad practice. If that camera was placed directly on the internet (not behind a firewall) then prying eyes could potentially see what my camera could see. Obvious lax security controls indicate systemic failings. Without speculating on the technicalities of what went wrong here, I would surmise that the software security initiative at Swann is either lacking or could benefit from some deliberate improvement driven from management. The camera market is catching up in cybersecurity. Leading Chinese manufacturers are integrating privacy and security into their cameras and infrastructure. Privacy and security are going to be vital for the camera industry, itself placed as a security solution.”
Christopher Littlejohns, EMEA Manager at Synopsys:
“Effective Key Management is a fundamental practice on which authentication and cryptography is based within the Digital World. Without unique and “uncrack-able” keys we lose the ability to authoritatively identify people and things connected to the internet, or to transfer their secrets in a secure manner. In this particular case a human error resulted in a manufacturing fault with at least two security cameras having the same key causing both cameras to be identified as the same item. The net result was that images, sound and videos were sent from one camera to the wrong user on their mobile phone. Whilst the impact of this is mostly on the vendors reputation, the same issue appearing in something like Bitcoin or other high-value item could be catastrophic – huge sums of money could be lost, confidence eroded in a service, or even State Secrets revealed to hostile governments. The latter is stretching the point a bit, but the underlying theme is that internet security is only as good as the weakest supply chain link, the generation and allocation of keys being part of that supply chain. Issues such as this may cause significant difficulties with government regulations, for example European Union GDPR compliance. Poor key management may be considered negligent when it results in such data privacy issues, and there cannot be many things much more relevant to privacy than sending videos from your own home to the wrong person.”
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.