Cyber Crime a Smart City Killer. Closed-Circuit Security Cameras a Digital War Weapon

Smart City: “A city that uses technology to automate and improve city services, making citizens’ lives better.” The definition looks very interesting however as said, All good things are difficult to achieve, and bad things are very easy to get a parcel. With regards to smart city, Cyber Attacks plays a major role and is the main contributor which can make complete system at halt

Smart City comprises of below critical functions-

1. Traffic Control Systems
2. Smart Street Lighting
3. City Management Systems
4. Sensors
5. Public Data
6. Mobile Applications
7. Cloud and SaaS Solutions
8. Smart Grid
9. Public Transportation
10. Cameras
11. Social Media
12. Location-based Services
13. Etc.

To effectively run the Smart City operation, a complete governance framework needs to be setup which requires monitoring.

Let's takes a simple scenario of point no. 10 which is a very elementary component of smart city solution; however, plays a very vital role. Closed-circuit security cameras are supposed to make you safer to run the city operation, but there are many ways to turn them into weapons like sabotage manually or using malware. Researchers have discovered code that turned about 900 Linux-based CCTV cameras into a botnet, which promptly bombarded an unnamed "large cloud service" that serves millions of people. The intruders compromised cameras from multiple brands, all of which had lax out-of-the-box security -- in some cases, they'd been hacked by more than one person.

A botnet is a collection of compromised computers often referred to as “zombies” infected with malware that allows an attacker to control them. Botnet owners or “herders” are able to control the machines in their botnet by means of a covert channel such as IRC (Internet Relay Chat), issuing commands to perform malicious activities such as distributed denial-of-service (DDoS) attacks, the sending of spam mail, and information theft

The botnet conducted a "run of the mill" denial of service attack, and it would be relatively easy to thwart the attackers with a bit of caution. However, it underscores the potential dangers of security cameras. There are millions of connected cams worldwide, many of which likely weren't installed properly -- and it'd be trivial to use those cameras to spy on people. Until companies either ship more secure cameras or tell their customers how to protect themselves, these surveillance systems will likely represent an ongoing risk.

Let me show you a small demo; how a Closed-circuit security camera can be hacked easily with simple steps.Please note, I am not encouraging people to hack others system; however objective is to educate about consequences if your camera is not secured. 

Consequences could be more devastating like a Terrorist attack on sensitive government functions as mentioned above, Bank operation to sabotage and to gain financial benefit ( what if CCTV camera of ATM or bank is hijacked to perform robbery), what if your privacy is made public by controlling your personal or public cameras. What if someone is controlling the operation of Smart Grid or monitoring Traffic Control Systems for any illegal activity. The complete surveillance will go for a toss. We should give equal importance to physical security as well as digital aspect(which we are talking about). Placing a camera is secure environment is very important for digital operation.

To test this scenario, I quickly evaluated my public IP address and then I did scanning to look for a system which has a camera installed by giving an IP range. As part of this process, I selected the web detect option. Web detect is used when we want to know small details about the devices that are connected to the internet. For example any router name or the CCTV camera name or the model number.

So you got the complete result of your scan operation -

The highlighted part shows the system with Camera installed. There are few parameters by which you can recognize your CCTV camera. 

• DVRDVS-Webs – CCTV camera
• Webs – CCTV camera
• Hikvision-Webs — CCTV camera
• iBall-Baton — CCTV camera
• uc-httpd 1.0.0 — CCTV camera

   And by simply browsing the IP address, I am able to get the login page of the camera system.

Now, I know the make of the device i.e. Hikvision Digital Technology Co. Majority of cameras is deployed by engineers who doesn't understand the consequences of using the default password. Here you go with the password. Most of the CCTV cams and router has the default password in it so they can easily be hacked and the hacker can inject botnet or zombies to execute the digital war.

And finally, you are in!!!. 

This article is only for educational purposes and encourages administrator to secure the camera interfaces using best practices. In my subsequent article, I will show you how to secure your camera's for better future operations from Cyber Crime. Till then Happy Reading.....