It may be the favorite easy target for those of us who like to grumble about the sad state of security in the consumer market, but there have been some egregious examples of poor security in “smart” cameras recently.
We buy security cameras to help keep us and our families safe, but their own lax security may be doing the opposite.
Security researcher Rob Graham decided to see just how much security he could expect from a newly purchased JideTech camera.
He set up the camera to isolate it from the rest of his home network, just in case the worst happened.
It ends up he had good reason to be concerned, though the speed at which this new camera became a problem was shocking even to him.
Less than two minutes – just 98 seconds – after he plugged it in, it was compromised, infected with the Mirai malware that’s been turning IoT devices into botnet zombies to attack internet services.
You can follow the outline of his experience on Twitter, where he posted a play-by-play as he watched his new camera become infected:
1/x: So I bought a surveillance camera pic.twitter.com/HbmPzrZgFK
— Robᵉʳᵗ Graham 𝕏 (@ErrataRob) November 18, 2016
The camera is no longer available on Amazon, though that is where he originally bought it for $55.
Admittedly this camera is not one of the more high-end models – but a more expensive camera is no guarantee of better security practices.
What does it all mean?
For one thing, if a security professional takes proper precautions to safeguard his new IoT device and it still gets infected, that surely doesn’t bode well for the rest of us.
But the bigger picture is this: it’s incredibly easy to find internet-connected devices if you’re someone looking to do a little research or wreak a little havoc.
If you can use a search engine, you can find unsecured webcams and their relevant identifying data, with search engines such as Shodan making it easy to find these devices.
Combine how easy it is to find IoT devices with the fact that a huge number of IoT users never change the passwords on their devices from the well-known defaults.
It’s easy to see why criminals have a treasure trove of devices they can easily work with.
This leads to the problem of the Mirai malware: it hijacks IoT devices, turns them into botnet zombies, and uses them to knock entire internet services offline.
Even if Mirai isn’t out to get you directly, you may still end up knocked offline, as close to a million Deutsche Telekom users in Germany found out last weekend: their routers crashed when exposed to Mirai’s attempts to probe the network for victims to drag into a future attack.
And, with IoT devices being so quickly and easily infected, and so easily discovered, Mirai isn’t likely to go away any time soon.