How Secure are Home Security Cameras?

 By Catherine Powell

Image courtesy Pixabay

If you were following the news around the holidays, you may have caught the Fox 30 piece about porch pirates who were captured on video stealing packages.  While this kind of larcenous behavior is nothing new, the proliferation of home security cameras has made it easier for home and business owners to catch thieves in the act.  This not only gives law abiding citizens evidence to use in court when the culprit is caught, but some web-enabled systems allow owners to alert law enforcement while the crime is taking place.  While user-friendly technology is making it far easier to secure your possessions, some systems can be used to spy on the same home and business owners who installed them.  If you own or are planning on acquiring home security cameras for your property, you need to know a few things about that eye-in-the-sky.

The same feed that informs owners of an intruder can be used by thieves to case a property. - If your security camera is web-enabled, it had better be password protected.  If it isn't, that means anyone can tap into the system to use your camera to keep an eye on you and your family.  The reason thieves do this is to learn your habits in order to determine when the best time to break in.  Once breached, such a system will also let thieves know when you're likely to return so they can rob you blind.

Local access can sometimes mean your footage is stored on the cloud. - Even if your system doesn't alert you to a break-in in real-time, if it stores any of the footage on the cloud, this is another vulnerability that lets thieves get the drop on you.  In a December 5, 2022 article entitled, "Eufy No-Cloud Security Cameras Steaming Data to the Cloud," Christopher Boyd pointed out that even though the manufacturer claimed the camera footage wasn't going to the cloud, it turns out that the data was sometimes sent to the cloud, even when the cloud storage option wasn't enabled. Far more troubling was what Chris Boyd revealed next:

"Facial recognition data in the form of thumbnails and other information was being stored against usernames and data was kept on servers even after being deleted from the app.  Another user discovered that this data wasn’t encrypted. Moore even found out that you can remotely start a stream and watch live with VLC."

While the Malwarebytes article specifically focused on the Eufy No-Cloud Security Camera, a little web research allowed me to discover that this wasn't the only security camera system with gaping security flaws.

1.  Ring cameras, video doorbells, and smart lights have also had their fair share of security and privacy issues, according to a blog by reviews.org. It was reported that some Ring models had not only been hacked to gain access to the video footage, but some hackers were able to wrest control of the devices from their lawful owners.  Due to adverse publicity concerning these lapses, Ring released a number of security fixes including two-factor-ID and end-to-end encryption.  However, it's left up to users to implement these fixes.

2. Nanny cams have proven to be particularly vulnerable. - One family in Minnesota who had employed a nanny cam manufactured by Foscam were surprised to hear music coming over the monitor.  When they went to check on their infant, the music would stop, then resume soon thereafter.  After conducting an investigation they learned their nanny cam was not only web-enabled, but it had been hijacked by hackers in Amsterdam.  After tracking down the IP address the hackers were using, they followed it to a site that displayed thousands of pictures pirated from cameras like theirs.  They also came to learn that not only were the hackers able to see their videos, they were also able to take control of the camera to aim it anywhere in the nursery they pleased.  When they contacted Foscam, a company representative told them that the family should check the camera's log files to make sure that no unauthorized IP addresses were accessing their nanny cam.

If you own or intend to install security cameras in your home or office, here's what you need to know:

Make sure you practice safe security standards. - Never buy a security camera system secondhand.  These can come with built-in malware. Check and double check that all your cameras are fully secure and they don't upload any footage to the cloud.  Even if it takes a bit more time to enable two-step authentication and end-to-end encryption, the effort is worth the effort.  (Some haughty hackers in Russia have been known to create websites where other hackers can view the footage gleaned from pirated home security videos.  Many of these same sites then offer to sell the security passwords to the highest bidder.  One site alone boasts more than 15,000 videos from 256 countries.)

Don't lock the front door and leave the backdoor wide open. - The meaning of this adage is twofold.  In the first place, if you only install a front door camera, your unprotected back door will look all too inviting to a thief.  Secondly, if you make sure you follow all the recommended security protocols on your cameras but fail to secure your router, hackers can exploit this vulnerability to take control of your cameras.  

Keep your ear to the ground regarding known security flaws. - In the past some big players in the home security camera business were caught with their pants down, including AvTech, Hikvision, Linksys, and Panasonic.  If you set up a Google alert about your particular security camera you will receive any reports regarding known security holes now and in the future.  Then all you have to do to plug the hole is take corrective action.

Make sure you update your devices' software. - Just like PCs, tablets, and smartphones, you need to keep your cameras security protocols up to date.   The main reason that security updates are published is to plug newly discovered security lapses.  If you fail to update your cameras in a timely manner it's child's play for hackers to use known security holes to breach your system.  There are chat rooms on the dark web set up for precisely this reason. 

Register your cameras with the manufacturer. - This way if a security bulletin or update is issued you'll be sure to receive a notification.  You'll also be able to register a complaint if you should detect any unusual activity displayed by your device.

Just as there is no 100% secure computer, you need to understand the same principle holds true when it comes to today's high-tech security cameras.  

Catherine Powell is the owner of A Plus All Florida Insurance in Orange Park, Florida. To find out more about saving money on all your insurance needs, check out her website at http://aplusallfloridainsuranceinc.com