Iran Hijacking Home Security Cameras to Spy Within Israel

Article content

In the US, the Federal Communications Commission in 2022 banned Chinese-made surveillance equipment over national security concerns. 

Article content

The private surveillance market is fast growing around the world: it’s projected to reach $89 billion in 2030, up from $54 billion in 2024, according to a study by MarketsandMarkets Research.

Article content

Relatively cheap and ubiquitous, private security cameras are often easy to access and hack, and they can provide foreign intelligence services with information on where troops are located, or help adversaries figure out where to drop bombs. 

Article content

While researchers have been warning about the vulnerabilities in security cameras for over a decade, some in the industry say they can be contained by investing in higher-end systems that offer regular firmware and software updates and by following proper installation procedures. 

Article content

“Higher-grade security camera systems from vendors that take cybersecurity seriously will offer extensive configuration settings allowing for more device and communications customization,” Geoff Kohl, the Security Industry Association’s senior director of marketing, said in an email. At the same time, users should “presume your security video systems could be targeted,” he added.

Article content

Article content

Most consumers prioritize price over the security of a surveillance system, even though a weakly protected camera can be a “stepping stone” into overtaking the broader network, said Peleg Wasserman, a security architect at a global energy firm. “They don’t look at the security features of the device they’re buying. So for the vendor there is no incentive to beef up security of such systems.”

Article content

“Consumers need to remember that they’re not the only ones who may have access to this camera,” Wasserman said. “I’ve seen people that put a camera outside the home without knowing that they’re also filming their neighbors, for example, or a sensitive object or even giving a panoramic view of a city which may be useful for targeting.”

Article content

In addition, private surveillance cameras often come with a default password — sometimes as simple as 1-2-3-4 — which is rarely changed by the user, according to experts. Some systems automatically stream the footage on the internet. 

Article content

While Chinese-made cameras have taken over a large part of the private surveillance market, other systems have weak protections. A study by BitSight Technologies Inc. this month found live footage from 40,000 security cameras is accessible on the internet, including 14,000 in the US.

Article content

Article content

For countries at war, this data leakage can be an Achilles’ heel. 

Article content

In 2022, the Israeli cyber agency warned that 66,000 personal cameras in Israel were using a default password and could easily be overtaken by hackers. That warning was largely unheeded, including in the southern towns that were invaded by Hamas in the attack that killed over 1,200 and saw 250 abducted.

Article content

After the Hamas attack, the Israeli government issued nonbinding directives urging citizens to strengthen the information security on their personal security cameras, many of them Chinese-made, including adding two-factor authentication. It also obtained legal approval to remotely shut off traffic cameras and personal devices reflecting out on sensitive areas, such as borders or critical infrastructure, according to Portnoy, the former director of the Israel National Cyber Directorate.

Article content

That came after it detected increased attempts by Israel’s adversaries to breach highway cameras to monitor troop movements. Portnoy said Hamas had hacked private cameras for years to collect intelligence and monitor civilian and military movements while planning the attacks. Hamas is considered a terrorist organization by the US and many other governments.