The presence of CCTV cameras can make you feel safe, but how safe are the equipment itself?
Even as the State government has announced its plans to install 5,000 CCTV cameras in the city, cyber security experts claim that data from the existing Internet-connected CCTV cameras in the city are prone to malware attacks and resource theft has been happening for the past many years.
According to N. Vijay Shankar, a cyber security expert, this is mainly because of the weak passwords retained by the users.
“There are search engines which can monitor the active CCTV cameras and those that are vulnerable to dropping viruses such as the Mirai and Botnet. We found that the cameras in Bengaluru are very vulnerable,” he said.
Lt. Vineet Kumar, founder of National Anti-Hacking Group, a group of ethical hackers and cyber security experts, said that in 2012, a command and control server, used to steal data from various internet connected devices, including CCTV cameras, was detected in Bengaluru. “We even alerted the Karnataka police about this. Now even smart TVs and refrigerators are being hacked across the country. Bengaluru is one the prime targets as it is developing faster and becoming a smart city at a rapid pace,” he said.
The hacker gets access into the CCTV footage and then either uses it to facilitate a Distributed Denial of Service (DDoS) attack by sending the huge data from the Digital Video Recorder (DVR) to the target server.
“For example if an e-commerce platform has a discount sale coming up, the hackers of rival companies can bring the site down by flooding its server with images. One of the malware most commonly used is Mirai,” said Mr. Vijay Shankar.
There are different methods through which a hacker can get access to the DVR, including hacking into the phone through which CCTV is monitored. “However, the most common mistake is a weak-password or retaining the one issued by the company that installed the equipment. Through multiple combinations, a hacker can crack the password,” said R. Nandakumar, president, Electronic Security Association of India.
Pavan Duggal, a Supreme Court lawyer specialising in cyber law, said that he has seen a few cases from Bengaluru pertaining to CCTV hacking.
“People are not aware about cyber security of these equipment. Their cyber protection is very poor,” he said, recalling a recent case of an employee of a private company hacking into his company CCTV storage device to delete a footage of him stealing.
However, city police commissioner Praveen Sood, said the cameras installed by them are safe. “They have different layers of protection,” he said.
