Hikvision's Director Of Cybersecurity And Privacy Says IoT Devices With Backdoors 'Can't Be Used To Spy On Companies, Individuals Or Nations'

from the O-RLY? dept

Hikvision describes itself as "an IoT solution provider with video as its core competency". It hasn't cropped up much here on Techdirt: it was mentioned earlier this year as one of two surveillance camera manufacturers that had been blacklisted by the US government because they were accused of being "implicated in human rights violations and abuses" in Xinjiang. Although little-known in the West, Hikvision is big: it has "more than 42,000 employees, over 20,000 of which are R&D engineers." Given the many engineers Hikvision employs, the following comment by Fred Streefland, Director of Cybersecurity and Privacy at Hikvision EMEA (Europe, the Middle East and Africa), reported by IPVM, is rather remarkable:

even devices with backdoors can't be used to spy on companies, individuals, or nations. The security features built into devices, networks, and data centres, combined with end-users data-protection responsibilities, make espionage and other misuses of backdoors impossible.

Streefland expanded on why data protection laws make espionage "impossible":

the end-users who buy these cameras are responsible for the data/video footage they generate. In other words, they're the data custodians who process the data and control the video footage, which is legally required to be kept private. Secret access to video footage on these devices is impossible without the consent of the end-user.

An interesting theory, but not one that security guru Bruce Schneier has much time for. IPVM asked him to comment on Streefland's statements:

I would say that only someone who doesn't understand cybersecurity at all would say something like that. But he's a CSO [Chief Security Officer], so he's probably deliberately saying something that stupid in order to sell you something.

That's a polite way to put it. As many stories on Techdirt attest, IoT products in general, and video cameras in particular, have huge security problems, often caused by backdoors, that have led to all kinds of spying at every level.

It seems that someone at Hikvision has realized just how ludicrous Streefland's comments were. The original source for the IPVM story is an interview with Streefland published by Benchmark Magazine. That interview is taken almost verbatim from a post on Hikvision's own blog, called "Debunking myths in the security industry." By an amazing coincidence, both the original interview and the blog post now lead to "404 not found" messages. Happily, the Internet Archive's indispensable Wayback Machine still has copies of both the interview and the blog post, where Streefland's words of wisdom quoted above can be found, along with some other choice thoughts on security.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: backdoors, cybersecurity, fred streefland, iot, privacy, surveillance
Companies: hikvision

Most People Probably Don't Need A VPN, Experts Now Advise

from the first-do-no-harm dept

Given the seemingly endless privacy scandals that now engulf the tech and telecom sectors on a near-daily basis, many consumers have flocked to virtual private networks (VPN) to protect and encrypt their data. One study found that VPN use quadrupled between 2016 and 2018 as consumers rushed to protect data in the wake of scandals, breaches, and hacks.

Unfortunately, many consumers are flocking to VPNs under the mistaken impression that such tools are a near-mystical panacea, acting as a sort of bulletproof shield that protects them from any potential privacy violations on the internet. Not only is that not true (ISPs, for example, have a universe of ways to track you anyway), many VPN providers are even less ethical than privacy-scandal-plagued companies or ISPs.

After a repeated few years where VPN providers were found to be dodgy or tracked user data when they claimed they didn't, professionals have shifted their thinking on recommending even using one. While folks requiring strict security over wireless may still benefit from using a reputable VPN provider, experts say the landscape has changed. Improvements in the overall security of ordinary browsing (bank logins, etc.), plus the risk of choosing the wrong VPN provider, means that many people may just be better off without one:

"It’s time we retire the stock advice to get a personal VPN," Bob Lord, former chief security officer at the Democratic National Committee, told Motherboard in an email. "Most people do not need personal VPNs today because the internet is much safer than it was in 2010. Personal VPNs create additional risks. Giving everyone advice that only pertains to some people misdirects them from the steps that will actually help them secure their digital lives."

Granted there are plenty of journalists, government officials, or folks researching dangerous or volatile people who probably still benefit from using a quality VPN. There are also instances where using a VPN can help thwart invasive advertising data tracking:

"There is at least one thing that some VPNs could help with: blocking malicious ads. The online advertising ecosystem is so dangerous that the U.S. Intelligence Community has blocked advertisements on a network-level, Motherboard reported recently. But online ads are not just a threat to intelligence agencies; Motherboard has repeatedly shown how data brokers harvest 'bidstream' data by participating in the online advertising process. This sort of information can include location data."

But as the VPN field has become crowded by dodgy players, just injecting an entirely new dodgy player into your traffic flow isn't really helping anybody. Especially if you lack the capacity to ferret out which VPN provider is keeping its word, and which is just another shady business collecting, storing, and monetizing your data (while breathlessly insisting they don't do that).

Filed Under: cybersecurity, encryption, privacy, security, vpns

CIA, NSA Block Ads Network-Wide To Protect Agencies. Ron Wyden Says Rest Of Gov't Should Do The Same.

from the [glaring-pointedly]-they're-not-wrong dept

Not everyone uses an ad-blocker. But most people do. And no matter how much online publications claim ad blocking is the same thing as stealing, it really isn't. If they're bent out of shape about it, it's because they assault users with ads, burying content behind a wall of uncurated virtual salesmen. If it bleeds, it leads, the old saying goes, but now it refers to readers' processing power and data allotments.

Far too many online publications consider processing the check on the ad buy to be the end of their responsibility. But ad servers get hijacked. Other ad companies get purchased by ad pushers with more malleable morals. Everyone collects reams of data on every site visitor. The end user of sites seems to be the last concern for ad brokers and the people who sell to them, so it's no surprise more people are deploying ad blockers, seeing as readers of even supposedly-reputable sites have been hit with malware, spyware, and auto-playing video when just trying to access some content.

Ads can be dangerous. They can compromise systems and hijack browsers. The general public definitely knows this. Enjoy this shade thrown at ad saturation and website design overcompensation:

The government knows this as well. And it should, although it really shouldn't be a trailing indicator on abusive ad deployment. The spyingest agencies of the Intelligence Community don't just suggest employees should use ad blockers. It mandates them. Here's Joseph Cox for Motherboard:

Lots of people who use ad blockers say they do it to block malicious ads that can sometimes hack their devices or harvest sensitive information on them. It turns out, the NSA, CIA, and other agencies in the U.S. Intelligence Community (IC) are also blocking ads potentially for the same sorts of reasons.

The IC, which also includes the parts of the FBI, DEA, and DHS, and various DoD elements, has deployed ad-blocking technology on a wide scale, according to a copy of a letter sent by Congress and shared with Motherboard.

The letter [PDF], written by Senator Ron Wyden, suggests the rest of the federal government follow the NSA's lead and implement "network-based ad-blocking technologies" at all federal agencies.

While the intelligence community has acted to protect its personnel and computers from malvertising based threats, many other federal agencies have not, and are unlikely to until they are required to do so. To that end, as OMB [Office of Management and Budget] finalizes its recently released draft Federal Zero Trust Strategy, detailing the specific actions that OMB is requiring federal agencies to take to secure their systems from hackers, I urge OMB to also require agencies to implement the CISA and NSA guidance to block ads.

"Zero trust." That sounds like an accurate court of the trust most online advertisers have earned. It's a cesspool out there and publications looking for the easiest way to convert readers to dollars have proven willing to splash around in it under the assumption they'll always be able to blame the foul odors on their ad partners. But that assumes people will be willing to forgive continuous abuse as long as they can access "free" content. That's a risky assumption.

And it doesn't have to be this way. Techdirt has experimented with a blend of ads and direct connection with readers to pay the bills. As ad providers have become less trustworthy and old standbys (like Google's AdSense) have become increasingly erratic with their policy enforcement, Techdirt has dropped ads completely. There are no Google ads on Techdirt and no analytics trackers logging reader info for data brokers who not only help serve up "targeted" ads but also sell data in bulk to government agencies. Techdirt runs clean and is almost entirely reader-supported. Very few sites are willing to give up money to ensure the safety and privacy of their readers and that's why ad blocking has never been considered a threat to Techdirt's business model.

Ad blocking is a must-have these days, even for the federal government. Too much abuse and too little oversight has turned a nicety into a necessity. And if online publications don't like the current state of affairs, they really have no one but themselves to blame.

Filed Under: ad blocking, cia, cybersecurity, intelligence community, nsa, ron wyden

American Malware Purveyor That Did Nothing To Limit Misuse Now Horrified To Find Gov't Of India Misused Its Products

from the who-could-possibly-have-seen-this-inevitable-outcome dept

Another malware purveyor is shocked, SHOCKED to discover its products have been used to do Very Bad Things. Thomas Brewster has more details for Forbes. Here's the setup:

Earlier this year, researchers at Russian cybersecurity firm Kaspersky witnessed a cyberespionage campaign targeting Microsoft Windows PCs at government and telecom entities in China and Pakistan. They began in June 2020 and continued through to April 2021. What piqued the researchers’ interest was the hacking software used by the digital spies, whom Kaspersky had dubbed Bitter APT, a pseudonym for an unspecified government agency. Aspects of the code looked like some the Moscow antivirus provider had previously seen and attributed to a company it gave the cryptonym “Moses.”

More digging by Kaspersky and others discovered who was actually behind these deployments. And the source wasn't some state-supported hackers or a malware purveyor with a malleable set of morals. No, the exploits -- which were deployed to indiscriminately target people in Pakistan and China -- were sold (in a way) to the government of India by an American firm, Exodus Intelligence.

Operating out of Austin, Texas, Exodus doesn't craft many exploits of its own, but rather provides access to information about known exploits, including where to obtain them, and how they can be utilized and leveraged.

Exodus, when asked by Five Eyes countries (an alliance of intelligence-sharing countries that includes the U.S., U.K., Canada, Australia, and New Zealand) or their allies, will provide both information on a zero-day vulnerability and the software required to exploit it. But its main product is akin to a Facebook news feed of software vulnerabilities, sans exploits, for up to $250,000 a year. It’s marketed primarily as a tool for defenders, but customers can do what they want with the information on those Exodus zero days—ones that typically cover the most popular operating systems, from Windows to Google’s Android and Apple’s iOS.

The government of India chose to leverage this knowledge to indiscriminately assault China and Pakistan entities in hopes of hitting targets of interest. That wasn't what Exodus Intelligence's info feed was designed to do. It's only what it ended up being used for. And now the CEO of Exodus is acting like a parent disappointed a child has exceeded the boundaries he never bothered to set.

That feed is what India bought and likely weaponized, says 37-year-old Exodus CEO and cofounder Logan Brown. He tells Forbes that, after an investigation, he believes India handpicked one of the Windows vulnerabilities from the feed—allowing deep access to Microsoft’s operating system—and Indian government personnel or a contractor adapted it for malicious means. India was subsequently cut off from buying new zero-day research from his company in April, says Brown, and it has worked with Microsoft to patch the vulnerabilities. The Indian use of his company’s research was beyond the pale, though Exodus doesn’t limit what customers do with its findings, Brown says, adding, “You can use it offensively if you want, but not if you’re going to be . . . shotgun blasting Pakistan and China. I don't want any part of that.”

While it's great the CEO doesn't want any part of that, not placing limits on end users is always going to result in things like this. And while it's unlikely writing up a new ToS is going to deter customers from "shotgun blasting" people with the weaponry you've provided, it at least allows you to terminate contracts and access without having to engage in a bunch of costly litigation or fruitless negotiations.

And, if you're going to be in the business of selling exploits (or indirect access to exploits), you need to be way more proactive on the security front.

Brown is also now exploring whether or not its code has been leaked or abused by others. Beyond the two zero days already abused, according to Kaspersky, “at least six vulnerabilities” made by Moses have made it out “into the wild” in the last two years.

Whoops. That doesn't look good. But, in all fairness, even the NSA and CIA have seen their tech tools and exploits leaked, resulting in the infliction of misery worldwide by people a shade more malicious than the entities belatedly bemoaning the unplanned distribution of their digital secrets.

Speaking of belated, here's some regret from the cofounder of Exodus Intelligence, Aaron Portnoy.

[T]oday, the 36-year-old self-taught hacker, who dropped out of Northwestern to carve his own career in cybersecurity, worries that he never knew who had access to his code or how they used it. He now regrets relinquishing control over his zero days to salespeople. “It's almost like I was being taken advantage of . . . It felt very much like I was a tool that was being used for a bigger purpose that I really had no insight into,” says Portnoy, now plying his trade at Randori, a Massachusetts-based cybersecurity firm.

Sure, but not so concerning Portnoy didn't leap from Exodus to defense contract Raytheon, and from there to startup Boldend, which partnered with Raytheon to (and I'm directly quoting here) "accelerate cyber operations with greater force."

While it's great that Exodus has revoked the Indian government's access to its exploit feed, the larger problem remains. American companies are aiding and abetting mass surveillance, targeting of dissidents and activists, and other human rights abuses by not being more selective of who they sell to or placing limits on how their products are used. This puts them in the same shady neighborhood as overseas malware merchants like NSO Group and Hacking Team. Sooner or later, it's going to put them on the wrong end of UN sanctions or DOJ investigations. Until then, it appears it will be risky business as usual, making the United States home to plenty of proxy human rights violators.

Filed Under: china, cybersecurity, india, malware, pakistan, security, zero days
Companies: exodus intelligence

Report Again Finds US Government IT Security Sucks, Three Years After Saying The Same Thing

from the giant-wheel-of-dysfunction dept

Three years ago a US Senate Committee report showcased that the U.S. government's cybersecurity defenses were the IT equivalent of damp cardboard. The study found numerous government agencies were using dated systems that were expensive to maintain but hard to properly secure. It also noted how from 2008 to 2018, the government repeatedly failed to adequately protect sensitive data at the Social Security Administration and Departments of Homeland Security, State, Transportation, Housing and Urban Development, Agriculture, Health and Human Services, and Education.

Three years have gone by and guess what: very little has actually changed. The latest 47 page report (pdf) found that little meaningful improvement was made in the last three years, with cybersecurity at those same eight federal agencies earning four grades of D, three Cs, and a single B:

"It is clear that the data entrusted to these eight key agencies remains at risk. As hackers, both state-sponsored and otherwise, become increasingly sophisticated and persistent, Congress and the executive branch cannot continue to allow PII and national security secrets to remain vulnerable."

This report is just one of countless instances over the last two decades where the government was warned that it's expensive, shitty, dated systems simply weren't secure. In this report, of the eight agencies, only the DHS showed meaningful improvements in IT security:

"What this report finds is stark. Inspectors general identified many of the same issues that have plagued Federal agencies for more than a decade. Seven agencies made minimal improvements, and only DHS managed to employ an effective cybersecurity regime for 2020. As such, this report finds that these seven Federal agencies still have not met the basic cybersecurity standards necessary to protect America’s sensitive data."

Much like election security, there's a lot of bloviation and consultant bucks that get thrown around -- often with little to show for it. DC lawmakers often talk a lot about the importance of cybersecurity, but only as so far as it pertains to being helpful in terms of partisan fear mongering, lining the pockets of campaign contributors, weakening encryption for their own surveillance purposes, or protecting the interests of dominant domestic corporations. But when it comes to taking actual, intelligent, meaningful action (like oh, shoring up the security nightmare that is the internet of broken things), we fail repeatedly.

The report of course comes about seven months after Russian government sponsored hackers used a massive supply chain attack to gain access to systems at numerous US government agencies and over 100 corporations. And just four months after Chinese government sponsored hackers breached multiple federal agencies by exploiting vulnerabilities in the Pulse Secure VPN. While both events have taken the usual DC consternation, hand wringing, and big dollar consultant payouts in to new levels, who the hell knows if any of it leads to actual, meaningful reform.

Filed Under: cybersecurity, government it, government technology, homeland security, it, security

'Malicious' Actor Is Wiping The Data Of Countless Western Digital My Book Users

from the past-its-expiration-date dept

Owners of the Western Digital popular My Book external hard drives aren't having a particularly good week. The company is advising customers to stop using the devices for now after customers mysteriously found their data deleted. According to complaints over at the company's website (first spotted by Bleeping Computer), many users say they woke up to find that the content of their external USB-connected storage drives had been completely wiped. Worse, they couldn't log in to the device's administrative systems to run any kind of diagnosis on the drives:

"I have a WD mybook live connected to my home LAN and worked fine for years. I have just found that somehow all the data on it is gone today, while the directories seems there but empty. Previously the 2T volume was almost full but now it shows full capacity.

The even strange thing is when I try to log into the control UI for diagnosis I was-only able to get to this landing page with an input box for “owner password”. I have tried the default password “admin” and also what I could set for it with no luck. There seems to be no change to retrieve or reset password on this landing page either."

The problem appears to have begun at around 3PM on June 23, at which point these devices started receiving a remote command to perform a factory reset. This appears to still be happening on a staggered basis. The Western Digital announcement sent out to customers suggests that a malicious actor has found a way to compromise the devices, and is deleting data for their own amusement:

"Western Digital has determined that some My Book Live devices are being compromised by malicious software. In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live device received its final firmware update in 2015. We understand that our customers’ data is very important. At this time, we recommend you disconnect your My Book Live from the Internet to protect your data on the device. We are actively investigating and we will provide updates to this thread when they are available."

There's been absolutely no indication given of when customers can expect a fix. Western Digital stopped supporting the My Book Live in 2015 for cost reasons, leaving millions of devices with dated firmware and vulnerabilities. According to user threads at the company's website, some Western Digital MyDrive users who say they disabled all cloud functionality to protect themselves, say their data was wiped anyway. Since much of this data is encrypted, recovering it may prove to be a long shot, meaning that many users who thought they were being smart by backing up their essential files, will have likely lost everything permanently.

It's not that hard for an everyday consumer -- inundated with an endless sea of obligations -- to miss the handful of notifications (if they even existed) that their devices are now neither supported nor secure. Given the millions of shitily-secured network routers and IOT devices that are being connected annually, the scope of the problem (and our collective apathy to it) really can't be overstated. If you know somebody who uses this hardware for backups and storage, you might want to give them a nudge.

Filed Under: cybersecurity, external hard drive, malicious actors, mybook, ownership

Former FCC Boss Wheeler Says Trump FCC Napped On Cybersecurity

from the asleep-at-the-wheel dept

As we've made clear by now, the FCC under Trump spent four straight years kissing monopoly ass. From eliminating decades-old rules protecting consumers and competitors from the harms of media consolidation to gutting the FCC's consumer protection authority simply because AT&T and Comcast wanted it done, the agency under Pai was a textbook example of regulatory capture. There were a few high points (like the creation of a national suicide hotline), but by and large the FCC under Pai was just a mindless rubber stamp for the industry's wealthiest players.

While the Pai FCC was busy doing whatever AT&T and Comcast wanted, a lot of stuff those companies didn't care about fell off the table. Like any real rules governing the massive light pollution caused by low orbit satellites. Or any support for policies that would competitively challenge entrenched incumbents. And according to former FCC boss Tom Wheeler, a little thing called cybersecurity (more specifically, funds directed at smaller competitors to help them secure their networks):

"We are currently failing to use efficient regulatory mechanisms to oversee the security of these networks. The Department of Homeland Security has the expertise but lacks the regulatory authority of an agency such as the Federal Communications Commission. Yet, for the past four years, the Trump FCC was asleep at the switch, gutting cyber programs and refusing to exercise its authority."

The FCC has largely been a no show on the security and privacy issues plaguing the internet of broken things. And as Congress prepares to throw another $100 billion at America's broadband problem, Wheeler's worried that the funds won't come with any aid to shore up network cybersecurity. While a company like Comcast may not want or need that help, Wheeler argues that smaller broadband providers are going to need aid ensuring they're protected from the growing threat of cyberattacks like the one that just rocked Cox Media Group:

"It is precisely these factors that make such small rural companies prime targets for cyber hackers. The companies typically have fewer than 100 employees — some fewer than 10 — and often cannot afford dedicated cybersecurity personnel or cutting-edge defensive technology."

Of course lobbyists for incumbent giants like Comcast and AT&T are busy shaping what the final broadband bill looks like. That already means not only less money overall, but more subsidies sent to giant players, and less money sent to smaller companies -- especially if they're going to be providing any competitive challenge to incumbents. But throwing yet more money at broadband providers (an approach that already historically hasn't worked out that well for taxpayers) without providing funds to secure them could spell trouble as ransomware and other attacks increasingly target the most ill-prepared.

Filed Under: ajit pai, cybersecurity, fcc, tom wheeler

Arizona County's Voting Machines Rendered Unusable By OAN-Financed Vote Auditors

from the nice-work,-cyber-idiots dept

The libs have been owned. They've been owned so thoroughly that Maricopa County, Arizona is going to need to buy millions of dollars of new electronic voting machines.

Arizona Secretary of State Katie Hobbs sent a letter Thursday to Maricopa County officials to let them know that the fake "audit" of the 2020 election probably ruined hundreds of voting machines the county sent for "testing" under a subpoena from the state Senate. Since there's no knowing whether Cyber Ninjas, the QAnon enthusiasts running the audit, had messed up the machines, they can't safely be used again in future elections.

Once the machines were no longer under Maricopa County's control, Hobbs explained, the "chain of custody" was broken, leaving her with "grave concerns regarding the security and integrity of these machines," she wrote.

Before we get into the more expensive implications of this, let's backtrack a little to see how this came to be.

For months leading up to the 2020 presidential election, President Donald Trump and his enablers claimed the upcoming election would be fraudulent. Suspecting he was on his way out, Trump ramped up his baseless claims that everything from voting machines to mail-in votes couldn't be trusted.

Once he had lost, the claims went into overdrive. The election had been "stolen." Hundreds of true believers stormed the Capitol on January 6, 2021 with the intent of preventing the election from being certified as a win for Joe Biden.

The claims of fraud continued. Nobody could prove any fraudulent activity had occurred but Trump and his acolytes continued to insist Trump had been illegally removed from power. This group of idiots included several Congressional reps and Senators. It also included everyone from a pillow salesman to a cybersecurity "expert" who claimed his inability to properly compose a tweet was evidence of malicious hacking.

Welcome to Maricopa County, where everyday is another scene cut from "Veep" because it was considered too improbable. State senate Republicans hired the ridiculous-sounding "Cyber Ninjas" to perform "America's Audit" (called this despite the fact it's confined to a single county in a single state) -- a recount of every vote in the county.

Since then, it's been fiascoes piled on debacles piled on a foundation of conspiracy theories. It started with auditors working with blue pens that could be used to change ballots. Auditors are only supposed to use red pens, which can't be read by auditing equipment and voting machines.

That's the most sane part of this. The CEO of the Cyber Ninjas has tweeted out stuff about "stopping the steal." The audit is partially financed by One America News Network, one of several entities sued for defamation by Dominion Voting Systems. At one point, auditors were using UV lights and 5k cameras to search for traces of bamboo, following up on the absurd claim that a box of filled ballots had been shipped in from China. How this was supposed to prove a link between ballots and China is best left to the brain geniuses at Cyber Ninja, who probably assume nothing is above slanty-eyed furriners and their desire to elect Sleepy Joe.

Even the Republican-dominated Maricopa County Board of Supervisors found the whole thing appalling. Its scathing letter to state Senate leadership pointed out the auditors' inexperience and apparent inability to count and said the whole thing was nothing more than the state Senate placing election integrity in the hands of "grifters and con artists."

This brings us back to the latest insanity. The voting machines were turned over to the Cyber Ninjas, who then acted as though chain-of-custody isn't that big of a deal. Since they followed none of the steps needed to ensure the machines remained intact and secure, the county has no choice but to decertify them once the Ninjas are done entertaining their "stolen election" fantasies. This isn't just the Secretary of State saying this. This is also the DHS's election security experts.

[DHS officials] unanimously advised that once election officials lose custody and control over voting systems and components, those devices should not be reused in future elections. Rather, decommissioning and replacing those devices is the safest option as no methods exist to adequately ensure those machines are safe to use in future elections.

As many as 358 machines may be affected by the actions of cybersecurity "experts" who have no previous experience with either election security or conducting a vote audit. The total cost for replacement could be more than $6 million.

The only upshot is that local residents won't be paying for these. Thanks to the agreement reached with the so-called auditors, Maricopa County isn't responsible for costs like these. No, it will be the entire state paying for the clusterfuck that is "America's Audit." The state is on the hook. And with lawsuits already flying, taxpayers will be out even more money no matter what the outcome of this litigation is. And it all could have been prevented by either 1) hiring competent people to conduct the audit or 2) Senate Republicans not indulging the worst members and supporters of their party.

Filed Under: arizona, audit, chain of custody, cybersecurity, election security, elections, maricopa county, recount, voting machines
Companies: cyber ninjas

Thousands Of Security Cameras, Archived Footage Exposed After Surveillance Company Verkada Is Hacked

from the unsecured-security-cameras-are-the-best-security-theater dept

Put enough cameras up and pretty soon they become tasty targets for malicious hackers.

A group of hackers say they breached a massive trove of security-camera data collected by Silicon Valley startup Verkada Inc., gaining access to live feeds of 150,000 surveillance cameras inside hospitals, companies, police departments, prisons and schools.

Some of the more notable targets include Tesla factory cameras and security cameras deployed by Cloudflare. The hackers also apparently have access to archived video from these sources. Verkada has responded by disabling all internal administrator accounts -- something it probably should have done back when it was making news for doing the same thing, only without the participation of outside hackers.

Last year, a sales director on the company's sales team abused their access to these cameras to take and post photos of colleagues in a Slack channel called #RawVerkadawgz where they made sexually explicit jokes about women who worked at the company, according to a report in IPVM, which Motherboard independently verified and obtained more information about.

"Face match… find me a squirt," the sales director wrote in the company Slack channel in August 2019, according to one screenshot obtained by Motherboard.

Now, the same sort of thing can be done by anyone with access to the compromised system. The hackers involved here claim to be operating somewhat altruistically.

The data breach was carried out by an international hacker collective and intended to show the pervasiveness of video surveillance and the ease with which systems could be broken into, said Tillie Kottmann, one of the hackers who claimed credit for breaching San Mateo, California-based Verkada. Kottmann, who uses they/them pronouns, previously claimed credit for hacking chipmaker Intel Corp. and carmaker Nissan Motor Co. Kottmann said their reasons for hacking are “lots of curiosity, fighting for freedom of information and against intellectual property, a huge dose of anti-capitalism, a hint of anarchism -- and it’s also just too much fun not to do it.”

Add to that list "too easy." According to Kottmann, the hackers gained access to a "Super Admin" account after finding a username and password publicly exposed. That access has since been revoked (along with all other internal admin accounts), but the footage served up to reporters showed everything from eight hospital staffers restraining a patient to police officers grilling suspects.

Then there's the facial recognition tech grafted onto Verkada's cameras.

Verkada's website advertises that "all" of its cameras include "Smart Edge-Based Analytics," referring to the cameras' facial recognition, person identification, and vehicle analysis tools.

It's not clear which of Verkada's 24,000 customers were using these functions but they appear to be built-in. And its list of customers -- also exposed in the breach -- includes schools, banks, bars, breweries, churches, condo complexes, museums, airports, a Salvation Army Center, as well as the previously mentioned companies, hospitals, and prisons.

And, as was briefly noted earlier, Verkada's system allows customers to search recorded video by face, allowing users to compile screenshots of every instance in which the searched face was captured by the cameras.

Surveillance is a growth market. Amass enough market share and someone's going to want to see what you've collected. Verkada's use of admin accounts was already problematic given what we know about the mindset of some of its administrators. Giving admins access to all customer cameras and recordings may make it easier to address user problems, but without better security, it's also irresponsible.

Filed Under: cybersecurity, hackers, iot, privacy, security, security cameras
Companies: verkada