Several years ago, security cameras joined the legions of IoT devices when they began to operate by connecting directly to the internet. This has had several benefits: it lowers costs and allows their use case to be brought closer to the end user, be it a company or a private individual, without going through expensive surveillance companies. But, as always seems to happen with technological advances, this is a double-edged sword. Along with the benefits come potential security breaches. What problems are associated with IP cameras and how can we prevent them?

Security cameras for all

With the appearance of webcams, it was only a matter of time before the concept evolved into IP cameras. These devices are substantially better than other types of cameras because they are much cheaper to produce and do not require a computer (or even wiring) to transmit the images, which can be controlled from a PC or even from a mobile phone. This has enormous advantages, since installing a video surveillance system is possible with little money and in a simple way.

So great is their success as IoT devices that private users can even make their own camera system at home. This goes for companies as well, of course, since many surveillance services have chosen to use these advances to their advantage, at the expense of traditional CCTV systems. In any case, whether the company has an IP camera system managed by an internal team or if it has an external company, these cameras offer the same opportunities. And they also suffer from the same safety hazards.

What problems do they present?

Like other IoT devices, or any other element that transmits information, IP cameras are likely to be hacked. This implies three main consequences: the first one is, of course, to access the content that a camera records, being able to obtain images or sensitive information about the company without anyone knowing. Second, they can also be hacked to display fake content. Third, and probably much more important because of its implications, like other IoT devices, IP cameras are vulnerable to specialized malware. These devices are not usually the final goal but a means to attack: they can be the access route to the network of an entire company.

Among this type of attack are the dangerous Reaper, IoTrooper, Persirai, and others like them, which, analysts say, are infecting a greater number of these devices every year. The consequences? Some of these botnets, such as Reaper, have yet to face the music, while others, as we saw in 2016, have shown to be effective in guaranteeing access to the networks to which they are connected or participating in DDos attacks.

The most famous case to date is the offensive against Dyn in October 2016. As an Internet provider for companies such as Amazon, Netflix and Twitter, the DDoS attack on Dyn paralyzed much of the Internet for hours. And the botnet that allowed the attack (Mirai) was not composed of computers, but of IoT devices, among which were many IP cameras.

The main problem with IP cameras, like other devices related to the Internet of Things, is that they are not properly secured, as they do not have enough capacity to effectively encrypt wireless communication, or have security issues when connecting to external servers. Manufacturer participation is also essential — but not always offered, as increasing security measures can be costly and cut into their profits.

Preventing a breach is possible

There is no such thing as an unbreachable network. But we can do a fine job of securing one with the right measures. First of all, we should always opt for cameras connected by cable, and not wirelessly, which greatly diminishes the likelihood of a breach.

Secondly, we must maintain, if possible, our own server that manages data coming from the surveillance system. When data is longer in our control, the possibility of a security failure is never far off. As  long as we control the network completely, and the data, in turn, does not leave the company, the communications will be safe.

With this is in mind, it is absolutely essential to monitor traffic to avoid data loss or unwanted malicious code being injected into our systems. Solutions like Panda Adaptive Defense 360 ​​allow us to maintain an iron grip on network security, and in real time. Security breaches on IP cameras can be identified in the same way as any other attack on connected corporate devices, so preventing them is, of course, possible.