Analyzing the Security and Privacy of Cloud-based Video Surveillance Systems

Abstract

In the area of the Internet of Things, cloud-based camera surveillance systems are ubiquitously available for industrial and private environments. However, the sensitive nature of the surveillance use case imposes high requirements on privacy/confidentiality, authenticity, and availability of such systems. In this work, we investigate how currently available mass-market camera systems comply with these requirements. Considering two attacker models, we test the cameras for weaknesses and analyze for their implications. We reverse-engineered the security implementation and discovered several vulnerabilities in every tested system. These weaknesses impair the users' privacy and, as a consequence, may also damage the camera system manufacturer's reputation. We demonstrate how an attacker can exploit these vulnerabilities to blackmail users and companies by denialof-service attacks, injecting forged video streams, and by eavesdropping private video data -even without physical access to the device. Our analysis shows that current systems lack in practice the necessary care when implementing security for IoT devices.

The impact of IoT security labelling on consumer product choice and willingness to pay

“…For example, research has shown that-by taking advantage of hardware or protocol flaws-attackers can exploit man-in-the-middle attacks to intercept communications from and to wearable devices to steal personal information, invading user's privacy and exposing them to the risk of identity theft [7]. Attackers can also take advantage of the weak authentication and encryption protocols used in many cameras enabling them to eavesdrop on camera streams [8], again raising privacy concerns and creating opportunities for crime [9]. Such concerns may impede consumer confidence in, and the uptake of, the benefits the IoT promises to deliver [4].…”

Re-engineering Real-time Intrusion and Burglary Detection using Fuzzy Technique

“…Recently, in a research by Obermaier and Hutle [12] provided a practical analysis of the security and privacy of four major cloud-based video surveillance systems. They reverseengineered the security implementation and discovered several vulnerabilities in every of the tested systems.…”

Looking Through Walls: Inferring Scenes from Video-Surveillance Encrypted Traffic

“…Several works have shown how a potential attacker can gain accurate insights on users' activity and data. Sensitive information can be gathered by installing a Man-in-the-Middle (MitM) malware that re-transmits data [2,3], or by eavesdropping packets exchanged on a shared network channel [4]. Network engineers have thus been designing encryption strategies to prevent third party users from accessing the transmitted information (e.g., SSL/TLS).…”