Stopping Surveillance 'Videojacking'

By: John Honovich, Published on Feb 16, 2011

A rising fear among security professionals is that surveillance video can be 'hijacked' and put on the Internet, resulting in embarassment or worse for the organization involved. A number of people are calling for more sophisticated and secure techniques to protect surveillance video. Unfortunately, such techniques do little to address the real risk and key threats to surveillance video.

A good example of the common but faulty recommendations offered can be found in a Feb 2011 Retail Solutions Online article [link no longer available] where end to end encryption from the camera through the monitoring client is advocated. While this is technically possible (in at least some systems) and may be important for proving the validity of evidence in court, it does little to address the threat of videojacking.

Most of the videos that are embarassing or hurting organizations are coming via mobile phones - either directly recording an incident (e.g., the Seattle police fight) or by filming the screen of a computer playing surveillance video (e.g., the Pennsylvania fountain case). Phones provide an easy and quick way to capture and share surveillance video.

Phones are a much more dangerous threat towards sharing surveillance video than hackers. With phones, there's no need to be a technology expert or network hacker to access the video. Just be inside the premises or the security monitoring center and click record on your phone. By contrast, hacking surveillance systems is a lot of work for relatively little gain compared to what else one can access on a corporate network (see our review/discussion on Is Hacking IP Cameras a Major Risk?).

To stop misuse of phones, we see 2 fundamental options:

  • Physically restrict people from having phones in areas where there is surveillance
  • Strengthen access control to video surveillance systems

The first option is generally not feasible unless you are in a maximum security area. As such, the second option, controlling access to surveillance systems is key. Many users leave their surveillance monitoring stations on all day. While this increases convenience and is often important to let people quickly look in on what's happening in a facility, unrestricted access means that someone with a phone can capture surveillance video in a minute. 

Tactics to restrict access include limiting the rights of operators to access recorded video and automatically timing out users after inactivity. Equally important and very basic, in surveillance, too often users share common username/passwords ('guard' and 'guard' or 'admin' or 'admin'). This makes auditing extremely difficult while increasing the chance that unwanted people access the system.

Because of mobile phones, stopping videojacking will not be easy. The most practical way to impact this is through improved access control to video, not encryption.

1 report cite this report:

Wireless Video Surveillance Hijacking Threat on Mar 25, 2011
An Australian investigative report is highlighting the risk that video surveillance systems face from wireless hijacking. In this note, we examine...
Comments : Members only. Login. or Join.

Related Reports

2020 Camera Book Released on Jan 10, 2020
This is the best, most comprehensive security camera training in the world, based on our unprecedented testing. Now, all IPVM PRO Members can get...
2020 IP Networking Book Released on Jan 06, 2020
The new IP Networking Book 2020 is a 280 page in-depth guide that teaches you how IT and telecom technologies impact modern security systems,...
Verint Victimized By Ransomware on Apr 18, 2019
Verint, which is best known in the physical security industry for video surveillance but has built a sizeable cybersecurity business as well, was...
Manufacturer Favorability Guide 2019 on Jun 12, 2019
The 259 page PDF guide may be downloaded inside by all IPVM members. It includes our manufacturer favorability rankings and individual...
Security Fail: ASISNYC Auto Emails Passwords In Plain Text on May 14, 2019
ASIS NYC automatically emails a user with the password the user just entered, in plain text, when one registers for the site / event, as the...
Axis Suffers Outage, Provides Postmortem on Aug 15, 2019
This week, Axis suffered an outage impacting their website and cloud services. Inside this note, we examined what happened, what was impacted...
Suprema Biometric Mass Leak Examined on Aug 19, 2019
While Suprema is rarely discussed even within the physical security market, the South Korean biometrics manufacturer made global news this past...
3 Weeks Later, Honeywell Still Cannot Say Whether They Are Vulnerable To Dahua Wiretapping [Now Admits] on Aug 27, 2019
The Dahua wiretapping vulnerability and Dahua's decision to delay disclosing it until IPVM inquired underscored problems with cybersecurity and...
Verkada Notification Outage on Dec 12, 2019
Verkada is suffering an event notification outage and analytic search failures. Inside, we examine what the issues are, what Verkada told IPVM...
IPVM Opens 12,000 Sqft Testing Facility on Dec 16, 2019
IPVM is proud to announce the opening of the world's first video surveillance testing facility that will allow us to significantly expand our...

Most Recent Industry Reports

Hanwha Wisenet X Plus PTRZ Tested on Feb 14, 2020
Hanwha has released their PTRZ camera, the Wisenet X Plus XNV-6081Z, claiming the "modular design allows for easy installation". We bought and...
PRC Warns Against China Video Surveillance Hacks, Hikvision Targeted on Feb 14, 2020
Hackers are targeting China video surveillance manufacturers and systems, according to the PRC's main cyber threat monitoring body. The hackers...
IPVM Conference 2020 on Feb 13, 2020
IPVM is excited to announce our 2020 conference. This is the first and only industry event that will be 100% sponsor-free. Like IPVM online, the...
Bosch Dropping Dahua on Feb 13, 2020
Bosch has confirmed to IPVM that it is in the process of dropping Dahua, over the next year, as both IP camera contract manufacturer and recorder...
BluB0X Alleges Lenel, S2, Software House Are Dinosaurs on Feb 13, 2020
BluB0X is running an ad campaign labeling Lenel, S2, Software House, Honeywell, AMAG and more as dinosaurs: In a follow-up email to IPVM,...
London Live Police Face Recognition Visited on Feb 13, 2020
London police have officially begun using live facial recognition in select areas of the UK capital, sparking significant controversy. IPVM...
Converged vs Dedicated Networks For Surveillance Tutorial on Feb 12, 2020
Use the existing network or deploy a new one? This is a critical choice in designing video surveillance systems. Though 'convergence' was a big...
Monitoreal "Completely Autonomous" Home AI Tested on Feb 12, 2020
Monitoreal claims to allow users to "see the things you want (people, vehicles, animals) and ignore the things you don’t”, using AI to distinguish...
Cisco Video Surveillance Is Dead, Long Live Cisco Meraki Video Surveillance on Feb 11, 2020
A dozen years ago much of the industry thought that Cisco was destined to dominate video surveillance. They stumbled repeatedly, failing. Now it is...
BICSI For IP Video Surveillance Guide on Feb 11, 2020
Spend enough time around networks and eventually someone will mention BICSI, the oft-referenced but only vaguely known standards body prevalent in...