Hackable Speed Cameras Highlight Risk Of Rush Toward IoT-Enabled 'Smart' Cities

from the if-you-build-it-(poorly)-they-will-come dept

We’ve been talking at length about how the lack of security in the Internet of Things space is seen as a sort of adorable joke, but isn’t always a laughing matter. While the hillarious stupidity of some of the “smart” products flooding the market is undeniable, the reality is that the abysmal state of security in “IoT” devices (read: little to none) is creating millions of new attack vectors every year. And as Bruce Schneier recently warned, it’s only a matter of time before the check comes due, and these vulnerabilities contribute to hacking attacks on core infrastructure resulting in notable fatalities.

Refrigerators that leak your Gmail credentials are one thing, but this looming calamity is going to be made notably worse by the rush toward “smart” cities. The same hardware vendors that can’t bother to secure their consumer-side hardware haven’t done a much better job securing the gear they’re shoveling toward cities under the promise of a better, more connected tomorrow. Case in point: Kaspersky Lab researchers have discovered that a significant number of city speeding cameras are, you guessed it, easily hackable:

“According to Vladimir Dashchenko and Denis Makrushin from Kaspersky Lab, these devices can be easily manipulated. The results were published in a security conference paper about the security hazards in smart cities…The Russian researchers were using the Shodan search engine to explore the security implications of the “smart city” fad. They hypothesized that the rush to deploy high-tech, “Internet of things” devices to improve the municipal infrastructure often meant that security was left behind.

And they were right. Except security wasn’t just subpar on speed cameras made by vendors like Redflex Traffic Systems. In many instances it didn’t exist whatsoever:

“We decided to check that passwords were being used,” Dashchenko and Makrushin wrote. “Imagine our surprise when we realized there was no password and the entire video stream was available to all Internet users. Openly broadcast data includes not only the video stream itself, but additional data, such as the geographical coordinates of cameras, as well.”

The researchers noted that even in not-so-smart cities, the cameras are already processing gigabytes of citizens’ data with little to no protection. Worse, the researchers found that given these cameras are tied to larger networks, hackers could potentially gain access to databases of stolen vehicles and add or remove vehicles from said lists. Their full paper, Fooling The Smart City (pdf), is worth taking a look at, and highlights how a significant number of kiosks — used for everything from ticket sales to bicycle rentals — are also vulnerable.

The result isn’t just an exponential explosion in vulnerabilities. These compromised devices are now being used in historically massive new DDoS attacks, that appear to be getting larger by the day. On the heels of the recent, record-setting 620 gigabit-per-second DDoS attack against Brian Krebs (which was fueled in part by compromised IoT devices), a new attack this week launched against a French web host peaked at an incredible 1.1 terabits per second, driven in part by — you guessed it — hacked security cameras.

Krebs subsequently noted this week that the source code for the IOT-fueled DDoS that took down his website has been released, all but guaranteeing that mammoth, even larger attacks fueled by not-so-smart cars, not-so-smart locks, and not-so-smart power outlets are about to become the norm.

Filed Under: , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Hackable Speed Cameras Highlight Risk Of Rush Toward IoT-Enabled 'Smart' Cities”

Subscribe: RSS Leave a comment
That One Guy (profile) says:

"But... that's illegal!"

I for one don’t believe a single word of it, I mean everyone knows that hacking is illegal, and as such no-one ever does it. Why would companies spend time and money protecting against a mythical threat that never happens when The Law is protection enough.

If, for the sake of argument you accept that despite The Law making such actions illegal people and groups still do them(impossible I know, but bear with me) then clearly the proper response is not to burden an already unfairly burdened company by insisting on any sort of ‘security’, but to make the law even harsher, in the sure expectation that that will deal with the theoretical ‘criminals’ who are breaking the current law and hacking into the devices/services.

That Anonymous Coward (profile) says:

Security costs to much.
The penalties, if they ever come, are paltry.
We can’t judge corporations for cutting corners to make money, they have to worry about shareholder value.
The CEO might get fired if things are bad enough but the giant golden parachute makes the landing soft, and more corporations will court the CEO to make them lots of money too.

Lurker Keith says:

Watch_Dogs = what not to do, not something to copy

Watch_Dogs was a game, not an instruction manual. If anything, it was a WHAT NOT TO DO demonstration. The entire point of Watch_Dogs was that a “smart” city was the worst idea ever AND would be a hackers’ playground.

Why does the world keep taking entertainment things making fun of what not to do, & treat them as a guide on how to do things? Shouldn’t they have learned SOMETHING by now?

Seriously, what sane anything could copy Ubisoft, at this point, anyway?

Whatever says:

Karl, there is a very basic difference between a “hacked” device and one that can have it’s normal functionality access remotely: What you can do with it.

Unless someone specifically changed the firmware on the cameras or otherwise changed the software that it is running, they can only do what the device could do to start with. For the traffic cameras, that means seeing the video portion including it’s location information.

Turning it into a DDoS bot would require a big step up the ladder to actually change the unit’s basic function, such as blindly sending the video feed to a given IP (to create junk traffic). That would require a hack much beyond just noting a lack of a password.

Again, good try, but just like with cable, you seem to be beating the IoT drum a little to hard and often.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...