Breach Brief: Security camera footage from homes and businesses leaked online

The UK Information Commissioner’s Office is warning the general public about a website containing thousands of live feeds from stand-alone webcams and CCTV systems to baby monitors.

What information was breached? A Russian website is sneaking a peek into the homes, gyms and offices of innocent people throughout the globe. Not only does the website show these unfiltered images, CBS News reveals that they also provide the exact coordinates of the location, complete with zip codes and links to a map. The hackers note that their site has been created in an effort to highlight the significance of security, urging those with remote-access cameras change their manufacturer’s default passwords.

How many are affected? At the moment, there are more than 4,000 cameras listed in the United States, 600 from the UK and over 10,000 others from 152 countries worldwide. Furthermore, exposed footage ranges from unmade children’s beds and kids watching television in the comfort of their own homes to living rooms and workplace lounges. Heck, snapshots from places like car insurance sales offices and candy stores to tattoo parlors and backyards have been released to the public. With an estimated 350,000 remote-access cameras sold in the UK last year alone, the ICO warned that those without password protection or with weak passwords could be vulnerable to hackers. This doesn’t include those from the 150-plus other countries as well.

What are they saying? “This is a threat that all of us need to be aware of and be taking action to protect against. Remember, if you can access your video footage over the Internet, then what is stopping someone else from doing the same? You may think that having to type in an obscure web address to access the footage provides some level of protection. However, this will not protect you from the remote software that hackers often use to scan the internet for vulnerable devices,” explained Simon Rice, ICO’s Technology Group Manager for the .

This incident represents a perfect model as to why the Internet of Things requires strong security, including encryption and authentication. In fact, we could not have created a demo any better than this to exemplify that point. “The cameras are IoT nodes by default. The website is a hacker. The data is intercepted and misused. Perhaps this notion of hackers posting your data to the net could be called the inadvertent IoT. We are all vulnerable which should drive the realization that built in security is paramount,” explained Atmel’s resident security expert Bill Boldt. “Anyways, this really brings it all home… literally.”

Is someone spying on you through your webcam? It is becoming increasingly clear that embedded system insecurity affects everyone and every company, so how can you ensure that you are indeed protected?