Russia Hacks Doorbell Cameras To Spy On NATO Bases (yahoo.com) 30
Dutch intelligence agencies say Russian hackers have been hijacking unsecured internet-connected cameras, including likely doorbell and security cameras, to spy on NATO military bases and transport routes used to move weapons to Ukraine. "Organisations with IP [internet protocol] cameras on these routes have now been warned so that they could take action," said the AIVD domestic security and MIVD military intelligence agencies. Targeted NATO member states include the Netherlands and Ukraine. The Telegraph reports: While the intelligence agencies did not specify the type of cameras hacked, the doorbell systems are frequently used by people to monitor their property from mobile phones. Hackers then use readily available apps to scan for devices that might be accessible. The Dutch investigation found that many of the cameras were unsecured, and "often have standard passwords, outdated firmware and standard configurations." They said: "When the IP camera is identified, the malicious party can attempt to access the IP camera via the internet. This is often relatively easy, because many IP cameras connected to the internet are insufficiently secure."
[...] The practice is now considered easier and cheaper than using drones and satellites to gather intelligence. It also aids operational surprise because most camera owners are blissfully unaware their devices have been penetrated by hackers. Ground-based cameras offer a unique perspective on the terrain, which isn't the case with conventional aerial-based spy kit.
[...] The practice is now considered easier and cheaper than using drones and satellites to gather intelligence. It also aids operational surprise because most camera owners are blissfully unaware their devices have been penetrated by hackers. Ground-based cameras offer a unique perspective on the terrain, which isn't the case with conventional aerial-based spy kit.
Oh no the Russians! (Score:2, Redundant)
Russian hackers have been hijacking unsecured internet-connected cameras
The article doesn't say why they think it's Russians.
Taking control of a device with a default password is not really a heavy hacking task. It doesn't require nation state resources. You could probably do it yourself in an afternoon, if you were motivated.
Re: (Score:3)
Re:Oh no the Russians! (Score:5, Insightful)
If it is possible to walk into cameras on NATO bases like that, honestly they deserve it. This shit should be locked behind seven layers of impossible.
Per TFA,it's civilian cameras on transit routes, so what it sounds like is they look for cameras along major roads and hack into them to follow shipments. It would not surprise me if they were trying to hack phones/watches/fitness bands or anything that can track individual then look at data to try to find the drivers by correlating the data with traffic data.
Re: (Score:2)
Re: Oh no the Russians! (Score:2)
Observe the weather and local time of day to narrow it down
Re: (Score:2)
Re: (Score:2)
How exactly do you determine a camera is on a major road or route from the internet? This sounds more conspiracy theory than reality when you look at the difficulty in correlating cameras with locations.
The difficulty would depend on what data the camera provides, analysis of traffic past the camera and available information about the locations of potential interest. A serious effort would be more than hacking cameras, it would include on the ground surveillance to collect information on route terrain, what identifying information cameras openly broadcast, correlating that with camera information and footage collected, etc. Government cameras such as traffic cameras might be a better target since they wou
Re: (Score:2)
Re: (Score:2)
How exactly do you determine a camera is on a major road or route from the internet? This sounds more conspiracy theory than reality when you look at the difficulty in correlating cameras with locations.
What?
There's a whole slew of "games" that involve looking at a Google Street View image and figuring out where in the world it is. Timed competing teams try to get it as close as possible before the other team does.
Point is... if you can see what the camera sees, it's not so hard to figure out where it's at. You won't get them all, and almost none of them will be useful to you, but if you filter by geo-IP and get access to enough cameras, it's worth the time.
Re: (Score:2)
If it is possible to walk into cameras on NATO bases like that, honestly they deserve it.
The camera feed is fake.
Re: (Score:3)
Kremlin-based hackers accessed the devices to monitor the transfer of military equipment to Ukraine, the AIVD domestic security and MIVD military intelligence agencies said.
Their joint investigation found the Russian operation had targeted cameras pointing towards military transport routes in the hope of identifying what weapons were being sent to Kyiv.
Do you think the people who found the hacked devices can't backtrace IPs and proxies?
Re: (Score:1)
Kremlin-based hackers accessed the devices to monitor the transfer of military equipment to Ukraine
Again, it doesn't say why they think they were "Kremlin based hackers."
I personally tracked the IP address of an open webcam I was monitoring, and I found it was hacked by redmid17 - 1217076. I have all the proxy traceroute logs. Very suspicious.
Fact check (Score:4, Interesting)
Targeted NATO member states include the Netherlands and Ukraine.
Ukraine is not a NATO member state. If you know anything about the conflict, you'd know that's kinda the whole point.
Seriously, who writes these summaries?
Re: (Score:3)
Seriously, who writes these summaries?
NATO supporters?
Re: (Score:3)
"Seriously, who writes these summaries?"
Russian hackers?
Re: (Score:2)
Seriously, who writes these summaries?
https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: Fact check (Score:3)
Importantly, there was a comma before Ukraine in TFA, so it may not be automatically incorrect after all. Not a clear cut case for using a semicolon there either, as that would be a more substantial pause than needed.
Seems like wasted effort (Score:2)
They're not going to identify where the weapons are deployed and they're more or less already notified in the public press that they're coming and from which countries. Also... it's not like Russia can do anything about it. They're not going to attack a NATO base to destroy a weapons cache. They can't strike all that far into Ukraine accurately enough to target anything specific either.
I'm all for Russia wasting effort that could have been applied elsewhere to give more advantage to them on the battlefi
Old school... (Score:1)
Obvious and stupid (Score:2)
I just do not understand how so many people are so freakin' STUPID.
They have abandoned their privacy, thinking nobody cares about them. But it has gotten so cheap to spy on people that you can spy on everyone, aggregate the data and suddenly everybody cares about the data.
Every doorbell camera like this should come with a large warning (bigger than the doorbell camera) that says:
"Thieves WILL access this camera and use it to figure out when you are on vacation. Your ex boyfriend will access it and see who
That;s why i work on EU CRA (Score:4, Informative)
As much as it sucks to comply to it, EU CRA that will be in full force on Dec'27 is supposed to combat these problems.
Re: (Score:2)
It will. The most important part is that it will allow real liability, because with the risk management and documentation requirements it will make it possible to later find out who did "cheaper than possible" engineering and have them pay for the damage done and probably some real fines on top of that.
Yes, getting into compliance sucks. I talk to people that struggle with that regularly. But I expect every other engineering discipline though that when they finally had to fix their ways. And overall it will
Re: (Score:2)
As much as it sucks to comply to it, EU CRA that will be in full force on Dec'27 is supposed to combat these problems.
I suspect more people will exit EU markets from the liability risks alone before even getting to the question of compliance.
Crappy insecure tech ... (Score:2)
... is crappy and insecure. Does not even require "Russia" to be a really bad idea.