Unsecured Security Cameras Turned Into Botnets

When you take a moment to count the number of internet-connected devices in your home, the tally may surprise you. There are smart TVs, routers, computers, tablets, smartphones, smart thermostats and refrigerators, security systems, and even toilets that can be flushed from afar. All of those devices are a potential access point for cybercrimals. Recently the security company Incapsula found somewhere around 900 Linux-based closed circuit television (CCTV) cameras had been turned into a botnet.

A botnet is a group of computers that have been taken over without owner permission and controlled as a group to do various types of activities; usually with a malicious intent. According to Kaspersky Labs and Symantec, these pose the biggest threat to the Internet, out-doing spam, viruses, and worms.

While security devices are intended to make us feel more secure, and other internet-connected devices make our lives a little more convenient, there are risks associated with using them.

2

• The first step is to change the default logins and passwords that come with them. In this case, that is exactly how the incident happened. The default login credentials had not been changed.

• Once they are installed and are internet-capable, the updates to the software and firmware that run them should be downloaded and installed. Often, they sit on shelves for a long time and updates have been released in the meantime. You want those latest ones applied.

• If your devices have a feature that will allow them to apply updates automatically, switch that to the “on” position. If not, mark a date every quarter or even more frequently, to check for updates. If there are any, apply them right away.

• Don’t forget to choose strong passwords and use a different one for each device. Make sure they have at least eight characters, are not common words, nor do they contain private details about you or your loved ones. Also include one or more special characters and combine upper and lower case letters. Don’t forget to add in a number or a few.

• If you are going to have someone else install devices for you, make sure they are qualified to do it securely and are experienced. As soon as they leave, change the passwords.

Incapsula reported that the security cameras had been used to perform a “run of the mill” type of denial of service (DOS) attack using cameras from several different brands that all had less-than-adequate security features out of the box. In some cases, the devices had been compromised by multiple people.

All the compromised devices were running BusyBox and included a variant of the malware commonly known as Lightaidra or GayFgt. This scans the device for BusyBox software and open Telnet/SSH services.

Just because technology makes our lives more convenient, we shouldn't make it more convenient for cybercriminals to cause trouble. Take a few minutes and secure them.