Security researchers at Ben-Gurion University of the Negev (BGU) were able to use infrared (IR)
light to control the behavior of security cameras infected with malware. The technique was detailed in a research paper published on Monday.
The technique is called "aIR-Jumper," and it will work with both professional and home security cameras, according to press release from BGU. It could affect LED doorbells as well, as they can also detect IR light, the release noted.
Using IR light, the researchers were able to achieve optical communication between air-gapped internal networks that acted bidirectionally, meaning messages could be sent and received. Air-gapped computers are isolated from the internet, the release said, and are often considered to be more secure than their connected counterparts.
SEE: Information security incident reporting policy template (Tech Pro Research)
The attack works in two ways. First, to get information from the camera, the researchers used malware to control its IR-emitting LEDs. Malware can control the way the camera emits the IR light, and can use it to send encoded signals back to the researchers, the release said. The attacker only needs a simple camera to record the message, and then he or she can decode it later.
"Security cameras are unique in that they have 'one leg' inside the organization, connected to the internal networks for security purposes, and 'the other leg' outside the organization, aimed specifically at a nearby public space, providing very convenient optical access from various directions and angles," Mordechai Guri, head of research and development for BGU's Cyber Security Research Center (CSRC), said in the release.
The attacker could send IR signals to the camera, in an effort to encourage other behaviors, the release said. The cameras can also be used for data exfiltration, including passwords and other sensitive data.
What's worse is that the attacker doesn't even need to be remotely close to the infected camera to create the communication lines. According to the release, the attacker could perform the operation from "hundreds of yards outside or even miles away with direct line of sight."
Getting Started with Advanced Analytics - A Planning Guide
In IT circles, talk about big data has shifted from hype and initial skepticism to a more considered conversation focused on using new and emerging technologies to capitalize on data to create business value.
No longer are people asking, "Is there value in big data?" Instead, they are asking, "How can I use data analytics solutions to create value for my organization?"
Given this compelling business case, it's no surprise that many companies are investing in analytics. These investments reflect the fact that from health care to retail, from banking to manufacturing, insights from massive amounts of data can enable organizations to make breakthrough discoveries, deliver better services, enrich the customer experience, and meet other business-driven goals.
White Papers provided by Intel
"Theoretically, you can send an infrared command to tell a high-security system to simply unlock the gate or front door to your house," Guri said in the release.
The 3 big takeaways for TechRepublic readers
Ben-Gurion University of the Negev researchers were able to control a malware-infected security camera using infrared light.
The technique is bidirectional, and can be used for data infiltration or exfiltration, and performed successfully from miles away.
This technique could be used to steal passwords, or even to unlock doors to a building, researchers said.
Stay informed, click here to subscribe to the TechRepublic Cybersecurity Insider newsletter.
SUBSCRIBE
Also see
How to build a successful career in cybersecurity (free PDF) (TechRepublic)
Surveillance cameras sold on Amazon infected with malware (ZDNet)
The Four Volume Cyber Security Bundle (TechRepublic Academy)
CCTV cameras enslaved to infiltrate air-gap networks (ZDNet)
Cybersecurity researchers claim every network router at risk of secretly leaking data (TechRepublic)
http://www.techrepublic.com/article/using-malware-and-infrared-light-hackers-can-turn-a-security-camera-into-a-business-spy/
