BigBrother’s Gaze: A YouTube channel was streaming a live feed from inside the Lang Suan Prison in Thailand. The attacker, who is not known other than by the YouTube name BigBrother’s Gaze, managed to break into the security cameras at the prison and started live-streaming the prisoners. A reporter who stumbled across the page alerted the prison to the incident, who in turn filed a police report and turned off the security cameras until the live feed was taken offline. The YouTube account also contained surveillance videos from a Thai company’s office, street views of Salt Lake City, an office in Australia and a café in Amsterdam.
Analyst Notes
Exposing the privacy of the prisoners is a concern for the prison system and after they realized the live stream was happening, they ordered the cameras to be turned off to protect the privacy of the prisoners. However, that also left the prison exposed because they did not have any security cameras within the facility for a period of time. This risk is one that many people may not consider when hacking into cameras for live feeds, but it is a bigger risk to take them offline than the exposed information in this case. IoT (Internet of Things) devices is any device that is connected to the internet–such as security cameras. Having multiple feeds of cameras could potentially indicate that the attacker found the same vulnerability in the cameras if all of the places were using the same type of cameras, however, that information has not been released yet. IoT devices in general typically lack basic security protocols and their manufacturers are not the best about supplying updates to these devices. Anyone using cameras or other IoT devices should install security patches whenever possible , they should always be installed on their own segment of the network, behind a firewall that only allows access by the range of IP addresses used by the organization that owns the cameras, and only the ports needed to administer the cameras. Doing this helps protect the cameras from being accessed by unauthorized parties, even if the cameras contain vulnerabilities or backdoor access methods that can’t be patched.
