A security camera startup out of California, Verkada, was the victim of an attack that allowed the attackers access to thousands of security cameras. A group calling itself “APT-69420 Arson Cats” has taken responsibility for the attack, and claims that they were able to access the cameras after finding administrator credentials online. It seems these credentials were valid, and allowed them into over 150,000 cameras all over the world located in all kinds of facilities such as prisons, stores, and hospitals.
Companies notified of the breach have been working to confirm if their camera streams had been viewed and what information may have been exposed as part if they have. Verkada offered cloud base surveillance as part of a “next generation” of office security, including the ability to track individuals or create a surveillance history of an individual by tracking individuals (such as through facial recognition or what they are wearing), although not all customers use this feature.
While, at this time, it does not appear as if any of the surveillance footage has caused anyone harm – it does raise the question about the dangers of cloud based security. Leaving the manufacturer’s password in place is a security issue, but normally you only have to worry about a single building or network being compromised – but with cloud based services, a single vulnerability can expose many more devices.
