[LINK] Security cameras can tell burglars when you're not home, study shows

[Bernard Robertson-Dunn]

[Oh dear. A reminder that a simple solution will (not might, but will)
have unexpected and unintended consequences

[See article for pictures

Security cameras can tell burglars when you're not home, study shows
https://edition.cnn.com/2020/07/06/tech/home-security-cameras-risks-scli-intl-scn/
By Jack Guy, CNN Business
July 6, 2020
(CNN Business)

Some popular home security cameras could allow would-be burglars to work
out when you've left the building, according to a study published Monday.

Researchers found they could tell if someone was in, and even what they
were doing in the home, just by looking at data uploaded by the camera
and without monitoring the video footage itself.

The international study was carried out by researchers from Queen Mary
University of London (QMUL) and the Chinese Academy of Science, using
data provided by a large Chinese manufacturer of Internet Protocol (IP)
security cameras.

Cameras like these allow users to monitor their homes remotely via a
video feed on the internet, but the researchers say the traffic
generated by the devices can reveal privacy-compromising information.

Popular security cameras such as those manufactured by Nest (pictured
here) present the same privacy risk.

Study author Gareth Tyson from QMUL told CNN that data uploads of the
unencrypted data increase when a camera is recording something moving,
so an attacker could tell if the camera was uploading footage of someone
in motion, and even different types of motion like running or sitting.

The risk is that "someone who is specifically targeting an individual
household rocks up outside with a device to try and start passively
monitoring traffic," he said.

Tyson told CNN that an attacker would require a decent level of
technical knowledge to monitor the data themselves, but there is a
chance that someone could develop a program that does so and sell it
online.

Noting that he hasn't seen any direct evidence of this kind of attack
taking place, he said one potential use would be if someone wanted to
burgle your house.

"They monitor the camera traffic over an extended period of time, and by
looking at the patterns that are generated by those cameras over maybe a
week, they then start predicting the following week when you're most
likely to be in the house," he said.

In order to reduce the privacy risk, companies could randomly inject
data into their systems to make it harder for attackers to spot a
pattern, he said.

Tyson said the team are trying to extend their research to work out how
to maintain camera performance while reducing privacy risks.

At present, cameras are "fairly stupid items" in order to keep
manufacturing costs down, said Tyson, uploading data whenever motion is
detected.

"What we want to do is have a more intelligent system that allows the
camera to understand what that motion is, assess the level of risk, and
only upload it and alert the user in a case where the camera feels that
it's worthy doing," he said.

For example, someone who owns a cat probably doesn't want to be alerted
every time the camera detects the animal walking around, but they would
certainly want to know if a human intruder were spotted.

Tyson said this is the first study to investigate the risks posed by
video streaming traffic generated by the cameras.

The global market for the devices is expected to be worth $1.3 billion
by 2023, according to the press release. Popular brands include Xiaomi
and Nest, which is owned by Google.

While the study authors did not analyze data from those brands, they did
find that their cameras present the same privacy risk. CNN has reached
out to Nest and Xiaomi for comment on the research.

The study was published at the IEEE International Conference on Computer
Communications, which brings together researchers in networking and
related fields.

-- 

Regards
brd

Bernard Robertson-Dunn
Canberra Australia
email: brd at iimetro.com.au