Insecam
Insecam and Korea⌗
Insecam is a website which crawls the insecure network cameras connected to the Internet without any authentication throughout the world. According to the website’s FAQ, they are collecting the network cameras without password protection and listing the live video feed of them. They also claims that the cameras are not hacked, but the vulnerable software may enable the remote access without any authentication. The website provides a grouped view by camera manufacturers, installed countries and cities, places. Unless the network camera is supposed to broadcast a public video stream, the owner of the network camera is supposed to apply at least a proper password authentication to protect their video stream.
The installation and usage of video surveillance devices are regulated by Personal Information Protection Act1, Article 25. According to the law, the owner of the video surveilance device must secure their device in order to protect the personal information. In addition, the device must not record any voice and record places outside of its intended purpose. Regardless of the legal code, the number of video surveilance devices installed by public institutions are in constant rise2, and about 1.3 million devices are installed as of 2020. There is no accurate number of video surveilance devices installed by private person, but one report estimates the number as 13 million devices in 20173. In addition, about 89 percent of Korean cars have dashcams installed in 20194.
At least the legal code seems to be good, but how come the picture below became the reality?
As of the time of the writing, South Korea is ranked 2nd in the Insecam’s country list. To make things even more ironical, Insecam website is blocked in Korea by Korea Communications Standards Commission (KCSC). The block was decided around early 20165, to “protect” the privacy of Korean people. This block is not effective against those who outside of Korea, and as everyone knows, cybercriminals these days do not know the national border. The root cause of this problem – unprotected network camera – remains unsolved, as Korean police decided that there is no way to inform the individuals on the problem of their network camera5. To make things more worse, rebadged cheap camera by Korean companies often do not get adequate support from the original manufacturer, leaving the users vulnerable. This was demonstrated in Petzview incident around 2018.
The Petzview Incident⌗
There was a network camera named Petzview, which was marketed towards companion animal owners to monitor their loved ones from outside of their home. The device was sold for several years, and was used by not only individual peoples but also by veterinary clinics too. The hardware itself was not that special as seen in the image below.
In October 2018, Petzview announced that they will shut down their web service6 to share the live footage of Petzview devices7 and discontinue the mobile app to control the network camera. According to the news report, an owner of Petzview network camera found that their camera had been compromised in 2012, and found the security vulnerability in 2014, which he exploited to illegally record the other Petzview users for at least 4 years. The attack was only discovered in 2018, and the hacker was arrested for privacy invasions by illegal recording. Well, if you look into the source code of the web archive, you may find interesting thing there which tells about the security mindset of the Petzview designers :(
As long as these kind of insecure network cameras are connected to the Internet without software updates, and Korean authorities are burying their head in the sand like just blocking the Insecam website instead of regulating the market tightly, we don’t believe that the number of network cameras listed in the Insecam will decrease.