Features Security Lessons: Secure Video

FEATURES Security Lessons: Secure Video Secure Video Surveillance Camera Shy Unless your surveillance cameras are wired directly to a video board, they are notoriously insecure. We show you how to keep your cameras from being compromised. By Kurt Seifried n issue 121, Marcel Gagné covered buy a portable WiFi jammer for US$ 40 Non-IP-based cameras with a direct line the basics of building a video sur- from a site like DealExtreme. And, al- to the surveillance system mean that at- veillance system using Linux and though these devices often are illegal tackers will have to compromise the sur- I Kmotion [1]. But, to build a really (because they interfere with wireless veillance server directly to get at the secure, scalable (with dozens or hun- networks, oddly enough), I’ve never video information. Also, most video sur- dreds of cameras) system that can’t be heard of anyone having them seized by veillance servers easily can compromised easily by attackers, you’ll customs, for example. Thus, the bad guy be locked down to need to do more. For starters, you’ll can simply carry around a WiFi jammer, make such a breach probably need to ditch Kmotion and look and all you’ll see on your surveillance more difficult. at ZoneMinder instead, and you’ll need system is one camera after another going Additionally, to be very careful about the cameras you offline. basic IP cameras use. So, unless the cameras buffer the im- with limited reso- ages and resend them when the network lution (e.g., Wired, Wireless, and IP is up, the bad guy can easily avoid detec- 320x200) cost One of the biggest mistakes people make tion. In other words, I recommend that about the same when they buy cameras for a surveil- you use wireless cameras only if you ab- lance system is selecting wireless cam- solutely have to or if you expect your at- eras. Now, I see the advantages: They tackers to be completely unsophisticated are really easy to install, and a power (which might actually be the case for source usually is easily accessible. Also, most of us). running network cable can be a real pain The second major difference between – each cable that needs to be run to a cameras is whether they are network ca- camera can cost a hundred dollars or pable (IP based) or not (directly wired more. But, wireless cameras also have into a video capture board). The advan- two tiny problems: They can be moni- tage of an IP-based camera is that you tored (so people can see what you’re can simply plug it into your network, seeing), and they are trivial to jam. without running special cables (usually Most wireless cameras come in two coaxial) from the surveillance system to flavors now: X10 and 802.11 (WiFi). The the camera. Also, multiple systems eas- X10 cameras have very little security in ily can make use of a single IP-based most cases, and the video signal often is camera. not encrypted. A good rule of thumb is: The disadvan- If the camera costs less than a few hun- tage to an IP- dred bucks, the signal is likely not en- based camera crypted. Most WiFi-based cameras, how- is that an at- ever, now support WPA2, but your sys- tacker with ac- tem is only as secure as your network cess to your net- passwords, so make sure they aren’t eas- work can intercept ily guessed. and monitor or even The jamming issue, on the other hand, modify video with a is basically impossible to fix. You can tool such as VideoJak [2]. KURT SEIFRIED Kurt Seifried is an Information Security Consultant specializing in Linux and networks since 1996. He often wonders how it is that technology works on a large scale but often fails on a small scale. 66 APRIL 2011 ISSUE 125 LINUX-MAGAZINE.COM | LINUXPROMAGAZINE.COM 066-067_kurt.indd 66 16.02.2011 12:00:00 Uhr FEATURES Security Lessons: Secure Video as “dumb” but much higher quality cially if you have many cameras. One so- wired cameras. lution is to get a video capture board that does on-board motion detection, Live Video Modification presenting the computer with pre-filtered In films, the bad guys often break into a footage. Unfortunately, such cards are video surveillance system, record a loop not widely available. However, of video with no events (i.e., an empty bluecherry [8], which sells a host of hallway or a bank vault with the jewels video capture cards guaranteed to work still inside), and feed that loop back to with ZoneMinder and provides open the system while they make off with the source drivers for their own boards, does loot (only to have the video loop fail at have such a card coming to market soon. some point, resulting in a really good I tested a beta version, and it works chase sequence). Although this scenario pretty well, especially if you’re using a is still possible, the technology is a lot computer with limited CPU power or more sophisticated. Until recently, you cooling issues. could usually assume that live video was Figure 1: An example of zones in Zone- a pretty good representation of the truth, Minder surveillance. (Reprinted with permis- Future of Surveillance but with modern technology, you can sion from Philip Coombes) The future is here – which is both good, modify video in real time. because some of the technology is very I recommend you pause here and In other words, unless you can prove cool, and bad, because some is definitely check out the video at LiveLeak [3]. If that the video stream from the camera to open to abuse. New high-end systems you haven’t watched it yet, I’ll spoil it the recording device is secure, you must not only detect motion but also analyze for you. Using a computer to modify the be wary of trusting video evidence. For- behavior (e.g., identifying people who video signal, you can simply circle an tunately, again, most people caught are fighting, jumping over a turnstile in a object, and, presto, it disappears from doing bad things on video are not that subway station, or breaking into a car). the video feed. The craziest part of the sophisticated. Face and gait recognition are also be- video is when they “remove” an object coming popular. These systems allow on a counter in front of a mirror – you A ZoneMinder Primer you to alert security automatically, for can still see the object in the mirror. First, use cameras that are wired directly example, when people who have been The technique used is quite simple to a capture board running on a Linux banned show up on the premises. and clever. The computer basically re- server. ZoneMinder (Figure 1) [5] ships In an Orwellian twist, some new cam- duces the resolution of the object and its with most major distributions, so instal- era systems can physically track individ- surroundings, then increases it, using lation won’t be a problem. Configura- uals and identify and track groups of video from around the object to rec- tion, however, might an issue because people, so you don’t need to hire some- reate the space the object occu- getting the settings right for your cam- one to follow people, you can just let the pied. This technique works es- eras can be tricky. I suggest using computer do it. If this technology be- pecially well on flat surfaces, comes widely deployed, who knows? such as a painted wall. xawtv -hwscan Maybe large-brimmed hats will come The kicker is that you back into fashion. nnn can modify the video to detect all local cameras [6]. and feed it back out in Second, spend some quality time with INFO less than 40ms. Assum- the web interface and put in all your [1] “Webcams” by Marcel Gagné, Linux ing a standard 30 cameras. Then, you can decide whether Magazine, December 2010, pp. 30-36 frames or so per second you want to capture all video (set the of video, this time pe- camera to function Monitor) or only [2] VideoJak: http://videojak.sourceforge.net/ riod represents a two- video when motion is detected (choose frame delay, which Modetect). Also, you can configure alerts [3] LiveLeak: http://www.liveleak.com/ very few systems will in case motion is detected. ZoneMinder view?i=639_1288445821 notice (network la- has a great interface for navigating his- [4] Canon OSK-E3 is proved useless: tency and jitter torical events for one or more cameras. http://www.elcomsoft.com/canon. alone can easily ac- For all the details on ZoneMinder setup, html?r1=pr&r2=canon count for 40ms). visit the wiki [7], which includes distri- [5] ZoneMinder: Even the use of bution-specific guides. http://www.zoneminder.com/ cameras with se- [6] xawtv: cure digital signing Motion Detection and http://linux.bytesex.org/xawtv/ probably won’t help CPU Usage [7] ZoneMinder main documentation: much, because such One problem with using motion detec- http://www.zoneminder.com/wiki/ systems are often flawed tion, however, is the amount of CPU index.php/Documentation [4]. time that you’re going to consume, espe- [8] bluecherry: http://bluecherry.net/ LINUX-MAGAZINE.COM | LINUXPROMAGAZINE.COM ISSUE 125 APRIL 2011 67 066-067_kurt.indd 67 16.02.2011 12:00:03 Uhr.

Load more