Russian Intelligence Exploits IP Cameras for Military Surveillance
Russian intelligence services are systematically hijacking internet-connected security cameras across Europe and Ukraine, using the feeds to monitor military transport routes, weapons shipments to Kyiv, and the locations of Ukrainian troops. This alarming finding comes from a cybersecurity advisory published on July 10 by the AIVD and MIVD, the Netherlands' civilian and military intelligence services, which describe the operation as ongoing. In Ukraine, the surveillance has escalated beyond passive observation, with camera access being utilized to target Ukrainian military personnel and destroy their equipment, effectively turning exposed roadside or business cameras into tools for military targeting.
The intelligence services report that the same access is also gathering military intelligence unrelated to the conflict. The process of gaining access to these cameras is often straightforward. Operators scan the internet for exposed devices, identify IP cameras by brand, and exploit those still using default passwords, outdated firmware, and factory settings that have not been changed. Once inside, they employ image-recognition software to automate searches through video feeds for military vehicles and their cargo. Notably, this access does not require any zero-day vulnerabilities.
Martijn Grooten, a principal security researcher at Censys, emphasizes that merely being reachable from the internet does not equate to being hacked. Censys has identified over 87,000 internet-connected cameras across the EU, NATO members, and Ukraine that run services with known vulnerabilities, marking this as a conservative estimate. Among these, more than 4,000 are located in Ukraine. The count includes hosts running any vulnerable service, not just those with flawed camera software.
In the Netherlands alone, Censys found 45,386 cameras accessible from the public internet, with 1,992 flagged for running services with known vulnerabilities. When focusing specifically on bugs in camera software, the number drops to 541. Censys maintains that a foothold on one service can often lead to control over the entire host.
The advisory also highlights two specific vulnerabilities: CVE-2016-7407, which affects a local key-import tool in the Dropbear SSH server, and CVE-2021-39275, an out-of-bounds write in Apache. Both vulnerabilities have been patched, but Censys still counts them as exploited in the wild. The Dutch intelligence services have confirmed that they have only detected a small number of actual breaches, primarily along military logistics routes in the Netherlands, and have alerted the organizations responsible for these cameras to enhance their security.
The recommended solutions are straightforward yet effective. The intelligence services have not observed any military attacks outside Ukraine that utilized intelligence gathered from these cameras. The threat remains significant due to the simplicity of the entry points, often just default logins, and the value of the information is determined by the camera's field of view. A compromised camera can provide adversaries with real-time insights into physical operations, including the movement of trucks and personnel, without necessitating deeper network breaches. Therefore, the solution involves not only patching the devices but also removing them from public internet access and controlling their visibility.
