Incident: Security Flaws in Wireless Cameras Leave Homes Vulnerable to Hackers

Published Date: 2020-06-11

Postmortem Analysis
Timeline 1. The software failure incident related to security flaws in wireless cameras produced by Chinese firm HiChip and other brands, as reported by Article 101225, happened in June 2020. [101225] 2. The investigation revealing hacking attacks on smart homes, including the compromise of the ieGeek wireless camera, as reported by Article 115616, occurred in July 2021. [115616]
System 1. Wireless security cameras produced by Chinese firm HiChip, including brands such as Accfly, Elite Security, ieGeek, Genbolt, and SV3C, were found to have security flaws allowing hackers access to live footage and other devices [101225]. 2. Cameras using the CamHi app, including brands like Alptop, Besdersec, COOAU, CPVAN, Ctronics, Dericam, Jennov, LEFTEK, Luowice, QZT, and Tenvis, were identified as being at risk of hacking [101225]. 3. Smart devices in general, including the ieGeek wireless camera, were targeted by hackers in a fake home setup, with the ieGeek camera being easily hacked and compromised [115616].
Responsible Organization 1. Hackers targeted the wireless security cameras produced by Chinese firm HiChip, as reported by Which? [101225] 2. Hackers targeted smart devices in a fake home set up by Which?, NCC Group, and Global Cyber Alliance, with the ieGeek wireless camera being compromised. [115616]
Impacted Organization 1. Consumers using wireless security cameras produced by Chinese firm HiChip, including brands like Accfly, Elite Security, ieGeek, Genbolt, and SV3C, which were found to have security flaws [101225]. 2. Consumers using any camera that uses the CamHi app, which could be compromised and hacked, including brands like Alptop, Besdersec, COOAU, CPVAN, Ctronics, Dericam, Jennov, LEFTEK, Luowice, QZT, and Tenvis [101225]. 3. Consumers with smart home devices, such as wireless cameras like ieGeek, that are vulnerable to hacking attempts and surveillance [115616].
Software Causes 1. The software causes of the failure incident were related to security flaws in wireless security cameras produced by Chinese firm HiChip and used in homes across the UK, as reported by Which [101225]. 2. The software supplied with the cameras, used by various brands including Accfly, Elite Security, ieGeek, Genbolt, and SV3C, also had security issues contributing to the failure incident [101225]. 3. The CamHi app, used by many camera brands including those made by HiChip, was identified as a potential vulnerability that could be exploited by hackers to gain access to live footage and other devices [101225]. 4. The flaw in the design and security of existing cameras, particularly related to Unique Identification numbers (UID) that could be easily targeted by bad actors, was highlighted as a fundamental flaw contributing to the failure incident [101225].
Non-software Causes 1. Lack of strong default passwords on wireless security cameras [101225] 2. Weak security design and flaws in the software supplied with the cameras [101225] 3. Vulnerability in the devices' Unique Identification numbers (UID) [101225] 4. Inadequate security standards and protections in smart devices [115616]
Impacts 1. The software failure incident involving wireless security cameras from Chinese firm HiChip and other brands led to various security flaws, potentially leaving users' networks open to hackers. This could allow hackers to access live footage, target other devices linked to the same network, and even grant access to live footage and speak via the camera's microphone [101225]. 2. The security flaw in the software supplied with the cameras, used by brands like Accfly, Elite Security, ieGeek, Genbolt, and SV3C, could be exploited by hackers to compromise the devices [101225]. 3. The flaw in the design and security of the cameras, particularly related to Unique Identification numbers (UID), could allow hackers to steal usernames and passwords, gaining full access to the cameras without the users' knowledge [101225]. 4. The software failure incident resulted in the recommendation by Which? for users to stop using the affected cameras immediately and uninstall the associated app, CamHi, to mitigate the security risks [101225]. 5. The incident highlighted the need for stronger legislation to require connected devices to meet certain security standards to prevent such vulnerabilities in the future [101225]. 6. The investigation revealed that smart homes could be exposed to over 12,000 hacking attacks every week, with hackers targeting various connected devices, including wireless cameras like the ieGeek camera, leading to potential privacy breaches [115616]. 7. The hacking attempts on smart devices, including wireless cameras, underscored the importance of enhancing security measures and the urgency for proposed government laws to address devices with poor security [115616].
Preventions 1. Changing default passwords and setting secure passwords connecting three random words that are easy to remember could have prevented the software failure incident [101225]. 2. Keeping the camera software updated could have prevented the security flaws and vulnerabilities [101225]. 3. Disabling the feature that allows remote access to the camera from the internet if not in use could have prevented unauthorized access [101225]. 4. Implementing legislation to require connected devices to meet certain security standards could help prevent such incidents in the future [115616].
Fixes 1. Changing default passwords and setting secure passwords connecting three random words that are easy to remember [101225]. 2. Keeping the camera software updated to ensure security and add new features and improvements [101225]. 3. Disabling the camera if there are any concerns about security, especially if the remote access feature is not being used [101225]. 4. Implementing legislation to require connected devices to meet certain security standards [101225, 115616]. 5. Strong enforcement of security standards for connected devices [101225, 115616].
References 1. Which? consumer watchdog [101225, 115616] 2. Security specialists NCC Group and Global Cyber Alliance [115616]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to security flaws in wireless cameras has happened again at the same organization, HiChip. The article [101225] reports that more than 100,000 cameras produced by Chinese firm HiChip have been shown to have various security flaws, giving hackers access to live footage or other devices. The article mentions that HiChip encrypts data between the camera and the app but still faces security risks. Additionally, the article highlights that the software supplied with the camera, used by brands including Accfly, Elite Security, ieGeek, Genbolt, and SV3C, also has security issues. (b) The software failure incident related to security flaws in wireless cameras has also happened at multiple organizations. Article [101225] mentions that there are 47 camera brands worldwide that may be jeopardized, with 32 of them currently or previously sold in the UK. Brands such as Alptop, Besdersec, COOAU, CPVAN, Ctronics, Dericam, Jennov, LEFTEK, Luowice, QZT, and Tenvis are identified as being at risk. The article also states that any wireless camera using the CamHi app could be compromised, and the app and many of the brands are made by China-based HiChip.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the first article [101225]. The incident involves security flaws in wireless security cameras produced by Chinese firm HiChip, which were found to have various security vulnerabilities by the consumer watchdog Which. The flaw in the software supplied with the camera, used by multiple brands, including Accfly, Elite Security, ieGeek, Genbolt, and SV3C, could give hackers access to live footage or other devices. The design flaw in the software allows hackers to exploit the Unique Identification numbers (UID) of the cameras, making it easy for bad actors to target users and gain unauthorized access to the cameras without their knowledge. (b) The software failure incident related to the operation phase is highlighted in the second article [115616]. The investigation conducted by Which? revealed that smart homes in the UK are exposed to thousands of hacking attacks every week. The ieGeek wireless camera, one of the smart devices tested, was easily hacked and compromised, allowing cybercriminals to access the video feed and spy on the testers. This indicates that the operation or misuse of the smart devices, including weak username and password combinations, can lead to successful hacking attempts, compromising the security and privacy of users.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident reported in the articles is primarily within the system. The failure is related to security flaws within the wireless security cameras and the software supplied with the cameras, allowing hackers to access live footage, target other devices, and potentially grant access to microphones without the user's knowledge [101225]. The security issue is also linked to the design and security flaws in the cameras, particularly revolving around the devices' Unique Identification numbers (UID) that can be easily targeted by bad actors [101225]. (b) outside_system: The software failure incident also involves contributing factors that originate from outside the system. The incident includes hackers targeting smart devices with 'botnets' and attempting to infiltrate devices like routers, wireless cameras, and connected printers by exploiting weak default passwords [115616]. The hacking attempts come from various countries, including the US, India, Russia, the Netherlands, and China, indicating external threats targeting smart devices in households [115616].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident in Article 101225 was primarily due to security flaws in wireless cameras produced by Chinese firm HiChip and used in homes across the UK. These security flaws allowed hackers to access live footage or other devices without human participation [101225]. (b) The software failure incident occurring due to human actions: - The software failure incident in Article 101225 was exacerbated by human actions such as using weak default passwords on wireless cameras and not keeping the cameras updated, which made them vulnerable to hacking [101225]. - Additionally, in Article 115616, it was mentioned that hackers target smart devices with 'botnets' by probing for new unsecure devices and forcing their way past weak default passwords, indicating that human actions like setting weak passwords contribute to the failure [115616].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The software failure incident reported in Article 101225 is related to wireless security cameras designed by Chinese firm HiChip, which have various security flaws that could leave networks open to hackers [101225]. - The security issue with the software supplied with the cameras, used by brands like Accfly, Elite Security, ieGeek, Genbolt, and SV3C, is also mentioned in the article [101225]. - The flaw in the design and security of the cameras is attributed to the devices' Unique Identification numbers (UID), which can be easily discovered and targeted by bad actors, allowing them to gain full access to the camera without the user's knowledge [101225]. (b) The software failure incident occurring due to software: - The software failure incident reported in Article 101225 is primarily due to software issues, such as security flaws in the cameras' software and the CamHi app, which could give hackers access to live footage or other devices [101225]. - The article highlights that the flaw in the software could be exploited by hackers to pinpoint user locations, target other devices linked to their broadband, and grant access to live footage and microphone usage, even if the password is changed [101225]. - The article also mentions that the software flaw was identified in wireless cameras from various brands like Accfly, Elite Security, ieGeek, Genbolt, and SV3C, indicating a software-related vulnerability [101225].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in the articles is malicious in nature. The incident involves security flaws in wireless security cameras produced by Chinese firm HiChip and used in homes across the UK. These security flaws could potentially allow hackers to access live footage, target other devices linked to the network, and even grant access to live footage and speak via the camera's microphone [101225]. Additionally, the incident involves vulnerabilities in various camera brands supplied with the software, including Accfly, Elite Security, ieGeek, Genbolt, and SV3C, which could be exploited by hackers to compromise the devices [101225]. The articles highlight that hackers can exploit weaknesses in the design and security of the cameras, particularly related to Unique Identification numbers (UID), to gain unauthorized access to the cameras without the user's knowledge [101225]. Furthermore, the investigation revealed that smart homes with connected devices are vulnerable to hacking attacks, with cybercriminals targeting devices like wireless cameras and routers with weak default passwords [115616]. This indicates a deliberate attempt by hackers to infiltrate and compromise these devices for malicious purposes.
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident related to the security flaws in wireless cameras, particularly those using the CamHi app, can be attributed to poor decisions made by the manufacturers and developers. The incident involved various security flaws in cameras produced by Chinese firm HiChip and other brands, leading to vulnerabilities that could be exploited by hackers to access live footage, target other devices, and even speak via the camera's microphone [101225]. The flaw was related to the software supplied with the cameras, which had weak default passwords and encryption issues, making them susceptible to hacking attempts [101225]. Additionally, the incident highlighted the fundamental flaws in the design and security of existing cameras, indicating a lack of proper security measures implemented during the development and production of these devices [101225]. (b) The software failure incident can also be linked to accidental decisions or mistakes made by users who unknowingly purchased vulnerable wireless cameras or connected devices for their smart homes. The incident revealed that consumers may have unintentionally invited hackers into their homes by purchasing cameras with security flaws, believing they were enhancing their home security [101225]. Furthermore, the investigation conducted by Which? showed that smart homes with connected devices are targeted by hackers, with one wireless camera easily hacked and compromised, allowing cybercriminals to access the video feed and spy on users [115616]. This indicates that users may have unintentionally exposed their homes to hacking attacks due to the vulnerabilities in the devices they purchased and connected to their networks.
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development incompetence: - The incident involving security flaws in wireless cameras produced by Chinese firm HiChip and used in homes across the UK was due to various security flaws in the software supplied with the cameras [101225]. - The software flaw allowed hackers to access live footage, target other devices linked to the broadband, and even grant access to live footage and speak via the camera's microphone [101225]. - The security issue with the software supplied with the camera affected brands including Accfly, Elite Security, ieGeek, Genbolt, and SV3C [101225]. - The flaw in the software was exploited by hackers to pinpoint where the user lives, target other devices linked to their broadband, and gain unauthorized access to the camera [101225]. (b) The software failure incident occurring accidentally: - The investigation revealed that the ieGeek wireless camera was easily hacked and compromised, allowing a cybercriminal to access the video feed and spy on the testers [115616]. - The hacking attempts on smart devices, including the ieGeek camera, were part of more than 12,000 hacking attacks targeting smart homes every week, indicating a significant vulnerability in the software of these devices [115616].
Duration unknown The articles do not provide specific information about the duration of the software failure incident related to the security flaws in the wireless cameras. The focus of the articles is on the security vulnerabilities discovered in the cameras and the potential risks posed by these flaws, rather than on the specific duration of the failure incident. Therefore, it is unknown whether the software failure incident was permanent or temporary based on the information provided in the articles.
Behaviour omission, value, other (a) crash: The articles do not mention any instances of software crashing. (b) omission: The articles highlight a security flaw in wireless cameras produced by HiChip and used in homes across the UK, which could give hackers access to live footage or other devices. The flaw allows hackers to gain full access to the camera without the user's knowledge, indicating an omission in the system's intended security functions [101225]. (c) timing: The articles do not mention any instances of software performing its intended functions too late or too early. (d) value: The articles discuss a security flaw in wireless cameras that could allow hackers to access live footage and other devices, indicating a failure in the system's intended security functions [101225]. (e) byzantine: The articles do not mention any instances of the system behaving erroneously with inconsistent responses and interactions. (f) other: The software failure incident described in the articles involves a security flaw in wireless cameras that could be exploited by hackers to access live footage and other devices, even if the password is changed. This behavior could be categorized as a security vulnerability leading to unauthorized access, which is not explicitly covered in the options provided [101225].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) unknown (b) unknown (c) unknown (d) property: The software failure incident mentioned in Article 101225 resulted in a security flaw in wireless security cameras produced by Chinese firm HiChip, which could give hackers access to live footage or other devices, potentially compromising people's privacy and security [101225]. (e) unknown (f) non-human: The software failure incident impacted wireless cameras and smart devices, making them vulnerable to hacking attacks [101225, 115616]. (g) unknown (h) theoretical_consequence: The articles discuss potential consequences of the software failure incident, such as hackers being able to access live footage, target other devices linked to the network, and even grant access to microphones without the user's knowledge [101225]. (i) unknown
Domain information, health, other (a) The software failure incident reported in the articles is related to the **information** industry. The incident involves security flaws in wireless security cameras used in homes, which could potentially leave networks open to hackers and compromise the privacy and security of users' information [101225]. (j) The software failure incident is also relevant to the **health** industry. The compromised security of the wireless cameras could potentially invade the privacy of individuals in their homes, which is a concern for personal health and well-being [101225]. (m) Additionally, the software failure incident could be associated with the **other** category as it pertains to the broader issue of cybersecurity and privacy concerns in the context of smart home devices and connected technologies [115616].

Sources

Back to List