Continuing To Bypass Wireless Cameras

I got asked by more than a few people to do a follow up for the last security camera post and so here it is. This one will focus mostly on wireless security cameras.

Because this post is more technical which discusses steps to bypass security cameras, here comes the legal disclaimer. This post is for educational purposes only and to help authorized physical penetration testers and black team members to improve their ability to offer clients the best solutions for improving security.

Wireless security cameras has surged in popularity across both residential and commercial properties. These devices offer a convenient, cost-effective solution for monitoring and safeguarding premises. Their appeal largely stems from being relatively cheap, offering plug-and-play capabilities, and eliminating the need for complex wiring setups.

Yet, as with all technology, they are not without their vulnerabilities. This article delves into one of the more technical aspects of wireless camera security: bypassing these devices, particularly through things like deauthentication and other attacks, to understand the implications of such actions.

Introduction to Wireless Security Cameras

Wireless security cameras have become a staple in modern security systems due to their accessibility and ease of installation. Unlike their wired counterparts, these cameras connect to a network wirelessly, which means they can be placed almost anywhere as long as they remain within the range of the wireless network.

This flexibility, combined with their lower cost and the simplicity of not having to run cables, makes wireless cameras an attractive option for many. However, the very technology that makes them convenient also introduces potential security risks.

These wireless cameras will connect back to an application, either mobile or deskop which will record events, send out alerts, update cameras, etc.

The following video shows how the camera is suppose to work. In this video you will see a security camera guarding a coffee cup. Pay attention to the top of the phone’s screen, when my hand comes into frame, an alert will be triggered because it detected motion. This SMS based alert is what users of these devices are looking for and utilize to tell them when an intruder is present or event has occured.

Deauthentication Attacks Explained

One of the primary vulnerabilities exploited in wireless security cameras is through what's known as a deauthentication (deauth) attack. This type of attack targets the communication between the camera and the wireless network. Attackers send deauthentication packets to the camera, tricking it into thinking they are coming from the router. As a result, the camera disconnects from the network, believing it needs to authenticate its connection again.

During the time the camera is disconnected, it fails to transmit live feed or alerts over the network, creating a blind spot in the surveillance system. Deauth attacks can be particularly insidious because they can be carried out with relatively simple tools and from a distance, often without physical access to the premises.

There are lots of gear that can be used for deauth attacks, everything from expensive devices that require some level of knowledge and expertise, to extremely inexpensive items that require no skill and can be purchased from Amazon for around $60.

Note that while the device above is cheap and very easy to use, it will only deauth devices on the 2G band … but there are similar tools which can be used on other bands.

The Role of Internal SD Cards in Wireless Cameras