AA+W - Fotolia
100,000 cheap wireless cameras vulnerable to hacking
Active devices built by Chinese firm HiChip have been sold in the UK as webcams and connected baby monitors
Consumer advocacy organisation Which? has issued a warning over the security of wireless camera brands made by China-based HiChip and urged the owners of more than 100,000 devices thought to be active in the UK to stop using their cameras immediately.
The flaws affect both the devices themselves and their accompanying CamHi smartphone app, said Which?. The organisation worked to verify the flaw alongside security researcher and camera specialist Paul Marrapese, and found it in five cameras from OEM brands Accfly, Elite Security, ieGeek, Genbolt and SV3C.
It may also exist in over 30 other brands that have been, at one time or another, sold into the UK. These include Alptop, Besdersec, COOAU, CPVAB, Ctronics, Dericam, Jennov, LETEK, Luowice, QZT and Tenvis.
Which?, working with US-based security expert Marrapese, tested and verified this security flaw in five wireless cameras from Accfly, Elite Security, ieGeek, Genbolt and SV3C – all of which were bought from Amazon and available on other online marketplaces. None of the brands meets the basic three requirements for the UK government’s planned internet of things (IoT) device security legislation.
The vulnerability centres on weak unique identification numbers (UIDs), which are often found on stickers on the devices themselves, so can easily be discovered and targeted. An attacker could them target app users when they connect to their camera, access their credentials, and gain full access to the device, allowing them to view live footage and even speak via the device’s microphone. Which? warned that changing the password does not stop the exploit.
“People may believe they are picking up a bargain wireless camera that can bring a sense of security – when in fact they could be unwittingly inviting hackers into their home or workplace,” said Kate Bevan, computing editor at Which?.
“Anyone who has one of these cameras in their home should turn it off and stop using it immediately, while all consumers should be careful when shopping around – cheap isn’t always cheerful, especially when it comes to unknown brands.”
A HiChip spokesperson said: “HiChip has focused on IP camera R&D for more than 10 years and continues to improve the security of the cameras. We encrypt all the commands and data with [advanced encryption standard] AES128 between the camera and the APP, above the P2P transferring layer. So our cameras have very low security risk about the end-user’s privacy.”
Nevertheless, the Shenzhen-based company is now working alongside Marrapese and Which? researchers on a number of proposed updates, although Which? said it had not yet been able to verify that the suggested updates will actually fix any of the vulnerabilities, adding that fundamental flaws might mean the devices could remain at risk even if patched.
The various brands are sold into the UK on a number of e-commerce websites, including AliExpress, Amazon, eBay and Wish, which were also contacted about the flaws.
Read more about IoT security
- A £400,000 funding pot is on offer for innovators to design assurance schemes that boost IoT security.
- Maintaining secure networks and IoT usage may seem secondary, but following proven protocols to stay digitally protected is one way to come out on top, especially during a pandemic.
- Fully private, segregated networks for IoT deployments are becoming increasingly attractive to many organisations, according to a report.
An AliExpress spokesperson said: “AliExpress takes product safety very seriously. We have strict platform rules that require all third-party merchants to comply with all applicable local laws and regulations. We work hard to ensure that consumers are protected on our platform.”
eBay said: “These cameras that Which? is concerned might put users at risk are all legal to sell in the UK, and comply with our existing policies. These devices can be used safely if used in a network without an internet connection, for example as baby monitors.
“We encourage people who purchase any wireless camera product on eBay to take appropriate security precautions, in the same way they would with any smart home devices, online email or social media account.
“Sellers on eBay have to comply with any applicable law. So if the UK government introduces new regulations in this area, sellers will, of course, have to comply with them. Any listings on our platform that do not comply with UK regulations or that violate our policies will be removed, with appropriate enforcement action taken against sellers.”
Wish.com said: “We were alarmed to hear of reports that a small batch of surveillance cameras that use the CamHi app may be vulnerable to hacking. We have alerted the sellers who currently list these items and requested they look into this as a matter of urgency, before taking any appropriate remedial action.”
Which? noted that Amazon declined to comment or to remove any of the listings from its site.
