Modern video camera systems have exploded in popularity thanks to their cheap price and ease of use, but with this convenience factor comes potential security risks that can leave us unsuspectingly exposed. Enter Verkada, a Silicon Valley company that offers cloud-based security cameras. Similar to the recent SolarWinds hack<\/a>, everything was fine until hackers were able to breach Verkada\u2019s systems. Hundreds of thousands of cameras were compromised, as was the company\u2019s video storage library. Suddenly factory workers, medical personnel, and even children playing at home were all exposed, violating their privacy and potentially allowing attackers to access other systems on the camera\u2019s network.<\/p>\n\n\n\n So, how were the hackers able to pull off the Verkada breach? How did the company respond? And how can organizations prevent similar breaches in the future?<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n First, let\u2019s take a look at the company itself. Verkada was founded in 2016 and sells cameras to a wide variety of industries and markets. Everything from offices to jails to schools to gyms to police stations. Notable clients of theirs include Cloudflare, Tesla, Equinox, and Nissan. Verkada offers the equipment required to monitor any desired areas, plus building automation gear that keeps track of temperature, motion, noise, and door access.<\/p>\n\n\n\n Their hardware requires an internet connection so it can access their cloud service. This gives customers the ability to watch and store real-time video from any location. Verkada also boasts artificial intelligence features that can track individuals as they move around. Called \u201cPeople Analytics,\u201d this software searches for specific people based on their face, clothes, any accessories they\u2019re carrying, and their gender, and allows them to be tracked as they move around.<\/p>\n\n\n\n The selling point of their AI features is that it improves public safety and security by detecting unusual occurrences that possibly pose a danger. Basically, the goal is to stop crimes before they occur. Yes, we\u2019re getting into Minority Report territory<\/a> here. These kind of \u201cvideo analytics\u201d systems are becoming more and more popular as a greater number of companies and public organizations turn to them in an attempt to prevent everything from petty theft to mass shootings.<\/p>\n\n\n\n About 150,000 of the company\u2019s cameras were accessed by a Swiss \u201chactivist\u201d group known as Persistent Threat 69420 (quite the serious name, indeed). The collective has less than ten members, including Tillie Kottman, who describes their mission:<\/p>\n\n\n\n We generally do not do targeted work. We all have ADHD and not a lot of patience. We do scans for very broad vectors looking for vulnerabilities.<\/p><\/blockquote>\n\n\n\n The goal of this particular attack was relatively straightforward \u2013 to demonstrate how easily Verkada\u2019s cameras could be hacked and to raise awareness of their vulnerabilities. Access was gained when the group located credentials for a \u201csuper admin\u201d account on a public-facing server. Specifically, it was on an unencrypted subdomain intended to be used as an internal development system. As Kottman explains:<\/p>\n\n\n\n This one was easy. We simply used their web app the way any user would, except we had the ability to switch to any user account we desired. We did not access any server. We simply logged into their web UI with a highly privileged user account.<\/p><\/blockquote>\n\n\n\n After finding the credentials, they were able to move freely within Verkada\u2019s internal network and had root access to individual cameras. This allowed them to use the cameras to execute whatever code they wanted, giving them the ability to potentially perform further, escalated attacks. The hackers were also able to subsequently infiltrate some customer networks by using the camera\u2019s connection as a starting point.<\/p>\n\n\n\n Besides accessing the live feeds of individual cameras, the hacker group was also able to infiltrate the complete video archive that contains files saved by Verkada\u2019s users to the cloud. The centralized nature of the company\u2019s software enabled the attackers to browse a massive amount of data with just a few clicks.<\/p>\n\n\n\n Anyone who used Verkada cameras was at risk, and the list of those affected is both long and diverse. The attackers were able to take a live glimpse into the factories of Tesla and Nissan, county jails around the country, and the offices of companies like Cloudflare and Equinox. Organizations weren\u2019t the only target – average people like you and I were impacted as well. The hackers did not discriminate.<\/p>\n\n\n\n Some of the released videos are quite eerie to watch because of how \u201creal\u201d they are and the fact that the subjects of the videos have no idea they\u2019re being spied on. One video shows a father and his children working a puzzle in a playroom, and another shows a nurse checking on someone in a hospital bed. There\u2019s videos of empty corridors and conference rooms, and even ones of convicts milling around a jail.<\/p>\n\n\n\n The hackers didn\u2019t stop there once they had access to Verkada\u2019s network. They stole the company\u2019s entire client list, containing over 24,000 entries along with potentially sensitive information on each.<\/p>\n\n\n\n The company acknowledged the hack and issued an apology for the exposure of \u201cvideo and image data from a limited number of cameras.\u201d However, they are not getting rid of the ability to view the live stream of individual devices.<\/p>\n\n\n\n Moving forward, Verkada says they intend to come up with a more effective approach to managing login data, hire more security experts, and use third-party consultants to perform a security audit. CEO Filip Kaliszan said:<\/p>\n\n\n\n While we already have robust logging and audit capabilities, we will ensure that customers receive proactive notifications whenever their data is accessed by Verkada, including by our technical staff<\/p><\/blockquote>\n\n\n\n The company has also disabled their internal administrator accounts and notified law enforcement so they can pursue the perpetrators.<\/p>\n\n\n\n Verkada has been in the news a few times previously in the past few years, and not for good reasons. Their security measures have been publicly questioned by security analysts, with Charles Rollet, part of the security research group IPVM, saying<\/p>\n\n\n\n Verkada had sold their system as particularly advanced in terms of privacy and security, which is ironic when you look at what happened. People don\u2019t realize what happens on the back-end, and they assume that there are always these super-formal processes when it comes to accessing footage, and that the company will always need to give explicit consent. But clearly that\u2019s not always the case.<\/p><\/blockquote>\n\n\n\n Three employees were also terminated last year for using company cameras to spy on fellow employees, as well as making sexually explicit jokes about them. They aren\u2019t the only security company to face this kind of issue, as the doorbell company Ring has also recently fired employees for similar infractions.<\/p>\n\n\n\n Verkada could face even more legal trouble down the line, as the Department of Health and Human Services (HHS) may investigate them for possible HIPAA\/HITECH violations. Security camera footage from medical facilities can sometimes be considered as sensitive health information. There are also possible GDPR violations and the potential for class-action lawsuits, so time will tell what additional penalties Verkada may be hit with.<\/p>\n\n\n\n The Verkada breach raises numerous questions concerning device security. First off, why did this \u201csuper admin\u201d account exist in the first place? Verkada said that admin access was given to engineers and support staff so that technical issues could be fixed, but surely there are better approaches that would still allow for effective problem solving and troubleshooting. Admin access should only be given out on a user-by-user basis, and only to those that absolutely require it to carry out their duties. Jeff Costlow, CISO at cloud security firm ExtraHop, agrees:<\/p>\n\n\n\n I’m OK with vendors having the ability to auto-update the device. That means they have control over the source code. But that doesn’t mean that they have control over the device any time they want.<\/p><\/blockquote>\n\n\n\n Companies, and in particular start-ups like Verkada, must implement best practices for privileged access to systems in order to prevent privacy breaches like these. While manufactures do indeed have legitimate reasons to log into your devices, comprehensive controls, restrictions, and auditing should be enacted to maintain the right balance between safety and access.<\/p>\n\n\n\n There was clearly a lack of effective access control in place, and even if these kind of \u201csuper\u201d accounts exist, the credentials should never be stored anywhere that could potentially be public-facing. This is a textbook example of how certificate-based authentication can prevent unauthorized access. Copying and pasting a username and password into an email or webpage is an easier and more likely scenario than someone taking an archive of the certificate\/key and posting the contents. Plus, you can link certificates to individual users so you\u2019ll have a trail of who is accessing what, and when they\u2019re doing it.<\/p>\n\n\n\n Vendors could even go a step further and have each customer\u00a0act as its own \u201cmini\u201d private certificate authority. That way, no one can access the device unless the owner issues a certificate to them. In the case of Verkada, if a customer had a technical issue then they could issue a certificate to the support team so they could fix it. Otherwise, the doors to the device would always be locked.<\/p>\n\n\n\n End-users should also have more control over how vendors are able to interact with their devices. While users can create admin accounts on their own Verkada cameras, for example, they couldn\u2019t do anything to prevent the company\u2019s \u201csuper admin\u201d account from accessing their video feed. Ideally, users would have to opt-in to allowing a feature like that, in order to preserve privacy by default. Users should have full control of the devices they own \u2013 period.<\/p>\n\n\n\n This incident also serves as a reminder that upon purchasing any new device, one should always go through the default settings. You never know what is enabled\/disabled by default, and what possible vulnerabilities may be created as a result. No matter what, the default login credentials should always be changed.<\/p>\n\n\n\n There\u2019s some irony in the Verkada breach \u2013 it demonstrates the dangers of self-surveillance. We have such a strong desire for a sense of security, but if it\u2019s not properly implemented then it can end up creating even more security threats as a result. In this particular case, we aren\u2019t even talking about a sophisticated attack or previously unknown vulnerabilities<\/a> – the bad guys simply used valid credentials. It\u2019s critical that companies be proactive with access controls and security in general so that they won\u2019t have to learn things the hard way, which ends up punishing average consumers like you and I, as well.<\/p>\n\n\n\n Protect Your Site With CodeGuard Backup<\/strong><\/span><\/p>\n\n\n\n It’s like an undo button to reverse damage done by a mistake, cyber attack, a bad update, or other issues.<\/p>\n\n\n\nWho is Verkada?<\/h2>\n\n\n\n
![\"the](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/03\/intro-command-platform.jpg\")
What Happened in the Verkada Breach?<\/h2>\n\n\n\n
![\"prison](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/03\/verkada-4.jpg\")
![\"verkada](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/03\/imrs.jpg\")
Who Were the Victims of the Verkada Breach?<\/h2>\n\n\n\n
![\"verkada](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/03\/verkada-1-1.jpg\")
How Did Verkada Respond?<\/h2>\n\n\n\n
![\"verkada](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/03\/verkada-3.jpg\")
How Could the Verkada Breach Have Been Prevented?<\/h2>\n\n\n\n
\n\n\n\n![\"CodeGuard](\"\/content\/images\/cg-vertical-logo.svg\"){kind=logo}
\n<\/div>\n\n\n\n