Uri Guterman, Head of Product & Marketing and Elaine Moran, Technical
Support & Field Engineer for Hanwha Techwin Europe have jointly
produced a jargon busting explanation of video surveillance cyber security
terminology and a reminder that combatting the activities of hackers needs
to remain a top priority.
Concerns about the ability of hackers to access live images (or retrieve recorded images captured by video surveillance cameras located in security sensitive areas) have been around for a while. Many manufacturers of professional level cameras have responded to the threat by introducing device network set-up protocols which do not allow for a default password, or one that has consecutive letters or numbers, to be used. However, hackers are likely to continue to look at other ways to gain access to data, including via a camera’s ‘back door’. Regardless of whether it is for criminal or malicious purposes, or just seen as a challenge by amateur hackers, it is essential that end-users’ confidential data is kept secure. This applies just as much to the many thousands of small businesses and homes that entrust video surveillance solutions to protect their assets as it is for high security and mission critical end-users, such as airports, banks, local authorities, government, military and emergency services.
DESIGNED WITH CYBER SECURITY IN MIND
Most responsible manufacturers of video surveillance cameras should recruite appropriately skilled software engineers to quickly produce firmware updates as new threats emerge. At Hanwha Techwin, our Security Computer Engineering Response Team (S-CERT) is totally focused on addressing any potential security vulnerabilities in our Wisenet products and solutions. Members of the team have been hand-picked for their expertise in being able to identify, analyse and quickly respond with effective countermeasures, to any cyber security threats. Manufacturers should also be using independent cyber security testing agencies to help them identify any vulnerabilities. However, as in all areas of life, prevention is better than the cure. This is why manufacturers such as Hanwha Techwin are equipping their latest generation of cameras with chipsets which have been developed from the ground up to minimise the risk of unauthorised access by hackers and the infiltration of malicious firmware. Whilst no manufacturer can offer 100% guarantee that their products will never be hacked, the next generation chipsets on the horizon are likely to incorporate a long list of technologies which will significantly improve the cyber security credentials of the cameras they are built into.
Some of these technologies are new and have been developed specifically to combat cyberattacks whilst others, which were originally intended simply to make chipsets more efficient, are also able to contribute to camera security. Almost all, when mentioned in video surveillance related documents, datasheets or on the internet, are stated as acronyms or have names which do not make it obvious what they are intended to do. Here therefore is an explanation of some of those you are most likely to come across.
Anti-hardware clone functionality prevents a chipset from being cloned. In addition to protecting intellectual property, this ensures that a chipset with a manufacturer’s label is a genuine copy and removes the risk of a cloned device which may contain malicious software being used to steal sensitive data such as passwords.
When applied to video surveillance solutions, crypto acceleration is normally referred to within the context of a camera chipset performing complex mathematical functions for encryption and decryption. This is a very intensive operation requiring the chipset to use a large proportion of its resources. Equipping chipsets with a dedicated ‘engine’ for this purpose ensures that encryption/decryption is efficiently carried out, without affecting other camera functionality.
Between the location of a camera and where the images it captures are remotely viewed, recorded and stored, there is always the possibility that a cyber criminal could hack into the network and gain access to what may be confidential video and data. Image scrambling is the encryption of video prior to transmission over the network. It does so by randomly rearranging the pixels of each image so that it cannot be viewed by anyone maliciously hacking into the network.
JTAG ports are hardware interfaces which are used to programme, test and debug devices. However, they can be compromised by cyber criminals to gain low level control of a device and perhaps replace firmware with a malicious version. This can be prevented by securing the JTAG port via a key-based authentication mechanism to which only authorised personnel working for the manufacturer have access.
UART ports are serial interfaces typically used for debugging cameras. They allow administrator access to a camera and are therefore a target for hackers attempting to access sensitive information such as password keys. Hackers could also potentially access a camera’s firmware in order to reverse engineer it, as well as examine it for vulnerabilities in the device’s communications protocols. Enforcing restricted and secure access to the UART port, will allow the debugging process to be safely completed, without opening the door to cyber criminals.
This is an acronym for One Time Programmable Read Only Memory which allows sensitive data, such as encryption keys, to be written only once onto a chipset and then prevents the data from being modified. This protects the integrity of encryption keys which are used to validate the stages in a secure boot up sequence and allows access to the JTAG Port.
SECURE BOOT VERIFICATION
Secure Boot provides an extra layer of security by sandboxing different elements of a camera’s operating system, which means they are in a protected space. The system will complete a full boot before communicating with any other part of the system and this prevents an interruption to the boot process which could be exploited by a hacker.
RANDOM NUMBER GENERATOR
Computers are designed to create very predictable data and are therefore not very good at generating random numbers which are required for good encryption. A dedicated random number generator overcomes this problem by having a dedicated mechanism for the task.
Using a separate operating system (OS) for encryption and decryption, as well as for verifying apps have not been modified or are forgeries, reduces the workload of a camera’s main OS. A separate Linux based API is needed to access a Secure OS and without this there is no way to make any changes from the outside of a camera. A Secure OS should always therefore be used to process important stored information.
In a highly competitive market, there is no shortage of camera manufacturers to choose from. Consultants, system designers and systems integrators therefore have the freedom to narrow down their shortlist of preferred supplies to those who have fully embraced and incorporated best practise into their manufacturing process. A clear demonstration of this would be if they have equipped their cameras with most, if not all, of the above functionality and technology.