IoT security issues: A case study on vulnerabilities in surveillance smart cameras

The number of internet-connected devices is growing at a fast rate. A large number of these machines are called the internet of things (IoT) machines. IoT devices can be conveniently associated and used via the internet. However, a considerable number of these devices are made with security vulnerabilities and defects that result in them being obvious targets for hackers. This issue has been extensively discussed in the media recently. An internet protocol (IP) camera is a type of digital video camera that can transmit information over the internet. These cameras are used for several purposes, such as home and industry monitoring, as well as monitoring for babies and the elderly. Also, with the remote access feature of these cameras, a live video stream can be viewed through a number of devices, including smart-phones, tablets, computers, or any other handheld device. IP cameras are usually strong, both in transmission bandwidth and computing, rendering them particularly appealing to hackers, who can exploit these devices with multiple attacks. Distributed Denial-of-Service is one of the attacks that IoT devices, such as IP cameras, are faced with. The purpose of this thesis is to investigate the vulnerabilities of IP cameras and the impact of these vulnerabilities on the security and privacy of IP camera users. This task will be carried out using a Kali Linux penetration testing platform and its tools. To this end, a hands-on test was be performed on three different brands of IP camera (an Intelligent Onvif YY HD camera, a Panoramic IP camera, and a Dual-HD camera), as well as analyzing the security components of these cameras. The outcomes of this study indicate that IP cameras have weaknesses and security problems, that such flaws have various security effects on users. One security flaw of IP cameras is their default usernames and passwords. To prevent attackers that try to access these devices without permission (for instance, using Mirai malware), the end-user must modify the default credentials. The implications and effects of security gaps such as a weak password policy for setting passwords, encryption of sensitive information with weak methods, and sending data without any type of encryption, are discussed in detail. This thesis will also discuss solutions and recommendations to improve the security of IoT devices, especially that of IP cameras.