When the cameras you install to protect your organization become a way for someone else to watch you, the security implications go well beyond video footage.
Recent reports that hackers accessed Dahua surveillance cameras and recorders in Ukraine, including changing settings and creating unauthorized accounts, raise bigger questions about IoT security, exposed devices and the risks of turning everyday connected technology into an intelligence-gathering tool.
I have four cybersecurity experts offering perspective on the story for your consideration, including why connected devices are so often overlooked, how compromised cameras can expose an organization’s people and security operations, how attackers can exploit the connections between physical and cyber infrastructure, and how camera networks can become powerful intelligence assets when their data is aggregated.
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security (www.ridgesecurity.ai)
“I’ve seen the broader risk firsthand during several authorized, full-scope adversarial emulation engagements. While the techniques differed from those reported in Ukraine, the principle is the same. Compromising surveillance infrastructure can give attackers visibility into the very systems and personnel responsible for protecting an organization. I call that watching the watchers.
What concerns me is that these systems rarely operate in isolation. Video surveillance, physical access controls, building automation, and alarm systems may be interconnected. For an advanced adversary coordinating cyber and physical operations, that visibility can reveal security procedures, personnel movements, and potential gaps in response. The camera is no longer just watching the door; it may be helping someone figure out when to walk through it.
Manufacturers must take greater responsibility for secure-by-default configurations, strong authentication, firmware maintenance, and independent adversarial testing before and after products reach the market. Organizations should isolate these systems, eliminate unnecessary cloud access, and validate their defenses against realistic attack paths. Installing a security device shouldn’t require taking its security claims on faith.”
John Strand, Owner, Black Hills Information Security (www.blackhillsinfosec.com)
“Watch any spy movie and you’ll see the importance of cameras. They can reveal physical blind spots, capture high-resolution video of someone’s fingers as they type a password, or show sensitive information on a screen.
“What’s interesting about this particular story is how many problems are stacked together. Predictable serial numbers. Easy cloud access. Outdated firmware. It’s amazing to me how bad the entire security ecosystem around some of these cameras is.
“But this isn’t unusual. We see the same thing across connected IoT devices that fall outside traditional endpoint management. Patching is poor, firmware gets forgotten, and there’s often absolutely no security monitoring. These devices can see what people type and what’s on their screens, yet nobody is watching the devices themselves.”
Phillip Wylie, Chief Security Evangelist, Suzu Labs (www.suzulabs.com)
“Security cameras are supposed to help protect organizations, but when they’re compromised, they can become surveillance tools for attackers. Instead of protecting your environment, they’re potentially giving someone else visibility into your operations, personnel, and physical security.
“One of the biggest challenges with IoT devices is that they’re often installed and forgotten. Organizations may not realize these devices are running outdated firmware, using weak credentials, or are accessible from the internet. Attackers look for these weaknesses because they can provide an easy entry point into an organization’s environment.
“Manufacturers need to prioritize security by design, including secure default configurations, strong authentication, and reliable firmware updates. Organizations also need to take responsibility for securing these devices by changing default credentials, limiting internet exposure, segmenting networks, and regularly checking for firmware updates.
“Ultimately, a security camera is another computer connected to your network, and it needs to be treated with the same level of security attention as any other endpoint.”
Donald McFarlane, Board Member, Xcape, Inc (www.xcapeinc.com)
“A camera is a sensor. A network of cameras (or radios, vehicles, routers or other connected devices) is an intelligence collection system.
“We have been seeing nation states turn privately deployed technology into intelligence assets for a long time. Russian intelligence has been publicly linked to compromising cameras to monitor NATO logistics and to identify Ukrainian personnel. U.S. agencies have assessed that Chinese state actors have penetrated and persisted in American communications infrastructure for years, maintaining access that could support disruption in a future conflict.
“An individual camera gives you an image. Aggregated sensor data gives you pattern of life: where people go, who they meet, which facilities matter, how goods move, and how critical systems operate.
“Hostile intelligence services don’t care what our acceptable-use policies or privacy statutes say. If we let them get the data, they’ll use it for their purposes.
“It isn’t enough to regulate what Flock, a police department, or another legitimate operator may do with aggregated data. We must ask whether Russia, China or somebody else can obtain that same data and build their own intelligence picture.
“When you deploy a nationwide sensor network capable of reconstructing movements and relationships, you have built an intelligence platform whether you intended to or not.
“The security requirement has to follow the intelligence value of the aggregate, not the apparent sensitivity of the individual sensor.
“Policymakers and operators must ask themselves: what collection or effects capabilities have we created, who else wants them, and how well are we protecting them?”
Cameras are things that you need to trust. And if you cannot trust them, the only option is to toss them ASAP.
Related
This entry was posted on October 27, 2026 at 8:59 am and is filed under Commentary with tags Cameras, Ukraine. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
When security cameras become surveillance tools
When the cameras you install to protect your organization become a way for someone else to watch you, the security implications go well beyond video footage.
Recent reports that hackers accessed Dahua surveillance cameras and recorders in Ukraine, including changing settings and creating unauthorized accounts, raise bigger questions about IoT security, exposed devices and the risks of turning everyday connected technology into an intelligence-gathering tool.
I have four cybersecurity experts offering perspective on the story for your consideration, including why connected devices are so often overlooked, how compromised cameras can expose an organization’s people and security operations, how attackers can exploit the connections between physical and cyber infrastructure, and how camera networks can become powerful intelligence assets when their data is aggregated.
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security (www.ridgesecurity.ai)
“I’ve seen the broader risk firsthand during several authorized, full-scope adversarial emulation engagements. While the techniques differed from those reported in Ukraine, the principle is the same. Compromising surveillance infrastructure can give attackers visibility into the very systems and personnel responsible for protecting an organization. I call that watching the watchers.
What concerns me is that these systems rarely operate in isolation. Video surveillance, physical access controls, building automation, and alarm systems may be interconnected. For an advanced adversary coordinating cyber and physical operations, that visibility can reveal security procedures, personnel movements, and potential gaps in response. The camera is no longer just watching the door; it may be helping someone figure out when to walk through it.
Manufacturers must take greater responsibility for secure-by-default configurations, strong authentication, firmware maintenance, and independent adversarial testing before and after products reach the market. Organizations should isolate these systems, eliminate unnecessary cloud access, and validate their defenses against realistic attack paths. Installing a security device shouldn’t require taking its security claims on faith.”
John Strand, Owner, Black Hills Information Security (www.blackhillsinfosec.com)
“Watch any spy movie and you’ll see the importance of cameras. They can reveal physical blind spots, capture high-resolution video of someone’s fingers as they type a password, or show sensitive information on a screen.
“What’s interesting about this particular story is how many problems are stacked together. Predictable serial numbers. Easy cloud access. Outdated firmware. It’s amazing to me how bad the entire security ecosystem around some of these cameras is.
“But this isn’t unusual. We see the same thing across connected IoT devices that fall outside traditional endpoint management. Patching is poor, firmware gets forgotten, and there’s often absolutely no security monitoring. These devices can see what people type and what’s on their screens, yet nobody is watching the devices themselves.”
Phillip Wylie, Chief Security Evangelist, Suzu Labs (www.suzulabs.com)
“Security cameras are supposed to help protect organizations, but when they’re compromised, they can become surveillance tools for attackers. Instead of protecting your environment, they’re potentially giving someone else visibility into your operations, personnel, and physical security.
“One of the biggest challenges with IoT devices is that they’re often installed and forgotten. Organizations may not realize these devices are running outdated firmware, using weak credentials, or are accessible from the internet. Attackers look for these weaknesses because they can provide an easy entry point into an organization’s environment.
“Manufacturers need to prioritize security by design, including secure default configurations, strong authentication, and reliable firmware updates. Organizations also need to take responsibility for securing these devices by changing default credentials, limiting internet exposure, segmenting networks, and regularly checking for firmware updates.
“Ultimately, a security camera is another computer connected to your network, and it needs to be treated with the same level of security attention as any other endpoint.”
Donald McFarlane, Board Member, Xcape, Inc (www.xcapeinc.com)
“A camera is a sensor. A network of cameras (or radios, vehicles, routers or other connected devices) is an intelligence collection system.
“We have been seeing nation states turn privately deployed technology into intelligence assets for a long time. Russian intelligence has been publicly linked to compromising cameras to monitor NATO logistics and to identify Ukrainian personnel. U.S. agencies have assessed that Chinese state actors have penetrated and persisted in American communications infrastructure for years, maintaining access that could support disruption in a future conflict.
“An individual camera gives you an image. Aggregated sensor data gives you pattern of life: where people go, who they meet, which facilities matter, how goods move, and how critical systems operate.
“Hostile intelligence services don’t care what our acceptable-use policies or privacy statutes say. If we let them get the data, they’ll use it for their purposes.
“It isn’t enough to regulate what Flock, a police department, or another legitimate operator may do with aggregated data. We must ask whether Russia, China or somebody else can obtain that same data and build their own intelligence picture.
“When you deploy a nationwide sensor network capable of reconstructing movements and relationships, you have built an intelligence platform whether you intended to or not.
“The security requirement has to follow the intelligence value of the aggregate, not the apparent sensitivity of the individual sensor.
“Policymakers and operators must ask themselves: what collection or effects capabilities have we created, who else wants them, and how well are we protecting them?”
Cameras are things that you need to trust. And if you cannot trust them, the only option is to toss them ASAP.
Share this:
Like this:
Related
This entry was posted on October 27, 2026 at 8:59 am and is filed under Commentary with tags Cameras, Ukraine. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.