Schneier on Security

Clive Robinson • July 9, 2020 8:47 AM

Basically, attackers can learn very basic information about what’s going on in front of the camera, and infer when there is someone home.

This is expected.

If you think about an uncompressed or unencoded video signal from a fixed point camera, it is a very very repetative image, that gets scanned.

The result is a signal where each scan line does not change from frame to frame, and infact does not change very much from the scan line either side, except for the first and last lines of a frame or interlace scan.

If something moving comes into the cameras field of view then it will have spectral components that relate to both it’s speed and directionality as well as it’s image.

Whilst you may not be able to determin the image of the object simply by spectral content differences determining the speed and direction of the moving object is not that difficult via 2D Fourier analysis.

But, even after compression the spectral component changes become rather more pronounced in the output signal.

I think most of us have seen the “Tux Image” with it’s before and after encryption using the wrong encryption mode well that image comes about from the spectral components in the signal at “edges”.

As I’ve mentioned in the past you actually do not need a high frequency signal to tell what is being watched on various displays. Sufficient information from frame to frame which coresponds to the average intensity of the frame can be detected by monitoring the input to the display powersupply. This can be compared to a known signal to work out what TV channel you are watching or which DVD etc.

The reason I mentioned it back then was that I also noted that the likes of burglars could determin your behavious from the power signiture of your whole house, and that Smart Meters could be in theory used to spy on selected homes over the power grid.

So to use an old saying “Colour me unsuprised” that people are only now getting around to it…

Clive Robinson • July 9, 2020 11:43 AM

@ me,

but most of the people publish stuff on facebook

But accessing that is an “active” attack that leaves a trail, that investigators can and do these days follow.

The way things are today it’s highly unlikely there are burglars and the like who could pull off an “active” attack and not get recorded along the way. Whilst they might get away with it once or twice, they start running out of options, also they are likely to make OpSec mistakes that give them away in some way.

This attack being “traffic analysis” is effectively a “passive” attack. That is you simply sit somewhere in somebidies upstream router and watch the packets flow by.

Which unlike an active attack does not require you to actually visit the end points such as the users home or Facebook servers just some opportune point such as an upstream router. This immediately makes any investigation much much harder.

Whilst your comms to the intercept head on the upstream router might be detected, it takes a lot lot less effort to disguse what you are doing and thus break any correlation attack on you an investigator might carry out.

A simple example is the intercept head would log ten to twenty potential targets plus another ten or a hundred targets you are never going to attack on the intercept head, these would then get sent at random times to a “drop point” somewhere that you never access. Because you have another intercept point on a router upstream of the drop point, that again at random times sends parts of the log.

If you use encryption wisely you’ve effectively built in two “cut outs” which break most simple analysis because they “store, change and forward” thus breaking correlations in time size and content.

Whist some readers of this blog are more than capable of doing this, again it’s not something your average house breaker would be upto, however it’s well within the capabilities of higher level criminal “helpers” and thus those working for quite a number of central and local governments agencies, and meadium to large national or international corporates, and well within the capabilities of those carrying out economic espianage from quite a small organisation upwards to the likes of Kroll and quite a few “pen-testers” as well.

So whilst burglary might be on the agenda, so might the various other forms of “black bag jobs” including the various levels of “wet work” from kidnapping, through tourture and assasination.

Thus people who might pay money for the “premium service” of these camera systems, they might be better spending the money up front on a better “CCTV System” with the empasis very much on “Closed”.

Clive Robinson • July 10, 2020 2:04 AM

@ Q,

The real problem is the “cloud” connection.

Yup hence my comment of,

spending the money up front on a better “CCTV System” with the empasis very much on “Closed”.

One of the first rules of security is “keep your secrets under your control” with the likes of the old “Three can keep a secret, if the other two are dead”.

I’ve always contended that a “Service Level Agreement” does not constitute “control” in any meaningful way thus “moving to the cloud” is a bad idea especialy if based on very short term financial thinking.

@ Steve,

Make of that what you will.

That is the “news item” sites doing and nodoubt “CNN Business” is charging handsomely for, and yes it would be funny if it was an “Internet based” camera.

Not so fot the researchers who I suspect have no control in any way over it, thus might be somewhat annoyed. One of whom –from Queen Mary University of London– I’ve met and chated with in the past all be it briefly, as I get older I find the world feels smaller :-S

Clive Robinson • July 10, 2020 11:34 AM

@ me,

isn’t the attack a mitm attack where you intercept data

No it’s not a MITM attack, because you are not putting yourself between the end points, and the data is “not going through you”

That is you are not changing the flow of data in any way or the number of nodes etc, you are just simply observing the traffic go by with the data packets like “ants in an ant farm” going about their business as usual.