The international study was conducted by researchers at Queen Mary University of London (QMUL) and the Chinese Academy of Sciences, using data provided by a large Chinese manufacturer of Internet Protocol (IP) security cameras.
Cameras like these allow users to remotely monitor their homes via video streaming over the Internet, but researchers say the traffic generated by the devices can reveal information that compromises privacy.
Study author Gareth Tyson of QMUL told CNN that unencrypted data loads increase when a camera records something in motion, so an attacker could tell if the camera was loading images of someone on the move, and even different types of movement, such as running or sitting.
The risk is that “someone who is specifically targeting an individual home is moving outward with a device to try to start monitoring traffic passively,” he said.
Tyson told CNN that an attacker would require a decent level of technical knowledge to monitor the data themselves, but there is a chance that someone could develop a program to do it and sell it online.
Noting that he has not seen any direct evidence of this type of attack, he said that a potential use would be if someone wanted to rob your home.
“They monitor camera traffic for an extended period of time, and by looking at the patterns generated by those cameras for perhaps a week, they begin to predict the next week when it is most likely to be in the house.” he said.
To reduce privacy risk, companies could randomly inject data into their systems to make it difficult for attackers to detect a pattern, he said.
Tyson said the team is trying to expand its research to discover how to maintain camera performance and reduce privacy risks.
Today, cameras are “pretty stupid items” to keep manufacturing costs down, Tyson said, loading data every time motion is detected.
“What we want to do is have a smarter system that allows the camera to understand what that movement is, assess the level of risk and just upload it and alert the user in a case where the camera feels it is worth doing.” he said.
For example, someone who owns a cat probably doesn’t want to be alerted every time the camera detects the animal walking, but they certainly would want to know if a human intruder was seen.
Tyson said this is the first study to investigate the risks posed by video streaming traffic generated by cameras.
The global device market is expected to be worth $ 1.3 billion by 2023, according to the press release. Popular brands include Xiaomi and Nest, which is owned by Google.
While the study authors did not analyze data from those brands, they did find that their cameras pose the same privacy risk. CNN has reached out to Nest and Xiaomi to comment on the investigation.
The study was published at the IEEE International Conference on Computer Communications, which brings together researchers in networks and related fields.
.
