Is your camera spying on you? : A security evaluation of a smart camera

Abstract: There are billions of Internet of Things (IoT) devices deployed world wide. Despite this there have been numerous studies showing that these devices very often have major security vulnerabilities. Ensuring the security of IoT devices is important, but especially so for devices that handle sensitive data. The goal of this thesis was to evaluate the security of one such device, a smart camera. It is not possible to ensure the security of every device out there, but analyzing the security of as many devices as possible gives valuable insight into what kinds of vulnerabilities affect different kinds of devices. This can both be used to patch current devices and as a guideline for what parts of the system needs to be secured during development of new devices. The security was evaluated by first building a threat model and then identifying threats against it. Penetration tests were then created to test for the existence of these threats. The thesis found that the evaluated camera has many unnecessary and/or insecure services installed which weakens the security of the device without providing much value. The device was also found to not receive timely updates and the tools installed are old and contain multiple vulnerabilities.