Tag: security

Darwin council claims new CCTV cameras “will not use facial recognition”

Internet of Things (IoT)

Darwin council insists that the new set of cameras in the Central Business District will not employ facial recognition until the technology is more carefully considered.

The 138 cameras were installed as part of the Switching On Darwin project, which also provides public wifi, new lighting, and traffic sensors. Although the cameras do have facial recognition hardware in them, the city does not plan to utilize it at this time.

However, council general manager Josh Sattler stated that although the city will not employ the technology, “requests coming from a state or federal agency” will “need to be complied with.” 

Install first, question later

Of the 81 grants offered by Australia’s Smart Cities and Suburbs program, only the Darwin proposal included funding for facial recognition technology. The Darwin council’s addition of the technology was done without public consultation. An estimated six month study by an outside consultant agency began in August.

Concerns with facial recognition

Many question the council’s decision to include a technology that will supposedly not be employed. Julia Powles, researcher and associate professor at the University of Western Australia, questions “the real reason why [the technologies] were sought in the first place”, adding “it’s like buying a supercomputer and then saying you’re just going to surf the web and check emails.”

Security of camera feeds also stands out as a major concern. Elise Thomas from the International Cyber Policy Centre, offered a warning along these lines:

“The ways in which a lot of these projects are being implemented at the level of local councils, particularly from a cyber-security perspective, those councils may not necessarily have the resources to ensure that their systems are secure”

Internet connected devices are notoriously vulnerable to security breaches. Any gateway into a network-connected device can open doors to the entire network. Depending on the type of access provided, compromised devices can be mined for data, or even remotely controlled by outside parties.

What You Should Already Know About Shodan

General

Shodan is an account-based search engine that searches for, and provides information about, internet-connected devices.

Use and misuse

Originally intended to help companies monitor where their software was being used, it is generally used today to gain access to or information about devices and systems. Searches can notify companies of weaknesses in their own databases. The most common vulnerabilities are default, system-wide passwords and logins, user-generated passwords such as “12345678”. These predictable entry points, coupled with the massive amount of devices whose username is “admin”, can easily allow outside access to an entire network.

Shodan users have been able to defrost hockey rinks in Denmark, reconfigure traffic control systems, and, more personally, access individual’s webcams and remotely access their screens.

Securing your devices

Insulating yourself or at least certain devices from Shodan searches can be simple enough. A device that isn’t connected to the public internet will not be searchable. Some devices are much more reliant on internal communication through educational or corporate networks, and may not need public internet access. Obviously this is not the case with most personal devices. Secure passwords are the next step. Any program or network that provides a default password or login should be changed after logging in. Not doing so is a blatant invitation for a device to be found on shodan (and accessed by a third party). A Shodan search for “default password” provided over 61,000 results at the time of writing. In some cases the username and password were the same. 

Shodan’s investigative reach

Shodan itself is only a port scanner; it searches for processes that can be initiated, but does not initiate anything itself, and is therefore legal and widely used for security and legal data mining. In the same way that Google offers an overwhelming feeling of access to information, Shodan’s tagline, “The search engine for security/the web/webcams/refrigerators/power plants/buildings” should be reason enough to consider how much you or someone else can know about any of your devices that are connected to the internet.