PrintUS Kabul Embassy Buying Chinese Security Cameras
The U.S. Embassy in Kabul, Afghanistan has ordered security cameras from a Chinese-owned company,according to author John Honovich in his blog "To Inform is To Influence." In the embassy solicitation, bidders are required to offer only cameras made by Hikvision, a company based in Hangzhou, China.
The U.S. Embassy in Kabul has long been targeted by the Taliban and al-Qaeda. Now, with ISIS active in Afghanistan, we can expect even more trouble there. Just this week there was a major bombing of the American University in Kabul, near the embassy, resulting in 12 dead and many more wounded.
As for the Chinese security cameras, the size of the contract is not important (and in any case is not much). But we are wondering exactly what the security officer in charge of the Kabul embassy facility must be thinking in specifying Chinese cameras for the protection of the facility?
Today there are principally two basic types of security cameras -- wired and wireless. Wireless cameras are increasingly popular but WiFi is a big intercept risk, so in most serious security environments wired cameras are preferred.
But today's wired cameras are usually connected through an Ethernet network, as are these Chinese cameras. Even though these cameras are wired, they are far from secure.
In an important article in Forbes, Andy Greenberg reported that more than a dozen camera brands are vulnerable to hijacking (representing tens of thousands of cameras bought by homeowners, businesses, and government agencies).
Hijacking a camera has serious security consequences. A hacker can watch what is going on in and around a facility, copy the video streams from each camera, and alter the video that is seen by the guards or monitors. The intruder can also delete recorded segments so information after the fact of a physical event such as a shooting or bombing cannot be recovered.
It seems that is only the beginning. Because the cameras are run through the facility computer system that, in many cases, control all the security systems,the hacker now has active control of the facility security apparatus. He can collect passwords, download data, circumvent firewalls, crash the entire system, or whatever he wants to do. He will be able to record the faces of personnel and visitors which he can use for a variety of purposes. He can test reaction times by staging events in front of select cameras facing the perimeter of a site. And he can also see how security cameras can be fooled and take advantage of these vulnerabilities in a subsequent physical attack against the facility.
Why are cameras so insecure? One reason is they are cheap, and securing a system is expensive. The market today looks for cheap in preference to secure. Cameras that are vulnerable to intercept through computer networks expose the entire computer network to compromise.
In the case of Chinese cameras, which is what Hikvision cameras are, many of them use firmware that has been proven to be easily hackable. A large number of the known vulnerable cameras use firmware developed by yet another Chinese company, RaySharp (Zhuhai RaySharp Technology Co., Ltd). According to Forbes, "[the]security firm Rapid7′s chief security officer H.D. Moore, has discovered that 58,000... hackable video boxes, all of which use firmware provided by the Guangdong, China-based firm Ray Sharp, [which] are accessible via the Internet."
We do not know whether Hikvision uses RaySharp's firmware.
If the procurement officer actually thought these cameras were more secure than others, that would have been claimed as part of the sole-source justification. In fact no claims of any kind are made in the procurement request for proposal regarding the Hikvision product.
The Hikvision cameras are commercial, off-the-shelf products that are reasonably priced. But the issue is not the cost. The issue is that the U.S. embassy is installing commercial cameras in one if its most sensitive locations. This is a big mistake, and mistakes like this can cost lives. There are plenty of trusted American suppliers of systems with better security that are designed for places like the Kabul embassy.
Dr. Stephen Bryen is the founder and former head of the Defense Technology Security Administration.
