Skip to main content

Why are hackers snooping on smart home security cameras? I asked an ex-hacker

One night about 20 years ago, while surfing the web on my family’s Gateway 2000, Netscape Navigator slowed to a crawl. The mouse stopped responding. Even Ctrl-Alt-Delete did nothing.

Then, a Windows warning popped up. It looked … wrong. A moment later, the screen went blank, the CD-ROM tray opened, and a chat box appeared.

I was freaked out, but I knew what was going on. I was hacked.

Through the chatbox, my hacker explained what happened. I’d fallen victim to a Trojan, which let the hacker access my computer and control it. The only way to fix the damage was to reformat the PC’s hard drive.

The Trojan that infected me, Sub7, was an early example of malware programmed by someone known as “mobman.” I never learned the identity of the hacker who sent Sub7 to me, but the Trojan’s creator now works as a security expert. I contacted him to find out why someone might want to randomly hack into a stranger’s life, a phenomena that’s become disturbingly common on today’s smart home cameras.

The Ring problem

Ring hasn’t had the best luck, for sure. With all the recent hacks in the news of late, it should come as no shock that people are concerned. Hackers have targeted Ring’s cameras in droves, leading to creepy stories of hackers spying on, and even taunting, their victims.

But why? What do hackers gain from snooping on smart home cameras? It’s a tough question to ask and answer, especially when the hackers are rarely caught or found.

Image used with permission by copyright holder

This led me to sniff out an answer from the “mobman” himself, who’s also known as Gregory Hanis.

Hanis now directs his skills towards professional internet security. He’s currently the chief technology officer of Viperline Solutions, an Alabama IT security solutions company. I asked him why hackers want to hack security cameras. His answer was simple, though not particularly comforting. Often, it’s just for fun.

I think, right now, people are doing it for kicks and giggles.

Hanis’ Trojan, Sub7, could tap into a victim’s connected webcam. It could view video in real time or listen in through a microphone. Sub7 thrived in the late ’90s and early 2000s, when most PC owners didn’t have proper antivirus protection installed. Its victims were easy targets, but those using Sub7 often did so only to prank or scare victims.

“I think right now, people are doing it for kicks and giggles, and they’re just targeting solo. They’re not making it a big enterprise kind of deal, or even targeting anybody,” said Hanis.

It doesn’t seem Ring’s cameras were compromised by an elaborate hack of parent company Amazon’s servers. Instead, login data was likely obtained by examining hacked credentials from other sources, guessing passwords, or through social engineering. Two-factor authentication can stop these intrusions, but, like PC owners in the late 1990s, people who own smart home cameras often don’t have security at top of mind.

When asked about the hacker who accessed a Ring camera to speak to a little girl, Hanis wasn’t impressed. “I looked at it, it looks like there are some videos on YouTube about people, I don’t want to say hackers, right? I want to say ding-dongs, criminals, or whoever, accessing some little kid’s room.”

Ring, and its rivals, must focus on security

Hanis thinks Ring should do more to prevent hackers from accessing cameras. “I think they said they have multifactor authentication. I don’t know why people don’t turn that on. [Ring] should’ve put it by default on, like when you’re creating your account.”

Ring eventually recommended users turn on two-factor authentication, but only after hacks hit the news. Now, with its new Control Center, Ring is placing emphasis on privacy and security settings in the main dashboard of the app. Currently, two-factor authentication is an opt-out option during new account setups, but soon, it will also be an opt-out option during new device setups on existing accounts as well.

Lawsuits have been filed in California by plaintiffs alleging Ring’s failure to offer basic security measures to prevent these hacks. In one instance, a couple was threatened with “termination” unless they paid the hacker 50 bitcoin (about $436,000).

Having developed Sub7, and now as manager of other security-related projects, Hanis feels Ring’s issues stem from the lack of focus on programming security features that tackle problematic scenarios.

“I’m 100% sure that when they go to develop these products and whatnot, they don’t do that. They don’t think about all the what ifs,” said Hanis. “And that’s why we’re going to have these problems, and we’re still going to have these problems. Until there’s something that enforces that, or some accountability, it doesn’t matter.”

Hackers can easily compromise gadgets that have poor security development, so it’s the responsibility of companies to make them a priority from the get-go, rather than later. As Hanis pointed out, Ring could’ve avoided issues if two-factor authentication was offered during the initial setup process.

Hacks will likely become more severe

While some isolated incidents have involved criminal activities like threats or attempts at extortion, these are rare. The mass attacks that occur through emails, text messages, and social media haven’t hit cameras. Yet.

I didn’t see actually somebody getting robbed because there are times of knowing when they’re home. It’s bound to get there.

“I didn’t see that much maliciousness. I didn’t see actually somebody getting robbed because there are times of knowing when they’re home,” said Hanis. However, he thinks “It’s bound to get there.”

His warning is sobering and, in all likelihood, correct. Hackers will attempt to find new ways and develop tools to remotely access cameras without owners’ knowledge.

This is exactly the evolution displayed by Trojans and other malware. Early examples, like Hanis’ Sub7, could be malicious but were often more of an annoyance than a serious problem. Yet the threat rapidly evolved. Hackers began to push the limits of what existing Trojans could do, then created new malware and used new techniques for deploying it. Only a decade separates early Trojans like Sub7 and the weaponized use of malware that brought down Iran’s nuclear program.

It’s up to Ring, and other companies that sell smart security cameras, to ensure proper safeguards are in place. From educating users, to sending out constant reminders to set up two-factor authentication, or even giving people a history of what devices are connected to an account, these methods foster awareness that would benefit everyone. Otherwise, owners are bound to fall victim to hackers.

Editors' Recommendations

John Velasco
John is the Smart Home editor at Digital Trends covering all of the latest tech in this emerging market. From uncovering some…
Google Home adds support for Nest Cam Indoor
A cartoon depiction of the Google Home app and Nest Cam Indoor.

Google Home is continuing to expand its roster, with Google today adding support for the Nest Cam Indoor (1st Gen). This allows you to manage all aspects of your camera, such as checking your notification history and accessing your camera feed.

There’s a bit of a catch, as support for Nest Cam Indoor is only available in Public Preview. To join Public Preview and gain early access to the feature, you’ll need to dive into the Settings on your Home app and select Join Public Preview. You’ll then get a prompt to update Public Preview -- accept this invitation, and you’ll see another prompt letting you know when you’re eligible to transfer your camera to Google Home.

Read more
Blink Outdoor Camera 4 launches with Person Detection, new design, 2-year battery life
The Blink Outdoor Camera 4 mounted on a brick wall.

The Blink Outdoor Camera 4 is the newest addition to the Blink catalog, offering the same impressive battery life as its predecessor while bundling in better motion detection skills and a sleek, updated design. The camera is now available for $120, which includes a Sync Module 2.

One of the first things you’ll notice about the Blink Outdoor Camera 4 is its new look. It’s still a solid black square like the old Blink Outdoor Camera 3, but its camera has been repositioned from the center of the device to the top corner. It also looks a bit more streamlined than the outgoing model, with fewer accents and indentations across its front.

Read more
Why moving your smart home could be a nightmare
Philips Hue Appear Outdoor smart light.

The smart home concept is a great thing. It allows us to automate things from lighting to temperature, make video calls while we prepare dinner, and get answers to questions instantly. In its current state, it has one fatal flaw, however: The smart home is not really meant to move.

In fact, you might want to leave behind the majority of your smart home gadgets when selling your property.
What to know about moving smart home gadgets
Think about it: Some of us have literally dozens of devices including lights, thermostats, robot vacuums, speakers, security cameras, wireless alarm systems, and more. How would you go about removing, relocating, and reconnecting all those devices to Wi-Fi in a new house if you ever need to move? On the surface, it sounds daunting.

Read more