Is Your Home Leaking Live Video?

rtspArs Technica recently published a great article entitled “Internet of Things” security is hilariously broken and getting worse. It talks about how the security of the Internet of Things is hilariously broken. And how it’s getting worse. I think we’ve heard these themes before…

Anyway, the article goes to the real heart of the problem and offers some good advice. It’s well worth the read. The interesting thing is what happened next. We’ve been seeing this article referenced in lots of other media, but really only one aspect of it: Shodan and how it enables people to find unsecured home webcams. Yes, Shodan, the infamous search engine that allows hackers to find all sorts of interesting things on the internet to break into and play with.

Ars Technica began their article by talking about Shodan and how it can be used to find unsecured web cameras on the internet. They even included a picture of a sleeping baby in a crib that was taken from someone’s unsecured webcam to bring home the point. Because nothing says IoT dangers quite like having your baby spied on.

The reason for this unsecured video problem centers around a protocol called RTSP (The Real Time Streaming Protocol). Some webcams use RTSP to provide access to their video streams. If access to the camera is available outside of the local network (typically on port 554) and it isn’t secured, then anyone can see what goes on in your house. Even if a password is used, RTSP relies on the not-so-secure Basic Authentication method which is really not so secure at all.

Now remember, this is not ultra-secret hacker stuff we’re talking about. A typical junior high school kid with access to Google can figure out how to access these cameras. And how to find them? Well, Shodan has lists of a whooooooole lot of ’em.

RouterCheck now detects unsecured RTSP video

Here at RouterCheck we recognized that people would become concerned by the reports in the media. We realized that people would be asking themselves “Is my home leaking live video?”. Unfortunately, there’s really no simple way to find out if you don’t understand the technology.

We then asked: “Is this really a big problem?”. We went and crunched through the logs of thousands of RouterCheck tests and found hundreds and hundreds of networks that had port 554 open (a telltale sign that RTSP is running). Yup, that was enough to convince us that the threat was real.

So we created a simple solution. RouterCheck already tests to see whether there are unnecessary and dangerous ports open on your router. So we simply built a new test to see whether those ports were leaking video. And no, we don’t access the video stream if it’s there, we simply detect the software that’s providing it.

Starting today, any checks that are made with RouterCheck will test for the Open RTSP problem and will be reported in the Tested Vulnerabilities section of the RouterCheck status report. Anyone testing positive for this vulnerability is advised to inspect any web or video cameras that they have in their home.