Safety trade-off when installing cheap surveillance cameras

When moving into a newly built house, the first thing Huy Toan (Nam Dinh) did was install a surveillance system. A dealer near his house advised him to choose three cameras, priced at 1.5 million VND for an outdoor camera and 1 million VND for an indoor camera. However, looking online, he found a device with similar functions for only a few hundred thousand VND, which made him change his mind.

"With the same amount of money, I could buy a dozen, even sharper and with more features," he said, and installed six cameras, both in the yard and in the rooms. "The equipment may not be durable, but if it breaks, it's easy to replace without regret." Although he was advised not to put it in the bedroom, he still installed it because he needed to watch his young child and didn't want any "dead corners" in the house that he couldn't monitor.

"I installed it myself and set the password myself, so I don't have to worry about anyone peeking," he said.

With similar thoughts, many people choose cheap cameras, sold on the Internet instead of products of reputable brands. On e-commerce platforms, many cameras priced at 200-300 thousand VND are advertised to support full features such as 360-degree rotation, motion detection, night vision... and attract tens of thousands of purchases.

"Surveillance cameras only need to provide images. In terms of specifications, these cameras are even better than products costing millions of dong," said Quoc Dung (Ho Chi Minh City). "Sometimes we are warned about safety issues, but once installed, we don't want to remove them unless they break."

Cheap cameras attract Vietnamese users

In many stores and on e-commerce sites, there are hundreds of types of surveillance cameras, usually priced over 500,000 VND each with major brands such as HikVision, Ezviz, iMou. Meanwhile, unbranded or less-known cameras are only about 200,000 VND, but are advertised to support 2K resolution, Wi-Fi connection, have a call screen...

Mr. Nguyen Trung Kien, CEO of Pavana - a company specializing in camera manufacturing with a factory in Vinh Phuc, said that when attending international electronics fairs, many Chinese units offered cameras for more than 6 USD (150,000 VND) and partners could attach their desired logo.

Citing a global report, Mr. Kien said that surveillance cameras in the world in general are mainly for businesses and governments with a market share of over 70%, while cameras for families account for about 15%. Meanwhile, in Vietnam, Pavana's survey shows that half of the market share is devices used for home surveillance purposes. Most of them are cheap devices from 200,000 to under 1,000,000 VND, sold online.

"This is not only a challenge for domestic camera manufacturers, but also poses a great risk to the information security of users, agencies and organizations," said Mr. Kien.

In fact, recently in Vietnam, Internet surveillance cameras (IP Cameras) have caused many major problems regarding information security, such as private images being shared publicly on 800,000 cameras, devices infected with malware becoming part of a botnet...

Self-set passwords can still be hacked

In Vietnam, many users leave account setup to technicians without changing the default password, leading to unauthorized access from strangers. However, even when setting a password themselves, as in Huy Toan's case, users are still at risk of being attacked.

Mr. Vu Ngoc Son, an expert from the National Cyber ​​Security Association, said that hackers do not attack directly but through the camera management server. After finding and exploiting vulnerabilities, they can bypass the authentication layer and gain access to the camera.

This situation was recorded on 150,000 Verkada cameras in the US in 2021. Although the company had deployed multi-factor authentication, hackers still attacked the server and bypassed the authentication steps. In 2023, hackers also accessed many HikVision cameras in Vietnam to warn users that they had not patched the security hole.

At the camera conference in May, Mr. Nguyen Viet Bang, Deputy General Director of VNPT Technology, emphasized that cameras look simple and small, but are complex devices, with optical components, processors, and information transmission over the network.

"With such equipment, it can completely become an information gathering device. A camera placed in the house will be like a computer with an operating system, recording sound, taking pictures and almost having an extra person running silently in your house," he said.

In addition, with the Internet viewing mechanism, camera data will be transmitted to the company's server, then transferred to the user's viewing device, such as a smartphone. The fact that companies do not place servers in Vietnam also makes it difficult to manage and control information. According to statistics, more than 96% of cameras imported into Vietnam are from China.

Mr. Nguyen Trung Kien commented that with insecure cameras, even when installed in public places, there can be potential risks of information security loss for individuals and organizations. For example, with a camera installed in a supermarket, if it is hacked and monitored, the attacker can know which items are of interest, thereby implementing competitive plans. Or a camera installed in the yard can also reveal the living hours of a certain family.

To reduce this risk, experts recommend that people choose cameras with clear origins, with published video storage locations and data security policies. When installing, avoid sensitive locations, change passwords immediately upon delivery, use multi-layer authentication, and regularly update software patches.

In August, the Ministry of Information and Communications also announced a draft of the National Technical Regulation on basic information security requirements for IP cameras. Some detailed requirements mentioned include that the default password must be initialized uniquely on each device and must meet the complexity requirements to prevent automated attacks; the manufacturer must have an online system that allows receiving and publishing information about vulnerabilities; personal data collected and processed by the camera device must be transmitted between the device and related services using a secure encrypted connection channel.