Disabling/Destroying CCTV/IP Cameras with Lasers?

Question

@D3C4FF has asked a great question and I would like to follow up on that. Basically he had asked whether "[...] an attacker can identify if a CCTV camera is on/operational without direct physical access to the cable/camera[.]".

I was highly impressed by @TildalWave 's answer, and particularly about disabling cameras: "[...] all you need is a decent pocket/torch size green laser (532 nm) directed for a few seconds directly into their CCD/CMOS sensor.".

I remember some 10 years ago kids in my neighborhood had found out that you could 'DoS' the street lights using the same technique (by pointing the laser to a point near the back of the light bulb). I figured out that this was because those posts light automatically when it gets dark (meaning lack of light) and as soon as it gets bright (meaning light went inside its sensors) the light would turn off.

So I would like to ask:

1 - How does this laser attack apply to cameras?

2 - For which types of cameras does the laser pen attack work against (CCTV Vs. IP)?

3 - Is the laser pen attack the only vector against those devices (apart from obvious things like fire, TNT, acid, shooting, etc)?

4 - Why are cameras still vulnerable to it, if at all?

5 - Finally, how can I prevent those type of attacks against my cameras (they are all IP-based)?

---

Just a quick edit for those who (like me) was not sure whether this question was appropriate for the site, I have posted a question on Meta.

Answer 1

I've experimented with this attack previously.

It depends on a few variables. First, the strength in mW of the laser you are using. Second the quality of the camera you are trying to disable.

1 - How does this laser attack apply to cameras?

• A laser creates a super bright and focused spot on the CCD (camera sensor). This spot can be bright enough to blind the camera, or strong enough to physically damage the CCD/CMOS sensor of the camera (melting, overloading the circuitry etc). This is the type of image you'll see when a lazer is pointed at your camera:

2 - For which types of cameras does the laser pen attack work against (CCTV Vs. IP)?

• It doesn't matter. It will work on ALL visible light imaging technologies. This includes film cameras, CCD, CMOS sensors etc. I've tested this with 'prosumer' point and shoot cameras and a wide variety of CCTV cameras. Being IP/CCTV doesn't change the fact that your overloading the light sensing components of the imaging sensor.

3 - Is the laser pen attack the only vector against those devices (apart from obvious things like fire, TNT, acid, shooting, etc)?

• NO! Another clever one that i've used to success is wearable Infrared LED clothes (usually on a hat). This is essentially the same as using a bright light to obscure you from view, you will show up on the screen, but if you use bright enough LED's, it'll make you un-identifiable.

4 - Why are cameras still vulnerable to it, if at all?

• Because cameras sense light, if you throw enough light at them, they won't be able to process the weaker reflected ambient light.

5 - Finally, how can I prevent those type of attacks against my cameras (they are all IP-based)?

• You can't really. Its part of the design of the cameras. The best thing to do would be to identify cameras that may be vulnerable and perhaps install hidden cameras in the area so that if someone disables an overt camera, they'll hopefully miss the covert one.

For more information on this type of attack, check this guy's site, there have been a few projects like this around but this is well written up and contains lots of good example shots.

Answer 2

To add to D3C4FF's answer:

1. Security camera's are often used to direct security staff. It's sufficient to know that a camera is under attack. Real-world security camera's have tamper sensors and self-diagnostics for the same reason: to detect physical attack as opposed to internal failure.

2. Obviously, have physical security staff. Camera's are not a full replacement, they just allow you to deploy people where it is actually necessary.

The same logic actually applies to those wearable IR leds suggested. Camera's don't need to detect precisely what is unusual, it is sufficient to detect that something is unusual. From that point you get a human involved.