3

Picture the following: A server controlling security cameras has a script that takes stored footage, encrypts the files with GPG, and moves it into a cloud storage folder (Dropbox in this case).

If an adversary compromised that account, what information could he gain from looking at the time at which footage is uploaded?

Note that footage is only recorded when motion is detected, so there's not a constant stream of data.

Footage has to be uploaded very soon after its recorded to protect from theft, so time delays in the script may not help much.

  • 1
    The first idea coming to mind is the attacker checks whether s/he's been detected during a break-in. Other than that, getting false alarm rates, learning security staff habits (and routing around patrols). – Deer Hunter Sep 13 '15 at 17:25
  • Sure. If it was designed so you can't tell which camera it came from without decrypting the files, that would help greatly in mitigating this. (Especially as more cameras are added). It might make looking for camera footage on the server harder, unless there was a searchable encrypted data scheme, which few providers have. – JvH Sep 13 '15 at 19:44
1

A lot would depend on your environment and what is being protected by the security cameras. For example, if you have multiple cameras and different filenames for each camera, then potentially, you could track the movements of someone in your environment. This could compromise other aspects of your security - for example, tell someone where the security patrol is or what path/pattern they follow and frequency of patrols etc. It may also be possible to perform some analysis of the file sizes to derive some other information as well - for example, perhaps number of people etc. One of the limitations of this type of metadata analysis is that you typically require quite large data sets in order to find meaningful metadata information. This often means considerable effort over an extended period of time. It also needs additional information about the environment i.e. number of cameras, site layout, file formats etc. Humans are also very creative and the right individual with the right mindset may find ways of deriving information which nobody else was able to conceive. This is why it is usually wise to limit the amount of information, meta or otherwise, attackers can access. The challenge is getting the balance right - at what point is the amount of effort used to hide this information more effort than the risk it is protecting against.

Then of course, there is the danger of actually cracking your gpg - while gpg is pretty good, it is also possible to either misconfigure it to use poor ciphers or too small a key etc. Sometimes, with applications like this, which may potentially need to encrypt large data sets frequently, options which increase encryption speed/efficiency are selected. In general, speed/efficiency and security are at opposite ends and if you don't get the balance right, you can compromise the security of the encrypted files. don't assume just because you are using gpg that your data is safe - it depends on what configuraiton options you are using.

Personally, I'd be more worried about the server compromise than the metadata such a compromise is able to reveal. Unless you are simply assessing the potential impact from a compromise, you need to consider what can be done to prevent the initial compromise first and then assess what measure would be approrpiate to mitigate the impact shold the compromise occur.

Having said all of this, I think it also needs to be highlighted that when it comes to physical security, more often than not, the real weakness is something far more simple. The effort and amount of information that can be gained indirectly via metadata usually takes considerable effort. You often require large amounts of input data to find useful patterns and it is generally a lot of work. This effort will only be worthwhile when the value of whatever is being protected is fairly high and even when it is, you will likely get a faster and less resource intensive result using simpler social engineering techniques or just finding overlooked physical security weaknesses.

  • In other words, it would probably be easier to watch the proper directly and figure out movements that way? Also, I'm assuming GPG is using strong keys (3072 bits or up), and the server is fast enough for this. – JvH Sep 18 '15 at 21:27
  • 1
    Yes, unless there are other barriers/controls which make simple observation difficult etc, then the effort to use metadata is probably higher than the reward (depending on what the reward is of course). – Tim X Sep 19 '15 at 0:33
  • WRT GPG, the defaults are pretty good. Problems can arise when people try to tweak things and don't fully understand the implications of what they are doing. Often the result of early optimization syndrome - someone expects there will be a performance problem, so they create keys with weaker, but faster ciphers in anticipation of an issue rather than using stronger ciphers and waiting until you verify there is an issue before making such decisions. In your case, even relatively weak encryption will likely be a sufficient deterrent – Tim X Sep 19 '15 at 0:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.