Wi-Fi enabled digital cameras

Question

A department in my company has decided that they want to use Wi-Fi enabled cameras because of how many pictures that they take. To be clear, these are not security cameras. Their current procedure is to take the cameras and plug them in via USB cable into their desktop to download images.

The department feels that the current process is too cumbersome because they can’t use the camera while it is downloading. In my opinion, I think a better option is to get SD card readers for their desktop and just swap out the SD cards (or whatever removable media they use) to download the pictures.

What I want to know is what are the disadvantages or security concerns of using a Wi-Fi enabled camera?

Answer 1

Your suggestion sounds like the prudent one. But here are some bullet points for the conversation.

Bullet points of the CONs of using wifi cameras:

• Confidentiality - even if the cameras use 802.11i or other appropriate encryption, the images can be captured by an attacker who monitors the wireless transmissions and cracks the encryption.
• Integrity - Depending on how the camera manages the image after transmission (does it save local and require the user to delete it? Does the camera delete it after transmission?) there is a possibility the image may get corrupted in transit, as it could with ANY transfer. In this scenario, if the image has already been deleted from the camera then you have lost the data. It's an unlikely scenario with several specific conditions, but it IS one of the points of the InfoSec triad (Confidentiality, Availability, Integrity)
• Cost - I am pretty certain the cost of WiFi enabled cameras is much higher than media-readers (USB SD readers are probably < $10 Amazon.) Extra SD cards are cheap too, if you don't get ridiculously large ones.

Some PROs for going with WiFi cameras:

• Convenience - even with SD media readers, the users have to go back to the workstation and swap out media. If the business campus is very large, this could be an inconvenience or a real waste of time.
• "Gadget Fun" - Oooh, shiny! New! Gimme fun toys! =) Everyone likes getting new toys/gadgets/tools to play with, right?

Answer 2

What I want to know is what are the disadvantages or security concerns of using a Wi-Fi enabled camera?

The Wi-Fi-enabled cameras I've used (from Olympus) require explicitly turning on the Wi-Fi; when you do, it takes over the entire display and makes it difficult to do much of anything directly with the camera until you turn it off. It's very obviously designed as something you only turn on temporarily (it drains the battery quite a bit), and as a side effect any security concerns are quite limited. I consider the security impact negligible on my personal camera.

You should of course see how the process works on the cameras your company is considering purchasing.

SD card readers will be much faster and simpler to use. The primary reason for Wi-Fi on the camera is to do things like post photos to social media via your phone or use a smartphone as a remote shutter.

Answer 3

Given "how many pictures they take," I would be concerned that the rate at which they take pictures would exceed the speed at which camera can upload them. RAWs and higher-quality JPGs are huge. Wifi will certainly not be faster than USB.

And in every camera I've owned that supported it, it's not like you can just dump your photos to a Windows/CIFS share or FTP site. You have to use some proprietary software on a desktop or tablet somewhere to collect it. Historically camera manufacturers have never been good software engineers. I wouldn't trust that my pictures made it over the air until I verified it myself.

Camera wifi also severely impedes battery life. This may result in their making more trips back to their desk as a result, not less.

Answer 4

Regardless of the model, a mainstream camera's WiFi stack, like much mainstream proprietary firmware, is likely to be under-scrutinised, potentially obsolete, and vulnerable to exploitation.

In principle, if an attacker were able to wirelessly exploit a camera (e.g. while the camera is being used on location), the attacker could install malware onto the camera. Such malware could, again in principle, be used to attempt to pivot to other devices on the WLAN; to make the camera participate in a botnet while online; to leak the photos to a remote client on the Internet; to turn the camera into a room bug; etc.

Of course, this is also true for most smartphones (which are indeed also WiFi-enabled cameras). That still doesn't mean it's a great idea from a security perspective.