6

Let's say Alice, Bob, and Mallory all live together in a house.
Mallory decides to go on vacation, but before leaving, she decides to play a game with Bob and Alice. She makes two claims:

  1. She has installed hidden cameras inside the house.
  2. She has remote access to the cameras.

Mallory challenges Bob and Alice to find the cameras and then leaves for vacation.

Bob and Alice conduct a casual visual search throughout the house, but do not find any cameras.

Based off the search, Bob assumes that Mallory is lying about the cameras. Alice is not convinced that Malory is lying, so Bob wants to prove it.

He decides to attempt debunking Mallory's second claim.

To the best of his knowledge, there is only one wireless router installed inside the house. Bob gets on his laptop and gets a command line running.

# iw dev wlan1 scan | grep -B 4 SSID

He runs this iw command several times and notices that only one SSID is found consistently. This is the SSID he knows his router uses.

He then tries to find the gateway address of the router.

$ netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.1.254   0.0.0.0         UG        0 0          0 wlan1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 wlan1
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan1

Bob's networking knowledge is limited and his knowledge on cameras is even more limited, but he assumes that in order to remotely access the cameras, Mallory would have to have opened ports for those cameras.

# nmap -v -A 192.168.1.254 | grep "open port"
Discovered open port 443/tcp on 192.168.1.254
Discovered open port 80/tcp on 192.168.1.254
Discovered open port 49152/tcp on 192.168.1.254

A quick google search shows that port 80 is for HTTP and port 443 is for HTTPS, but Bob is unsure what port 49152 is for. It seems nmap is also unsure what the port is used for:

49152/tcp open  unknown
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port49152-TCP:V=5.21%I=7%D=3/28%Time=53362E24%P=x86_64-unknown-linux-gnu%r(FourOhFourRequest,5,"\*\xced\0\x03")%r(GetRequest,5,"\*\xced\0\x03")%r(
SF:HTTPOptions,5,"\*\xced\0\x03")%r(RTSPRequest,5,"\*\xced\0\x03")%r(RPCCh
SF:eck,5,"\*\xced\0\x03")%r(DNSVersionBindReq,5,"\*\xced\0\x03")%r(DNSStat
SF:usRequest,5,"\*\xced\0\x03")%r(SSLSessionReq,5,"\*\xced\0\x03")%r(SMBPr
SF:ogNeg,5,"\*\xced\0\x03")%r(X11Probe,5,"\*\xced\0\x03")%r(LDAPBindReq,5,
SF:"\*\xced\0\x03")%r(SIPOptions,5,"\*\xced\0\x03")%r(LANDesk-RC,5,"\*\xce
SF:d\0\x03")%r(TerminalServer,5,"\*\xced\0\x03")%r(NCP,5,"\*\xced\0\x03")%
SF:r(NotesRPC,5,"\*\xced\0\x03")%r(WMSRequest,5,"\*\xced\0\x03")%r(oracle-
SF:tns,5,"\*\xced\0\x03");

Questsions

What can Bob do to verify whether or not this is the port Mallory is using to remotely access the cameras?

Bob is also worried that has not considered any wired internet connections. He is wondering if it's possible that Mallory hired a security company to install the cameras and that Mallory accesses the cameras remotely via the security company's website.

What else can Bob do to convince Alice that Mallory is lying about her second claim?

  • 5
    It's impossible to prove that something isn't there. You can only prove that there isn't any proof related to something... And given how difficult it is to know for certain that you've conducted the perfect scan, you can't be sure that the camera isn't just sneaky. – KnightOfNi Mar 29 '14 at 4:33
  • @KnightOfNi Proving a negative isn't necessary here, just have a high level of confidence that the negative is true would be good enough. – red_eight Mar 29 '14 at 12:49
  • 3
    What else can Bob do to convince Alice that Mallory is lying about her second claim? Disassemble the house, and categorize every piece. Use a spectrum analyzer to search for wifi transmissions, and then trace every Ethernet cable as well. Use Wireshark to watch the contents of all connections, and verify that there is never an unaccounted for data transfer. Beat Mallory with a $5 wrench. NOTE: Wireshark, just like everything suggested in the original post, is 100% worthless if a camera is connected to some other network. – Anti-weakpasswords Mar 29 '14 at 19:06
  • 1
    @Anti-weakpasswords Is the $5 wrench thing from XKCD? Or am I just imagining that? – KnightOfNi Mar 30 '14 at 1:11
  • 1
    XKCD 538 - alternately, use the command line XKCD and "display 538" – Anti-weakpasswords Mar 30 '14 at 2:41
12

For finding a wireless camera, people have long used "bug detectors" to hunt for unwanted RF transmitters and other electronic devices that unintentionally emit RF. There is no reason they wouldn't find an actively broadcasting Wi-Fi device.

For a wired device, use a tone generator and detector (often called a fox and hound.) Clip the fox to the first wire plugged into a switch, and start tracing it with the hound. Once you've found its terminus, move to the next wire.

A physical problem requires a physical solution.

4

Interesting question. Theoretically a sophisticated attacker could place hidden cameras that can't be detected, but theoretically a competent defender has logs about everything to catch attackers trying to deploy any unwanted stuff.
So in this case this boils down to how sophisticated an attacker Mallory is (as it's proven that Bob isn't a competent defender).

Threat Analysis:

Bob should start by conducting a simple background check against Mallory.
Main questions that should be answered: Does she have technical background? (More specifically: Does she have the necessary knowledge to set up something like this?)
Does she have the necessary resources? (Hiring someone else to set something like this up isn't cheap. At all.)
What difficulties might have been encountered by Mallory while setting this up? (Answers to this question could also be used to look for proof about the cameras existence.)
Did she have the opportunity to set this up? (And are there "logs" {security camera tapes, bills, etc.} from this time that could indicate the "attack"?)
Anything else based on data already know about Mallory, and might be applicable here.
Answers to these questions might indicate if the claim is true or not, and they could also give hints about the cameras whereabouts.

Some things I'd check:

Electricity:

Cameras (and the equipment to control them) need electricity. This can be supplied by batteries for a short time, but for extended operation they need to access the grid somehow. I'd check how the electricity consumption per day of the house changes now that Mallory isn't there and compare it to other days when she was there (and when she wasn't but hadn't probably deployed the cameras yet) and look for discrepancies.
(Also checking for additional power cables that weren't there before might be a good idea.)

Command:

She is supposedly having remote access to the cameras. This can take two forms (when observed by Bob), inbound and outbound communications.
Assuming that the house has only a single connection that is capable of accessing public networks (as most homes do), it shouldn't be too hard to monitor it. A good check could be to disconnect everything that belongs to Alice and Bob from the network and check if there's any suspicious communication going on.
(Though the cameras might use other means to access the public net.)

External help:

Getting external help isn't cheap so unless someone owns Mallory a big favor she would have had to spend quite a lot to get someone to help her. (Getting access to her financial data might conclusively disprove outside help.)



These checks can't conclusively disprove the cameras existence but might catch them if they do exist.

  • 4
    The power draw of a small camera is going to be next to impossible to distinguish compared to the power draw noise of an average house. – Anti-weakpasswords Mar 30 '14 at 4:02
  • 1
    @Anti-weakpasswords you can audit all the electricity consumption in any case; simply disconnect all 'whitelisted' devices and trace any remaining currents. Connecting the wiring to 1000V for a moment is also a valid option once all the 'good' devices and incoming power are disconnected. – Peteris May 19 '14 at 13:14
  • 1
    @Peteris Yeah, sure. You will fry all kinds of stuff you never suspected was there and possibly start a fire. – Nobody Sep 3 '18 at 7:05
3
  1. Bob could sniff the traffic.
  2. Bob could search the house again.
  3. Bob could use lsof -i:49152 to check what program is running on this port if he can access the PC.
  4. Bob could ask Mallory if she's kidding because this is annoying
1

You are assuming that the cameras will be connected not only over LAN, but to a network you have access to. Chances are, any half-decent hidden cameras will not just hide themselves visually, but hide their presence on any networks you have access to. However, even taking an SDR and sniffing for any inexplicable radio signals is not going to cut it. A number of hidden cameras will store video information and transmit it in short bursts sent at irregular intervals, often not using something standard like WiFi but something else that provides LPI/LPD (Low Probability of Interception/Detection), like a transmission employing DSSS or FHSS. These are spread spectrum transmission techniques which spread a signal out through a large frequency domain, making it exceedingly difficult, if not impossible, to tell that it even exists.

It may be possible to detect electromagnetic emanations released by the camera's microprocessor and other high-frequency electronics, but even then, a well-designed hidden camera will be shielded from emitting potentially identifiable electromagnetic radiation. Overall, the only truly effective way to find hidden cameras is to tear the whole place down and make sure every single finding is explained and all objects are accounted for, which is certainly not easy.

0

Bob wasnt always the most ethical roomate, with that said, he offered Mallory one of his laptops to use on her little vacation, right before she left. As an anti-theft feature Bobs laptop has a stealthy VNC type server that runs before boot(intel based on-chip kvm i believe)...He was going to tell Mallory all about it, but he forgot, and she didnt ask;) Bob starts a 'listening vnc viewer' on his laptop configured to record the VNC-viewer window when its not idle, so Bob could show alice everything Mallory had done online. Mallory had problems connecting to wifi on he phone while on vacation, little did she know is that Bob set the laptop up to spoof the MAC of her cellphone, so the routers would get confused and not let her cellular phone connect, and when it did connect Bob would use aireplay-ng to boot her off, so she always had to use the laptop...Bob also showed alice that he replaced their router after Mallory left with one he borrowed, so mallory couldnt possibly be using any port forwarding of any kind. Bob wins, but feels like a scumbag for it...

  • Bob has Mallory surveilled for her entire vacation to make sure she does not use any rental computers. – daniel Mar 22 '17 at 8:07
0

There is a second part to this that we have not considered - and techinical savy aside - lets assume Mallory did install a small unnoticeable camera in say the buildings aircon vent, connected to a wireless wi-fi router set up not to show its connection name, both units powered by a bank of car batteries in the roof cavity [all missed during the exhuastive search by Bob and Alice]... What we now have to ask ourselves is should Bob and Alice 1) prank Mallory and put on some charades to confuse her. 2) dont give a damn because they aren't doing anything unethical, immoral or illegal and live life as normal. 3) go away until Mallory comes back. 4) break the lease put all Mallory's stuff in boxes and hide it in the same roof cavity she must be hiding said equipement - then lease elsewhere and not include her as shes a cow anyway and always pulls the same typical time wasting pranks.

Just a thought - its been over a year since the last answer so thought I'd chime in with a non technical solution.. :)

-2

Bob should wait until he is the only person in the house, and then do something completely outrageous that Mallory would react to (run through the house in a chicken suit, burn all of Mallory's belongings). Then if Mallory talks about Bobs strange behavior he can know there was a camera. If Mallory reacts to his craziness before he returns then she must have had a remote source for her knowledge, if she only reacts after she returns then she may have lacked remote access or she could have been playing possum on this information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.