Finding hidden cameras

Question

Let's say Alice, Bob, and Mallory all live together in a house.
Mallory decides to go on vacation, but before leaving, she decides to play a game with Bob and Alice. She makes two claims:

1. She has installed hidden cameras inside the house.
2. She has remote access to the cameras.

Mallory challenges Bob and Alice to find the cameras and then leaves for vacation.

Bob and Alice conduct a casual visual search throughout the house, but do not find any cameras.

Based off the search, Bob assumes that Mallory is lying about the cameras. Alice is not convinced that Malory is lying, so Bob wants to prove it.

He decides to attempt debunking Mallory's second claim.

To the best of his knowledge, there is only one wireless router installed inside the house. Bob gets on his laptop and gets a command line running.

# iw dev wlan1 scan | grep -B 4 SSID

He runs this iw command several times and notices that only one SSID is found consistently. This is the SSID he knows his router uses.

He then tries to find the gateway address of the router.

$ netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.1.254   0.0.0.0         UG        0 0          0 wlan1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 wlan1
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan1

Bob's networking knowledge is limited and his knowledge on cameras is even more limited, but he assumes that in order to remotely access the cameras, Mallory would have to have opened ports for those cameras.

# nmap -v -A 192.168.1.254 | grep "open port"
Discovered open port 443/tcp on 192.168.1.254
Discovered open port 80/tcp on 192.168.1.254
Discovered open port 49152/tcp on 192.168.1.254

A quick google search shows that port 80 is for HTTP and port 443 is for HTTPS, but Bob is unsure what port 49152 is for. It seems nmap is also unsure what the port is used for:

49152/tcp open  unknown
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port49152-TCP:V=5.21%I=7%D=3/28%Time=53362E24%P=x86_64-unknown-linux-gnu%r(FourOhFourRequest,5,"\*\xced\0\x03")%r(GetRequest,5,"\*\xced\0\x03")%r(
SF:HTTPOptions,5,"\*\xced\0\x03")%r(RTSPRequest,5,"\*\xced\0\x03")%r(RPCCh
SF:eck,5,"\*\xced\0\x03")%r(DNSVersionBindReq,5,"\*\xced\0\x03")%r(DNSStat
SF:usRequest,5,"\*\xced\0\x03")%r(SSLSessionReq,5,"\*\xced\0\x03")%r(SMBPr
SF:ogNeg,5,"\*\xced\0\x03")%r(X11Probe,5,"\*\xced\0\x03")%r(LDAPBindReq,5,
SF:"\*\xced\0\x03")%r(SIPOptions,5,"\*\xced\0\x03")%r(LANDesk-RC,5,"\*\xce
SF:d\0\x03")%r(TerminalServer,5,"\*\xced\0\x03")%r(NCP,5,"\*\xced\0\x03")%
SF:r(NotesRPC,5,"\*\xced\0\x03")%r(WMSRequest,5,"\*\xced\0\x03")%r(oracle-
SF:tns,5,"\*\xced\0\x03");

Questions

What can Bob do to verify whether or not this is the port Mallory is using to remotely access the cameras?

Bob is also worried that he has not considered any wired internet connections. He is wondering if it's possible that Mallory hired a security company to install the cameras and that Mallory accesses the cameras remotely via the security company's website.

What else can Bob do to convince Alice that Mallory is lying about her second claim?

Answer 1

For finding a wireless camera, people have long used "bug detectors" to hunt for unwanted RF transmitters and other electronic devices that unintentionally emit RF. There is no reason they wouldn't find an actively broadcasting Wi-Fi device.

For a wired device, use a tone generator and detector (often called a fox and hound.) Clip the fox to the first wire plugged into a switch, and start tracing it with the hound. Once you've found its terminus, move to the next wire.

A physical problem requires a physical solution.

Answer 2

You are assuming that the cameras will be connected not only over LAN, but to a network you have access to. Chances are, any half-decent hidden cameras will not just hide themselves visually, but hide their presence on any networks you have access to. However, even taking an SDR and sniffing for any inexplicable radio signals is not going to cut it. A number of hidden cameras will store video information and transmit it in short bursts sent at irregular intervals, often not using something standard like Wi-Fi but something else that provides LPI/LPD (Low Probability of Interception/Detection), like a transmission employing DSSS or FHSS with OFDM and time-hopping. These are spread spectrum transmission techniques which spread a signal out through a large frequency domain, making it exceedingly difficult, if not impossible, to tell that it even exists.

It may be possible to detect electromagnetic emanations released by the camera's microprocessor and other high-frequency electronics, but even then, a well-designed hidden camera will be shielded from emitting potentially identifiable electromagnetic radiation. Overall, the only truly effective way to find hidden cameras is to tear the whole place down and make sure every single finding is explained and all objects are accounted for, which is certainly not easy.

Answer 3

Interesting question. Theoretically a sophisticated attacker could place hidden cameras that can't be detected, but theoretically a competent defender has logs about everything to catch attackers trying to deploy any unwanted stuff.
So in this case this boils down to how sophisticated an attacker Mallory is (as it's proven that Bob isn't a competent defender).

Threat Analysis:

Bob should start by conducting a simple background check against Mallory.
Main questions that should be answered: Does she have technical background? (More specifically: Does she have the necessary knowledge to set up something like this?)
Does she have the necessary resources? (Hiring someone else to set something like this up isn't cheap. At all.)
What difficulties might have been encountered by Mallory while setting this up? (Answers to this question could also be used to look for proof about the cameras existence.)
Did she have the opportunity to set this up? (And are there "logs" {security camera tapes, bills, etc.} from this time that could indicate the "attack"?)
Anything else based on data already know about Mallory, and might be applicable here.
Answers to these questions might indicate if the claim is true or not, and they could also give hints about the cameras whereabouts.

Some things I'd check:

Electricity:

Cameras (and the equipment to control them) need electricity. This can be supplied by batteries for a short time, but for extended operation they need to access the grid somehow. I'd check how the electricity consumption per day of the house changes now that Mallory isn't there and compare it to other days when she was there (and when she wasn't but hadn't probably deployed the cameras yet) and look for discrepancies.
(Also checking for additional power cables that weren't there before might be a good idea.)

Command:

She is supposedly having remote access to the cameras. This can take two forms (when observed by Bob), inbound and outbound communications.
Assuming that the house has only a single connection that is capable of accessing public networks (as most homes do), it shouldn't be too hard to monitor it. A good check could be to disconnect everything that belongs to Alice and Bob from the network and check if there's any suspicious communication going on.
(Though the cameras might use other means to access the public net.)

External help:

Getting external help isn't cheap so unless someone owns Mallory a big favor she would have had to spend quite a lot to get someone to help her. (Getting access to her financial data might conclusively disprove outside help.)

---

These checks can't conclusively disprove the cameras existence but might catch them if they do exist.

Answer 4

1. Bob could sniff the traffic.
2. Bob could search the house again.
3. Bob could use lsof -i:49152 to check what program is running on this port if he can access the PC.
4. Bob could ask Mallory if she's kidding because this is annoying

Answer 5

Bob should wait until he is the only person in the house, and then do something completely outrageous that Mallory would react to (run through the house in a chicken suit, burn all of Mallory's belongings). Then if Mallory talks about Bobs strange behavior he can know there was a camera. If Mallory reacts to his craziness before he returns then she must have had a remote source for her knowledge, if she only reacts after she returns then she may have lacked remote access or she could have been playing possum on this information.