Cyber Security Demonstrations using Penetration Testing on Wi-Fi Cameras

Sammanfattning: Cyber security is a rapidly changing area that contributes to people increasingly being exposed to Internet of Things (IoT). The risks of using IoT do not get enough attention from the users, nor does the supplier of the devices take full responsibility for security. There is a lack of comprehensive standards for secure products and without proper security measures, organizations using IoT are at risk of greater damage. There is a need of educating a diverse range of individuals within the area of cyber security, to reduce the risks of being a future victim. This thesis aims to increase the awareness and knowledge regarding current cyber security threats, by developing educational demonstrations. Two Wi-Fi cameras were penetration tested from an isolated network, where successful experiments showed that it was possible to remotely access the video stream of one camera, and extract the entire content of the SD card, without any requirements of user credentials. It was also shown that motion detection and privacy mode were possible to remotely enable and disable. Successful experiments also showed that a DoS attack could be carried out, by remotely rebooting one of the cameras. Additionally, a qualitative study was conducted, resulting in valuable criteria that a cyber security demonstration should fulfill. The vulnerabilities in both cameras were utilized developing five Proof of Concept demonstrations, presenting attack scenarios of i.a. an attacker breaking in without detection, espionage and blackmail. These demonstrations could be used in education to increase awareness of cyber security.