Discussions in our industry about cyber-threats to physical security systems, including IP video, often center around hypotheticals. How might a hacker gain access to a video camera feed? How might he or she enter the larger enterprise system through a software vulnerability related to physical security? We all know assessing threats often involves considering the hypothetical, of course, but we should also seek to learn from actual events in the past.

In relation to vulnerabilities of video surveillance systems to cyberattack, a historic event from seven years ago provides plenty of food for thought. It was in the news at the time, but the role of cybersecurity wasn’t known then, and, in our market, it has not been widely reported. The event isn’t a usually cited example of the dangers of insufficient cybersecurity in physical security systems; however, it should be. Even seven years later, the lessons of the Turkish pipeline explosion in 2008 couldn’t be timelier.

The Turkish government reported it as a mechanical failure. However, in 2014, Bloomberg reported that hackers had shut down alarms, cut off communications and super-pressurized the crude oil in the line

Cyberattack Incident

The Baku-Tbilisi-Ceyhan (BTC) pipeline runs 1,099 miles from the Caspian Sea to the Mediterranean, following a route through the former Soviet Union. On 7 August 2008, there was an explosion on the pipeline near Refahiye, Erzincan, a town in eastern Turkey. Cyber-attackers entered the operational controls of the pipeline to increase oil pressure without setting off alarms. The high pressure may have caused the explosion; no physical bomb was ever found.

The explosion caused more than 30,000 barrels of oil to spill and cost millions of dollars a day in transit tariffs during the two and a half weeks the pipeline was down. The Turkish government reported it as a mechanical failure. However, in 2014, Bloomberg reported that hackers had shut down alarms, cut off communications and super-pressurized the crude oil in the line. Some believe the Russian government was behind the explosion.

The hackers took down the system of sensors and video cameras that monitored the pipeline in the area, so there was no signal of the explosion. News of the event first came 40 minutes later from a security worker who saw the flames. There was 60 hours of video footage erased by the hackers. In fact, the only existing footage related to the event was provided by a single (offline) thermal camera that showed two men with laptop computers walking near the pipeline days before the explosion.

Consequences Of Ignoring Physical Security System Vulnerabilities

Previously, basking in the productive and beneficial glow of networked systems, we have denied cyber-vulnerabilities; we have ignored the “elephant in the room”

There is a specific reason that this incident should be of great interest to the security marketplace: Because hackers entered the computer system through a software vulnerability that was part of the video surveillance system. Hackers gained entry using vulnerability of the cameras’ communication software and then moved deep into the internal network.

Far from theoretical, in this instance, the cyber-vulnerability of a physical security system provided a means to deploy a massively destructive attack – a cyberattack with physical consequences. The cameras supposedly watching the site were not only useless (after the hacker erased their video feeds), but that very camera system provided entry for the attackers into the systems.

In addressing the cybersecurity vulnerabilities of IP systems, you could say our industry is late to the party. As the Turkish pipeline explosion suggests, we are at least seven years late.

Now, we are playing catch-up with the recent spate of cybersecurity programming at industry shows, and manufacturers are now addressing cybersecurity vulnerabilities in their systems. Previously, basking in the productive and beneficial glow of networked systems, we have denied cyber-vulnerabilities; we have ignored the “elephant in the room.”

More to the point, we have ignored a large open door inviting the bad guys in.

Share with LinkedIn Share with Twitter Share with Facebook Share with Facebook
Download PDF version

Author profile

Larry Anderson Editor, SecurityInformed.com & SourceSecurity.com

An experienced journalist and long-time presence in the US security industry, Larry is SecurityInformed.com's eyes and ears in the fast-changing security marketplace, attending industry and corporate events, interviewing security leaders and contributing original editorial content to the site. He leads SecurityInformed's team of dedicated editorial and content professionals, guiding the "editorial roadmap" to ensure the site provides the most relevant content for security professionals.

In case you missed it

Motorola Solutions Acquires Pelco For $110 Million
Motorola Solutions Acquires Pelco For $110 Million

Motorola Solutions, Inc. today announced it has completed the acquisition of Pelco, Inc., a global provider of video security solutions based in Fresno, California. Pelco designs, develops and distributes end-to-end video technology, including video security cameras and video management system software. The company’s scalable solutions and commitment to service delivery enables customers of all sizes to mitigate risk, increase operational efficiencies and enhance safety.  “Video continues to play a more powerful role in enabling safer cities and securing businesses around the world,” said Greg Brown, chairman and CEO, Motorola Solutions. “Pelco’s track record of innovation, internationally recognized brand, global channel and customer installed base enable us to further expand our global footprint with enterprise and public safety customers.”

What are the Security Challenges of Protecting the Cannabis Industry?
What are the Security Challenges of Protecting the Cannabis Industry?

The advent of a truly new market for the physical security industry is a rare occurrence. Particularly rare is a new market that is both fast-growing and provides an environment that is not just conducive to application of physical security technologies but that actually demands it. Such is the case with the market for legalized marijuana. We asked this week’s Expert Panel Roundtable: What are the security challenges of protecting the cannabis industry?

Wireless Technology Is Transforming Motion Detection
Wireless Technology Is Transforming Motion Detection

Motion detection is a key feature of security systems in residential and commercial environments. Until recently, systems have relied heavily on closed circuit television (CCTV) and passive infrared (PIR) sensors, which both require significant investment and infrastructure to install and monitor. Developments in wireless technology are increasing home security possibilities. Few years ago, these developments led Cognitive Systems to discover that the wireless signals surrounding oneself can be used to detect motion. Known in the wireless industry as WiFi sensing, this technology brings many benefits that other motion detection solutions have not been able to provide. The working of WiFi sensing At Cognitive Systems, the company has used WiFi sensing technology to develop a motion detection solution called WiFi Motion™, which measures and interprets disruptions in RF signals transmitted between WiFi devices. When movement occurs in a space, ripples in the wireless signals are created. WiFi Motion interprets these ripples and determines if an action, such as sending a notification, is needed. Enabling this functionality in a space is incredibly simple. With a software upgrade to only one’s WiFi access point (or mesh router), motion sensing capabilities are layered into one’s WiFi network. Existing connected WiFi devices then become motion detectors without detracting from their original functions or slowing down the network. Using artificial intelligence (AI), WiFi Motion establishes a benchmark of the motionless environment and learns movement patterns over time, which could be used to predict trends. This allows unusual movement patterns to be detected with greater accuracy while decreasing the potential for costly false alerts. WiFi Motion requires no line-of-sight or installation WiFi sensing and other home monitoring solutions All of these capabilities are made possible by WiFi sensing and together create a motion detection system that provides unparalleled accuracy, coverage, privacy and affordability compared to other solutions on the market. PIR integration is far more complex and imposes electronic and physical design restrictions compared to WiFi sensing. In terms of placement, PIR systems are difficult to install, requiring line-of-sight and a device in every room for localization. WiFi Motion requires no line-of-sight or installation and is also a scalable solution compared to PIR. Much like cameras, PIRs can only cover so much space, but WiFi Motion can cover the entire home and even detect motion in the dark and through walls, without adding additional devices to the home. WiFi Motion detects less distinguishing context than cameras and microphones, but more context than regular PIR sensors for the perfect balance of privacy and highly accurate motion detection. Privacy solution While cameras have been the security solution for years, WiFi Motion offers a more affordable solution that can rival the privacy and coverage capabilities of even the most high-end cameras. With such a wide coverage area, one might think that WiFi sensing infringes on privacy, but actually, the opposite is true. With WiFi Motion, the contextual information collected cannot be used to identify a specific individual, unlike cameras which can clearly identify a person’s face or microphones, which can identify a person’s voice. It is different from other smart home security options that use cameras and microphones because it only senses motion using WiFi signals - it doesn’t “see” or “listen” like a camera or microphone would. This provides opportunities for added security in spaces where privacy might be a concern and installing a camera may not be a comfortable solution, such as bathrooms and bedrooms. The data collected is also anonymized and highly encrypted according to stringent industry privacy standards. Existing connected WiFi devices then become motion detectors Additional WiFi sensing applications Since WiFi sensing technology requires no additional hardware or subscription fees, it is much more affordable than other motion detection solutions. It can be used as a standalone solution, or it can be easily layered into more complex systems. This ease of integration, scalability and relatively low cost brings a lot of potential for various applications. Motion detection can trigger other smart devices in the network to turn lights on or off In eldercare, for example, WiFi sensing can be used to help seniors live comfortably in their homes for as long as possible. With the increasing aging population and high costs associated with care homes, the market for this application is considerable. Caregivers can use an app to monitor movement in their loved one’s home and be alerted about unusual movement patterns that could indicate a concern. For smart homes and other environments that have a network of smart devices, the artificial intelligence (AI) component of the technology allows for improvements to automated features. Motion detection can trigger other smart devices in the network to turn lights on or off or make adjustments to the temperature in a room. Security for the commercial sector For office buildings and other commercial properties, it is easy to see how all of these features could be scaled up to offer a highly accurate and cost-effective motion sensing and smart device automation solution. Cognitive Systems is closely involved with the development of WiFi sensing technology, working with various industry groups to establish standards and help it reach its full potential. WiFi Motion is merely the tip of the iceberg in terms of motion sensing possibilities, but its applications in the world of security are undeniably compelling. It is an exciting time for the wireless industry, as one works with stakeholders in the security space to explore everything this technology can do.