{"id":19566,"date":"2022-07-11T08:30:22","date_gmt":"2022-07-11T16:30:22","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/07\/11\/news-13299\/"},"modified":"2022-07-11T08:30:22","modified_gmt":"2022-07-11T16:30:22","slug":"news-13299","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/07\/11\/news-13299\/","title":{"rendered":"How else to detect hidden cameras and microphones | Kaspersky official blog"},"content":{"rendered":"<p><strong>Credit to Author: Enoch Root| Date: Mon, 11 Jul 2022 16:17:30 +0000<\/strong><\/p>\n<p>In 2019, when a <a href=\"https:\/\/www.inman.com\/2019\/06\/07\/more-than-1-in-10-airbnb-guest-have-found-cameras-in-rentals-survey\/\" target=\"_blank\" rel=\"nofollow noopener\">survey<\/a> was carried out among travelers who make use of short-term rentals, 11% of participants said they&#8217;d found surveillance cameras in their rented accommodation. Moreover, about two-thirds of those surveyed worry that unscrupulous apartment owners may use hidden cameras.<\/p>\n<p>Just recently, we wrote about how Apple AirTags can be used to <a href=\"https:\/\/www.kaspersky.com\/blog\/how-to-protect-from-stalking-with-airtag\/43705\/\" target=\"_blank\" rel=\"noopener\">stalk people and steal cars<\/a>. The problem of covert filming in rental accommodation is similar in nature\u00a0\u2014 the deployment of seemingly useful devices for nefarious purposes.<\/p>\n<p>The issue of covert surveillance isn&#8217;t likely to go away soon; rather \u2014 just the opposite. First, a simple wireless video camera that transmits real-time data over Wi-Fi can be purchased for peanuts. Second, modern technology has advanced to the level where even cheap spy devices have become quite miniature and easy to hide amid an interior.<\/p>\n<p>There are several ways to find hidden cameras; the easiest of which is to scan a room in the dark with a phone camera to identify video cameras with an infrared light source (go <a href=\"https:\/\/www.kaspersky.com\/blog\/how-to-find-spy-cameras\/43199\/\" target=\"_blank\" rel=\"noopener\">here<\/a> to read about this and other detection methods). However, the effectiveness of these methods leaves much to be desired, and the demand for more reliable ways to detect spy devices increases as they proliferate.<\/p>\n<p>Therefore, attempts are constantly being made to create more hi-tech <em>anti<\/em>-spy technologies. The most advanced system was <a href=\"https:\/\/www.usenix.org\/system\/files\/sec22summer_sharma-rahul.pdf\" target=\"_blank\" rel=\"nofollow noopener\">recently proposed<\/a> by researchers at Carnegie Mellon University in the U.S. They found a way that potentially allows anyone to detect hidden IoT devices in a rented room using a smartphone app.<\/p>\n<h2>App-based spy detection<\/h2>\n<p>The authors of the paper decided to implement the following scenario. The &#8220;test guests&#8221; are given the keys to a rented apartment. After checking in, they open the special Lumos app on their smartphone and wait for about half an hour.<\/p>\n<p>Then they walk around the perimeter of each room holding the phone, which determines the coordinates of detected transmitters. After that, the app not only shows a list of detected &#8220;smart&#8221; devices, but also indicates their location. IoT devices are displayed in augmented reality (AR): information about the location of smart devices is superimposed on the image from the phone&#8217;s camera. The researchers made a demo video of the app:<\/p>\n<p><span class='embed-youtube' style='text-align:center; display: block;'><iframe class='youtube-player' type='text\/html' width='100%' height='420' src='https:\/\/www.youtube.com\/embed\/QwMXiyn-e28?version=3&#038;rel=1&#038;fs=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;wmode=transparent' frameborder='0' allowfullscreen='true' style=\"\"><\/iframe><\/span> <\/p>\n<p>Looks neat, but how does it work? The researchers assume that a typical landlord who rents out an apartment through Airbnb or a similar service will not spend time installing really sophisticated spy devices\u00a0\u2014 this is both costly and, in most cases, redundant. Instead, they&#8217;re more likely to buy something cheap and simple from the local store.<\/p>\n<p>It&#8217;s not hard to make a rough list of devices that could potentially be a privacy threat. The most obvious of them is a video camera that transmits image and sound over Wi-Fi. It might also be a smart speaker configured to constantly eavesdrop on conversations, a smart TV, or even a specialized security system \u2014 but home-grade, like Amazon Ring.<\/p>\n<p>Because all Wi-Fi-connected devices operate in a common frequency band they must coordinate data transmission with each other. Based on such open information, Lumos can find nearby wireless devices, identify their type (telling a webcam from a smart light bulb, for example), and even give an approximate location with an accuracy of 1.5 meters.<\/p>\n<div id=\"attachment_44835\" style=\"width: 1510px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2022\/07\/11121110\/how-to-find-spy-cameras-and-other-iot-devices-1.jpg\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-44835\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2022\/07\/11121110\/how-to-find-spy-cameras-and-other-iot-devices-1.jpg\" alt=\"Lumos adds an AR visual aid to the smartphone's camera image to indicate the presence of a wireless camera nearby\" width=\"1500\" height=\"832\" class=\"size-full wp-image-44835\" \/><\/a><\/p>\n<p id=\"caption-attachment-44835\" class=\"wp-caption-text\">The spy device detection system adds an AR visual aid to the smartphone&#8217;s camera image to indicate the presence of a wireless camera nearby. <a href=\"https:\/\/www.youtube.com\/watch?v=QwMXiyn-e28\">Source<\/a><\/p>\n<\/div>\n<h2>Lumos in detail<\/h2>\n<p>Some of you are probably already thinking: &#8220;Enough chit-chat, where can I download the thing?!&#8221; Unfortunately, you can&#8217;t for now. What&#8217;s more, in the prototypes it proved impossible to implement all the functionality using smartphones alone. That&#8217;s because Lumos has slightly higher requirements than typical smartphone Wi-Fi capabilities: it&#8217;s not enough for the system to simply connect to an access point and communicate only through that. Instead, Lumos has to scan all data packets transmitted over the air from all devices nearby. But the ability to sniff the airwaves is blocked in all smartphones.<\/p>\n<p>Theoretically, it can be done on a rooted Android device (that is, one on which the owner has superuser rights that give full access to the system), but the researchers went in a different direction. They built two test systems, the first consisting of a smartphone with a Raspberry Pi microcomputer connected to it, and the second being a laptop with a special camera.<\/p>\n<p>In the first case, the Raspberry Pi listened to the Wi-Fi transmission; in the second, the laptop did (such functionality is easier to implement on a full-fledged computer than on a smartphone). Accordingly, either the smartphone camera or the AR camera connected to the laptop was used for visual detection of hidden devices.<\/p>\n<div id=\"attachment_44836\" style=\"width: 1470px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2022\/07\/11121128\/how-to-find-spy-cameras-and-other-iot-devices-2.jpg\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-44836\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2022\/07\/11121128\/how-to-find-spy-cameras-and-other-iot-devices-2.jpg\" alt=\"How to find hidden Wi-Fi devices in an untrusted environment using your phone\" width=\"1460\" height=\"860\" class=\"size-full wp-image-44836\" \/><\/a><\/p>\n<p id=\"caption-attachment-44836\" class=\"wp-caption-text\">How to find hidden Wi-Fi devices in an untrusted environment using your phone] <a href=\"https:\/\/www.usenix.org\/system\/files\/sec22summer_sharma-rahul.pdf\">Source<\/a><\/p>\n<\/div>\n<p>Next, the researchers applied the technology that determines the type of device by its behavior. A simple example: a smart light switch might access the server once a minute and not show itself in any other way, while a webcam transmits streams of data and does so continuously. Using more than 50 such features and machine learning, the authors of the paper created &#8220;digital fingerprints&#8221; of typical IoT devices.<\/p>\n<p>As a result, there&#8217;s no need to maintain and constantly update a database of suspicious devices in the app\u00a0\u2014 Lumos will likely spot a Wi-Fi camera in your room <em>by its characteristic behavior when transferring data<\/em>, even if it has not seen the particular model before.<\/p>\n<div id=\"attachment_44837\" style=\"width: 2564px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2022\/07\/11121138\/how-to-find-spy-cameras-and-other-iot-devices-3.jpg\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-44837\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2022\/07\/11121138\/how-to-find-spy-cameras-and-other-iot-devices-3.jpg\" alt=\"Lumos detects a smart speaker\" width=\"2554\" height=\"1533\" class=\"size-full wp-image-44837\" \/><\/a><\/p>\n<p id=\"caption-attachment-44837\" class=\"wp-caption-text\">Another example from the Lumos demo video: finding a smart speaker. <a href=\"https:\/\/www.youtube.com\/watch?v=QwMXiyn-e28\">Source<\/a><\/p>\n<\/div>\n<h2>Searching for IoT devices in augmented reality<\/h2>\n<p>The most eye-catching part of the study is the information superimposed over the image from the smartphone camera. Lumos uses AR technology to embed virtual objects in the image of the real environment sent to the phone&#8217;s display from the camera.<\/p>\n<p>The approximate coordinates of located devices were overlaid on the image from the phone&#8217;s camera on an Apple smartphone using the standard ARKit library. This library uses various sensors of the phone to create a 3D model of the room. Along the way, the location of hidden connected devices is also determined.<\/p>\n<p>For this, the researchers used another feature of the Wi-Fi module: the continuous measuring of signal strength from both the nearest access point and other wireless modules. Hence, by walking around the premises, measuring the signal level at different points, and performing some not overly complicated calculations, the app can determine the position of hidden devices in the room.<\/p>\n<div id=\"attachment_44838\" style=\"width: 1470px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2022\/07\/11121158\/how-to-find-spy-cameras-and-other-iot-devices-4.jpg\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-44838\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2022\/07\/11121158\/how-to-find-spy-cameras-and-other-iot-devices-4.jpg\" alt=\"Wi-Fi device search map based on signal strength\" width=\"1460\" height=\"1100\" class=\"size-full wp-image-44838\" \/><\/a><\/p>\n<p id=\"caption-attachment-44838\" class=\"wp-caption-text\">Indoor Wi-Fi device search map based on signal strength. <a href=\"https:\/\/www.usenix.org\/system\/files\/sec22summer_sharma-rahul.pdf\">Source<\/a><\/p>\n<\/div>\n<h2>Implementation difficulties<\/h2>\n<p>We must stress again that this is scientific research \u2014 not the development of a commercial product; the authors are not trying to sell us anything. So it&#8217;s all the more interesting that they&#8217;ve put together a full-fledged spy-device detection system, rather than just show a part of it and leave the reader to fill in the blanks.<\/p>\n<p>And the results are quite encouraging:<\/p>\n<ul>\n<li>The accuracy of determining device type was 95\u201398%. The chance of error is small.<\/li>\n<li>The location of IoT devices is determined with an accuracy of 1.5 meters\u00a0\u2014 narrowing down the search area enough to find a hidden camera visually.<\/li>\n<li>The time it takes to discover nearby IoT devices is 30 minutes. For 27 of these minutes, the smartphone just lies there collecting data packets sent by surrounding devices. For the remaining three, the user has to walk around the room to determine the coordinates of the detected transmitters.<\/li>\n<\/ul>\n<p>This means that the system really may help uncover unpleasant surprises in rented accommodation or in a hotel. But there are limitations. We&#8217;ve already noted the inability of a regular smartphone to scan the entirety of Wi-Fi traffic. It&#8217;s unlikely that manufacturers will do anything about this any time soon.<\/p>\n<p>In addition, there are now lots of Wi-Fi devices in every home, and radio waves are quite good at passing through walls, especially if those aren&#8217;t made of reinforced concrete. This means you might accidentally find a camera installed in the neighbors&#8217; place, or even on the outer wall of the building\u00a0\u2014 and then falsely accuse the landlord of spying.<\/p>\n<p>And then, of course, attempts to detect a hidden camera are futile if the apartment owner\/cybercriminal uses a wired connection or records the footage in the old-fashioned way to a flash drive.<\/p>\n<p>All this means that we&#8217;re unlikely to see commercial implementation of Lumos in the foreseeable future. It&#8217;s too &#8220;hackerish&#8221; for that\u00a0\u2014 any commercial company that took on the development would face a mountain of issues and complaints, both from users (a camera was there, but wasn&#8217;t detected) and property owners (a camera wasn&#8217;t there, but the app said otherwise).<\/p>\n<p>If it does get developed, it&#8217;d most likely be a plaything for techies. It may even be necessary to buy a specially modified smartphone for it. However, should this less-than-ideal scenario arise, the system may well be free (not counting the price of this special smartphone), since the authors of the paper promise to make the prototype source code freely available.<\/p>\n<p> <input type=\"hidden\" class=\"category_for_banner\" value=\"ksc-trial-generic\" \/> <br \/><a href=\"https:\/\/www.kaspersky.com\/blog\/how-to-find-spy-cameras-and-other-iot-devices\/44833\/\" target=\"bwo\" >https:\/\/blog.kaspersky.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2022\/07\/11120950\/how-to-find-spy-cameras-and-other-iot-devices-featured.jpg\"\/><\/p>\n<p><strong>Credit to Author: Enoch Root| Date: Mon, 11 Jul 2022 16:17:30 +0000<\/strong><\/p>\n<p>A new method for detecting hidden cameras, microphones and other IoT spy devices that seems to actually work.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10425,10378],"tags":[24572,5897,714,24573,1331,4940,24574],"class_list":["post-19566","post","type-post","status-publish","format-standard","hentry","category-kaspersky","category-security","tag-hidden-cameras","tag-privacy","tag-security","tag-spy-cameras","tag-technology","tag-travel","tag-video-surveillance"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/19566","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=19566"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/19566\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=19566"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=19566"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=19566"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}