Breach of security start-up Verkada reportedly exposes 150,000 cameras

Industry experts said the breach could have been prevented if the vendor’s details were not exposed on the internet

The hackers claimed to have access live feeds from 222 cameras installed in Tesla’s factories and warehouses in the US and China. Getty

A group of hackers reportedly breached more than 150,000 security cameras of California-based start-up Verkada, exposing the live feed of companies including electric vehicle maker Tesla and software provider Cloudflare, according to Bloomberg.

The hack was carried out to reveal the vulnerabilities that exist in video surveillance devices, Swiss engineer and security researcher Tillie Kottmann, one of the hackers who took responsibility for the breach, said.

The hacktivist group said it managed to find a user name and password for an administrator account on the internet, which allowed them unlawful access to Verkada’s camera footages.

The hackers claimed to have accessed feeds from 222 cameras installed in Tesla’s factories and warehouses in the US and China,17 cameras in Graham County detention centre in Arizona and 330 security cameras in the Madison County Jail in Alabama among others. The group was reportedly able to access feed from schools and hospitals as well.

“We have disabled all internal administrator accounts to prevent any unauthorised access … our internal security team and external security firm are investigating the scale and scope of this issue, and we have notified law enforcement,” Verkada said in a statement provided to Bloomberg.

Verkada and Mr Kottmann did not respond immediately to The National's request for comment.

This is not the first time that Mr Kottmann has revealed loopholes within major companies. In January, he highlighted flaws in the source code for Nissan North America’s internal mobile apps. In August, Mr Kottmann exposed the leak of more than 20 gigabytes of proprietary data from America's biggest chip maker Intel.

Founded in 2016, Verkada was valued at $1.6 billion after securing $80 million in a Series C financing round in January last year. Its investors include Next47, Sequoia Capital, Meritech Capital and Felicis Ventures.

The increase in cyber threats has led to a surge in spending on cyber security, which is forecast to rise about 125 per cent to $363.05 billion by 2025 from 2019, research consultancy Mordor Intelligence said.

Last week, a cyber espionage group Hafnium reportedly exploited tech company Microsoft's widely used email and calendar Exchange server, breaching more than 30,000 commercial and local government entities in the US.

Cyber security experts said the latest hack could have been prevented if the vendor’s details were not exposed on the internet.

"Today, there are more than 1 billion surveillance cameras in use around the world and security is an afterthought in many of them, resulting in spying and unlawful monitoring of unsuspecting victims," Sam Curry, chief security officer of Boston-based cyber security firm Cybereason, told The National.

Verkada breach is a reminder how vast the threat landscape is, Mr Curry said.

“This breach appears to have been preventable if the administrator's username and password were not exposed on the internet.”

Organisations have to consider cyber breaches as "inevitable, not extraordinary", Ammar Enaya, regional director for Middle East, Turkey and North Africa at San Jose-based Vectra that uses artificial intelligence to detect cyber attacks, told The National.

“Cyber security thinking today is evolving … but we have to evolve faster. Lingering faith in faulty protection solutions has cost too many organisations dearly. The best response to these attacks is to adopt better protective measures,” he added.