There are some quick things you can do to stop your children falling victim to people hacking your smartphone camera. Photo / Getty Images
There are some quick things you can do to stop your children falling victim to people hacking your smartphone camera. Photo / Getty Images
DIGILIFE_STRAP
Last year, a family in Seattle grew alarmed when their 3-year-old daughter informed them that a voice in her bedroom was saying "I love you".
"We were both downstairs working in our office here, and our daughter called out," the child's mother told King 5, a local news channel. "She'ssaying, 'Mommy, mommy. The voice is talking to me.'"
The voice wasn't an imaginary friend, but a hacker who had broken into the internet-connected baby monitor in the toddler's room and begun using its speaker to broadcast his own voice.
The incident, and countless other similar hacks, have prompted governments around the world to crack down on cheap smart cameras.
This week, Britain's GCHQ spy agency released new advice urging Britons to turn off the internet features of smart cameras, which it said had the "potential to be accessed by unauthorised users".
The spy agency's National Cyber Security Centre (NCSC) said while the risk was low, it recommended the public disable any features that allow camera footage to be remotely viewed over the internet - unless they are actively being used.
"Smart technology such as cameras and baby monitors are fantastic innovations with real benefits, but without the right security measures in place they can be vulnerable to cyber attackers," NCSC technical director Ian Levy says.
The advice was a sign of growing concern about the vulnerability of "smart devices" - lights, speakers and security cameras connected to the internet. They are now estimated to be in almost two-thirds of British homes.
Even with the widespread use of such products, more than 70 per cent of households are said to be concerned about hackers breaking into them. As many as half said they thought they could never be totally secure.
It is a concern experts say they are right to have. Smart devices can be "easy pickings for hackers", says Cath Goulding, an ex-GCHQ spy who now works for Nominet, the official UK internet domain name registry.
Keep your devices up to date
Of course, "anything can be hacked if enough attention is applied", she says. "Quite often in these cases, you are looking at a perfect storm: mainstream users who don't manage their security effectively and simple-to-execute attacks, such as on devices that haven't been updated in a long time."
This wouldn't just put those devices at risk, but actually the entire network itself. Once hackers have managed to break into one device, they can gain access to other devices on the same network.
In today's world, many consumers may not be prepared for such an attack - but that is not to say it's too late and that their security is irreversibly compromised. In some cases all it takes is a basic software update.
Newer products typically come with more advanced features pre-installed, including two-factor authentication, which means users can verify they are the ones accessing the system through a separate device, such as a smartphone. This more rigorous security can be made available to older devices through updates.
UK spy base, GCHQ Headquarters. Photo / Getty Images
Change default passwords
Another key piece of advice is updating the passwords you use to log into smart devices to make sure that they're strong and unique. Alan Woodward, a professor at the University of Surrey and a former GCHQ consultant, says: "If you bought a smart kettle, would you know how to change the password on it? There's no keyboard, no screen, so people think it must be secure.
"A lot of the time, they're not - and being able to get into the system, through a cloud server, and change the password to gain control of the products is key."
Earlier this year, the UK Government said it would be drawing up new legislation to ban default passwords in smart devices and bringing it before MPs "as soon as possible".
But as it stands, many smart home devices have the same passwords, set by manufacturers - and that, worryingly, can often be found on online databases.
"This allows attackers to go to a single database that shows all of the devices found on the internet along with their configuration details, and so people can then log in," says James Hadley, a former GCHQ employee who now runs cybersecurity training business Immersive Labs.
"If I bought a device and then found out it couldn't be secured, so you couldn't change the password, then I wouldn't install it in my home."
The NCSC suggests using three different random words put together to form a strong, unique password.
Cover up some devices
And if they were installed, experts suggest finding physical covers for devices such as cameras - especially in sensitive spaces such as bedrooms.
If there is no other option, cameras can be blocked up with "a good old-fashioned blob of Blu-Tack", Goulding says. Or devices can be unplugged to save any unwanted attacks.
Update the passwords you use to log into smart devices to make sure that they're strong and unique. Photo / NZ Herald archive
Have a dumb home
The popularity of smart devices may be exploding, but that doesn't mean you need to have them in your home.
"Manufacturers these days seem determined to make their devices smart, so it's actually quite difficult not to buy them," Woodward says. "I personally do not have a home hub, an Alexa or whatever in my home."
Woodward adds that he bought a television that doesn't include a camera or microphone. Anyone looking to buy a smart device now should read reviews, to validate and verify whether a particular device has been accredited, says David Balson, now at RipJar and formerly at GCHQ.
"It's a bit of the Wild West at the moment," he says. "Most of these devices don't come with security at the forefront of their design."
Until it becomes the law for manufacturers to have to ramp up security measures for smart home products, consumers have to take it into their own hands, and make sure what they're buying is secure.
"At the moment, it's almost like companies are selling cars without seatbelts or a building is being built without fire escapes," Balson says.
