Download - Cctv Hacking
![Page 1: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/1.jpg)
Hacking CCTV
A Private Investigation22C3http://www.quintessenz.at/cctv/
![Page 2: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/2.jpg)
Overview
● Radio, Analog– Transmission modes– Frequencies– Receiver– Antennas– Encryption
● IP-Cameras● Real-World Stupidity
● Self defense– Nondestructive
Methods– Be invisible?
● Fun & Arts– Searchengines– “Baby”phones
wardriving
![Page 3: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/3.jpg)
Schwedenplatz
Warning Sign(Press Version)
Minister for internal Affairs: Prokop
![Page 4: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/4.jpg)
Schwedenplatz
Warning Sign
![Page 5: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/5.jpg)
Schwedenplatz
![Page 6: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/6.jpg)
radiocameras
● Frequent frequencies– 1,2-1,3 Ghz (ATV)– 1,4 Ghz– 2,3 Ghz (ATV+LEA)– 2,4 Ghz (ISM+ATV)– 5,8 Ghz
● Analog● Modulation● Encryption
![Page 7: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/7.jpg)
Modulation and Encryption
● AM-TV● FM-TV
● Inverted Signal● Modified H/VSync
http://www.2cool4u.ch/tv_signal_measurement/tv_signale_grundlagen/tv_signale_grundlagen.htmhttp://instruct1.cit.cornell.edu/courses/ee476/FinalProjects/s2003/fww3jhy5/results.html
![Page 8: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/8.jpg)
Methods of Reception
● Original Equipment● Arabsat - LNC● ATV / 13cm / 23cm
– http://www.darc.de/distrikte/g/T_ATV/13cm.htm
![Page 9: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/9.jpg)
Videoscanner
● eg: Icom IC-R3– 0.5 to 2450 Mhz– 2” LCD– http://www.icomamerica.com/
– New ~ 500€– PAL != NTSC
![Page 10: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/10.jpg)
SAT Receiver !?
● ~11 Ghz Downlink-Frequency
● LNC converts to 1-2 Ghz● Zf=f
SAT-f
LNC
● SAT-Receiver: ~ 950-2150 Mhz
![Page 11: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/11.jpg)
Up to 2742 Mhz
● Telestar/TechnisatSatPlus SP2
● 700 - 2742 Mhz● EBay ~ 15 €
![Page 12: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/12.jpg)
Antennas
● Microwave !?● WLAN nearby!● Buy one
– or – Do it yourself
http://martybugs.net/wireless/biquad/
![Page 13: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/13.jpg)
A possible Car Setup
● 12V-230V DC-Converter
● Screen● VCR● Copy-”Enhancer”● Receiver● Antenna
Display
VCR
12V DC
Recv
CE
![Page 14: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/14.jpg)
IP Cameras
● HTTP JPEG-Push Streams or MPEG
● Connected– Dedicated (V)LAN– shared LAN (!!!)– Internet (!!!!!!!!!!!!)
LAN
![Page 15: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/15.jpg)
IP Cameras
● ARP & Mac spoofing● ethercap plugin ?● Replace images in
the stream● Like in hollywood
movies
LAN
![Page 16: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/16.jpg)
IP Cameras @ Internet
● Searchengine-Hack– Axis, Panasonic, ...
Liveappletinurl:"axis-cgi/mjpg"inurl:"ViewerFrame?Mode="inurl:"view/index.shtml"inurl:"MultiCameraFrame?Mode="intitle:"Biromsoft WebCam" -4.0 -serial -ask -crack -software -a -the -build -download -v4 -3.01 -numrange:1-10000
![Page 17: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/17.jpg)
Self defense – Real World Stupidity
● CCTV is an invisible superhero ?
![Page 18: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/18.jpg)
Self defense
● Non Destructive– Airballoons– Plastic Bags– Tape– (Paintball)
![Page 19: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/19.jpg)
Laser Zapping
● See http://www.naimark.net/projects/zap/howto.html●
![Page 20: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/20.jpg)
Laser Zapping
● Laser Riffle● 100m
![Page 21: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/21.jpg)
Laser Zapping
● Laser is a monochromatic light source
● Green & Blue Channel affected less
![Page 22: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/22.jpg)
Infrared reception
● CCDs and CMOS cover a larger spectrum
● IR-Filter used for color correction
● CCTV an B/W Cameras usually response good to IR
● IR-Diodes*: 850-950nm
IR*
![Page 23: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/23.jpg)
Infrared
● Human Eye vs. Sony Camera– http://www.kweii.com/site/services/review/review.html
![Page 24: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/24.jpg)
Blend with Infrared
“Privacy Cap”
![Page 25: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/25.jpg)
Q/Gate
● anonymized video surveillance
● Since 2003● Realtime
Biometric Face Detection
● openCV
![Page 26: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/26.jpg)
Museumsquartier
● Protect “q/spot” - anonymous Hotspot
![Page 27: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/27.jpg)
Other Fun
● ARS-Electronica, Linz– Michelle Teran,CA– Babyphones
● Video Voyeurism
![Page 28: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/28.jpg)
Sources & Links● http://www.quintessent.at/cctv/
● http://www.quintessenz.at/qgate● http://www.rtmark.com/cctv/● http://www.naimark.net/projects/zap/howto.html● http://www.kweii.com/site/services/review/review.html● http://www.vtq.de/SecurityLink-DE.htm● http://www.ubermatic.org/life/● http://www.vam.com
![Page 29: Cctv Hacking](https://reader031.vdocuments.us/reader031/viewer/2022012305/545f0d37af79592b708b4c50/html5/thumbnails/29.jpg)
Questions ?