Last month, a series of Nest Cameras were breached by hackers who then accessed hidden microphones within the cameras to harass users—coming as a stark reminder of the dangers surrounding unsecured smart devices.
Google has since advised Nest Camera owners to take defensive measures by resetting the passwords related to their devices. But, when considering how users were never informed there’s a microphone inside their cameras in the first place, the news comes as that much more of an unwelcome surprise.
How Nest Cameras were Accessed
Hacking concerns surrounding smart technology have been on the rise for a while, with Japan even purposefully trying to hack into its citizen IoT devices to detect and eradicate vulnerabilities throughout the country’s information technology systems prior to the 2020 Olympic Games.
However, according to Nest, in this most recent incident the company is not to be blamed. Rather, they claim the hacked cameras were simply the result of password neglect on the users end.
According to an email from Nest’s Vice President, Rishi Chandra, these attacks were traced to customer’s repeatedly using the same passwords across multiple accounts, and the stolen passwords that were used to break into Nest Cameras were actually first compromised on other websites.
The message also provided recipients with an overview of good safety practices for defending against online threats to avoid similar attacks in the future. For example, in nearly every reported case, two-factor authentication would have been enough to stop the breaches.
Reported Hacking Incidents
Of the breaches, two incidents of note both occurred in January, starting with an unknown voice coming over the user’s Nest devices at home.
In California, one family received a phony emergency broadcast over their camera. The fake broadcast reported that intercontinental missiles had been fired at the United States by North Korea. It also mentioned that the U.S. had taken military action against the city of Pyongyang and that people in the areas about to be impacted had less than three hours to evacuate to safety.
Meanwhile, in Illinois, another family had their home security system breached by hackers who then connected to the home’s Nest camera. The camera, which was placed in the room of the family’s seven-month-old son, began projecting a voice that shouted racial slurs at both the child and the couple who came to investigate. The hacker also, for some reason, adjusted the family’s thermostat to 90 degrees Fahrenheit.
Though nobody was physically harmed during these events, the intense violation of privacy caused by these security lapses is remarkable. More importantly, they showcase a glimpse of just how much control malicious entities can acquire when successfully hacking into modern smart systems.