Identificación de vulnerabilidades en un sistema de videovigilancia y propuesta de solución

Abstract

Video surveillance systems connected via the Internet are exposed to various drawbacks, due to security vulnerabilities that may suffer by allowing third parties to have access to the information stored or projected in real time by the video cameras, considering that a cybercriminal could partially or partially manipulate completely the system, turning the role of the owner of the banana company from being a watchman to being watched, for this reason, it is important to identify the root weaknesses of the system and propose prevention strategies to reduce the negative effects of possible attacks. This work presents a broad vision to what a video surveillance system is currently exposed to, since it includes a study and collection of information, as well as the development of the practical part where the tests are carried out to identify the shortcomings using tools that can simulate the attack and allow the company to create robust security barriers. There are several scientific articles, theses and works that have been dedicated to research and penetration tests on networks, mobile devices and servers, however, there is a lack of information on the risks that video recording systems expose. For this reason, two real scenarios were implemented to test the security barriers, the first being an external attack where the ethical hacker does not have company information and the second one internal, in this case he already has basic knowledge of the LAN network. After implementing both work environments, the tools were chosen to run the penetration tests. VMware Workstation was used as virtualization software and Kali Linux was used as the operating system with a complete set of outstanding tools such as Metasploit, which was used to prepare the payload and through engineering. social malware was introduced that allowed pentesting, information gathering, search for vulnerabilities, escalation of privileges and exploitation of the victim. The applied methodology of Ethical Hacking (CEH) consists of five phases, starting with the recognition of the victim until the cleaning of traces to eliminate evidence of hacking. A solution proposal composed of the corrective measures that are recommended to be applied was elaborated, then a plan was created to evaluate the vulnerabilities again, this time with the corrections made. The controls were selected taking into account that they are not against laws, regulations and standards, that they are cost-effective, that they do not interrupt business operations, that they are safe and finally that they are effective. After applying the recommendations to strengthen security, the results were favorable. In the external scenario, the malware created by metasploit had no effect on the monitoring center. On the other hand, in the internal penetration tests, no vulnerabilities were detected either. In any case, organizations must take into account that as their equipment is connected to the WAN, they will always be exposed to new threats, therefore a risk analysis per year is recommended.