Hacked Cameras Used for Warfare: Ukraine, Israel, and Iran
The Expanding Battlefield: How Hacked Security Cameras Are Becoming a Key Tool in Modern Warfare
The modern battlefield is no longer confined to traditional domains. Increasingly, conflicts are spilling over into the digital realm, and a surprising new weapon is emerging: compromised internet-connected security cameras. From Ukraine to the Middle East, militaries are leveraging vulnerabilities in these ubiquitous devices for surveillance, reconnaissance, and even targeting, fundamentally altering the dynamics of modern warfare.
The trend gained significant attention in recent weeks with reports detailing the use of hacked cameras during the escalating conflict between Iran and Israel. Check Point security researchers have tracked “hundreds” of hacking attempts targeting IP cameras manufactured by Hikvision and Dahua, beginning around , coinciding with the start of the recent hostilities. These attempts, attributed to “several Iran-nexus threat actors,” suggest a deliberate effort to gain intelligence and potentially prepare for kinetic attacks.
This isn’t simply about opportunistic hacking. According to Check Point, the activity may be an “early indicator of potential follow-on kinetic activity,” highlighting a clear pattern of digital reconnaissance preceding physical strikes. Iran has a history of utilizing compromised cameras for this purpose. As recently as , threat groups linked to Iran’s Ministry of Intelligence and Security (MOIS) compromised servers hosting live CCTV streams from Jerusalem, allowing them to surveil the city in the days leading up to missile attacks.
However, Iran is not alone in employing this tactic. Israel has also demonstrated a sophisticated capability in exploiting camera systems. Intelligence sources speaking to the Financial Times revealed that Israeli intelligence assembled detailed “patterns of life” for Iranian security personnel guarding Ayatollah Ali Khamenei, Iran’s supreme leader, by analyzing real-time data from hacked traffic cameras in Tehran. “We knew Tehran like we know Jerusalem,” one source stated, illustrating the depth of their surveillance network. This intelligence was reportedly instrumental in a recent operation targeting Khamenei.
The use of hacked cameras isn’t a new phenomenon. The conflict in Ukraine brought this tactic into sharp focus. As early as , Ukrainian officials warned that Russian forces had compromised security cameras in Kyiv to observe infrastructure targets and air defenses. The Security Service of Ukraine (SSU) stated that the aggressor used these cameras to “collect data to prepare and adjust strikes on Kyiv.” In response, the SSU took the drastic step of disabling approximately 10,000 internet-connected cameras, though the specific methods used were not disclosed, and urged citizens to report any active streams from such devices.
Interestingly, Ukraine appears to have adopted the same tactic. Video footage of a Ukrainian underwater drone successfully destroying a Russian submarine in Sevastopol, Crimea, appeared to originate from a hacked surveillance camera. The Ukrainian hacktivist group One Fist received commendation from the Ukrainian government for their work, which included hacking cameras to monitor the movement of Russian matériel across the Kerch Bridge connecting Russia and Crimea.
The appeal of exploiting these cameras lies in their sheer ubiquity and inherent security vulnerabilities. Consumer-grade security cameras, often prioritizing ease of use over robust security, are frequently deployed with default credentials or outdated firmware, making them easy targets for attackers. The low cost of these devices and their widespread deployment create a vast, readily available network of potential surveillance points.
The implications of this trend are significant. It highlights the growing convergence of the physical and digital worlds, and the increasing importance of cybersecurity in modern warfare. The vulnerability of civilian infrastructure to military exploitation raises serious ethical and legal questions. While militaries may view these cameras as legitimate targets for intelligence gathering, the compromise of private security systems raises concerns about privacy and the potential for collateral damage.
The incident with the SSU disabling 10,000 cameras also points to the challenges of mitigating this threat. Simply disabling cameras is a blunt instrument, potentially disrupting legitimate surveillance and creating inconvenience for citizens. A more sustainable solution requires manufacturers to prioritize security, implement robust authentication mechanisms, and provide regular firmware updates. Users, too, must take responsibility for securing their devices by changing default credentials and keeping their firmware up to date.
As the conflict in the Middle East continues, and as geopolitical tensions remain high, the use of hacked security cameras is likely to become an increasingly common tactic. This trend underscores the need for a comprehensive approach to cybersecurity that addresses not only the protection of critical infrastructure but also the security of the everyday devices that are becoming integral to modern life – and, increasingly, to modern warfare.