spacebar Posted February 25, 2018 Posted February 25, 2018 Footage from at least four schools is available on a creepy US website that allows snoopers to “watch live surveillance cameras in the UK”. The schools are among hundreds of UK businesses, churches and private residences that have had their CCTV security breached. Parents are horrified anyone can log in to see their children. Dad Szczepan Warhol, 40, a parent at St Mary’s Catholic Academy in Blackpool, said: “It’s completely shocking. “I think they should have CCTV at the school to make it secure, but they need to improve this situation now.” Another parent whose child goes to the same school said: “It’s really bad. They’ve got cameras everywhere around the school and even in the toilets. How has this been allowed to happen?” Our investigators were able to watch video from eight cameras around the Academy – in the playground, the entrances and in school corridors. When an investigator phoned the school a staff member admitted they were unaware snoopers could see their 1,188 pupils through the school’s high-definition cameras. But nobody from the school made an official comment. Seven CCTV cameras were being streamed live from Highfield Leadership Academy, also in Blackpool, which teaches 1,130 pupils aged between 11 and 16. Pupils can be seen congregating in the main entrances and playgrounds, as well as on basketball pitches, by bike sheds and seating areas. The website broadcasting the footage – which we have chosen not to name – claim no cameras are hacked. They say all the cameras seen via the site do not have proper password protection. The Information Commissioner’s Office, which governs data protection in the UK, told us it is investigating. A spokesman said: “The ICO advises anybody who purchases an internet-connected device which has the capability to stream live video to immediately change passwords and usernames from default settings and to set a strong password.” https://www.dailystar.co.uk/news/latest-news/684543/school-cctv-cameras-hacked-streamed-online-parents-fury-anger So not a hack, just a stupid setup!
elsiegee40 Posted February 25, 2018 Posted February 25, 2018 Hack in news stories means insecure, or password given away/guessed/stolen [emoji849] It's a nice short word for headlines that is constantly being used incorrectly [emoji35]
FN-GM Posted February 25, 2018 Posted February 25, 2018 The school uses Home Access Plus. Looking like someone in IT is a member of the forum.
Edu-IT Posted February 25, 2018 Posted February 25, 2018 I assume by this point they've taken their cameras off of the internet.... one would hope.
XiJ Posted February 25, 2018 Posted February 25, 2018 If it’s not a true ‘hack’ it makes it even worse.
elsiegee40 Posted February 25, 2018 Posted February 25, 2018 The school uses Home Access Plus. Looking like someone in IT is a member of the forum.Or a lurker... possibly more likely
synaesthesia Posted February 25, 2018 Posted February 25, 2018 Good reason to check and double check that CCTV/security systems are not internet accessible and not on the same network (virtual/physical as applicable) as everything else. Not many reasons to have a CCTV system internet accessible.
Jobos Posted February 25, 2018 Posted February 25, 2018 This is nothing new as we had this problem at one of my schools a few years back. Now at the time I had nothing to do with the CCTV system and wasn't aware it was internet connected. At a meeting a year earlier it was proposed the CCTV should be internet connected as part of the building refurbishment but it wasn't mentioned again and I forgot about it. Fast forward a year or so later to the spring half term the site manager mentions in passing he is having problems with the out of hours monitoring station viewing the CCTV so I tell him that's because it not connected to the network only to be told it was working fine until last week! So I go on my hand and knees and trace the network cable and find it's connected to an BT ADSL router on a separate line. From the office PC I used IE to connect to the CCTV system and on the logon screen was a link to download the manual which listed the default password. Low and behold the password hadn't changed and I was in. Unbelievable, I couldn't have made it up! Seeing what a huge risk this was I tried connecting from my home PC not really expecting to get anywhere as the router firewall would block me right? Wrong, again I was in and had complete control of the CCTV including the ability to move PTZ cameras and view the neighbouring houses (no privacy blackout). So after the holidays I informed the HT of my findings and don't hear anymore about it until the first day of the summer holidays when a letter arrives at home informing me that I am being investigated for accessing the CCTV system without authorisation. The meeting was in five weeks time. I contact my union rep and he attends the meeting with me together with the HT, chair of governors, and the LA education HR bod. They basically tell me accessing the CCTV from my home PC is unacceptable and breaking loads of rules in doing so that's why they are investigating me. At the meeting I learn the company who fitted the system had done the same at other schools and they have lost the contract with the LA. There was another meeting a weeks or so later but nothing came of it and I was told not to do it again... but, I was told not to tell anyone about it or I could face dismissal. Sounds more like a cover up to me!
MkII Posted February 25, 2018 Posted February 25, 2018 (edited) This is nothing new as we had this problem at one of my schools a few years back. Now at the time I had nothing to do with the CCTV system and wasn't aware it was internet connected. At a meeting a year earlier it was proposed the CCTV should be internet connected as part of the building refurbishment but it wasn't mentioned again and I forgot about it. Fast forward a year or so later to the spring half term the site manager mentions in passing he is having problems with the out of hours monitoring station viewing the CCTV so I tell him that's because it not connected to the network only to be told it was working fine until last week! So I go on my hand and knees and trace the network cable and find it's connected to an BT ADSL router on a separate line. From the office PC I used IE to connect to the CCTV system and on the logon screen was a link to download the manual which listed the default password. Low and behold the password hadn't changed and I was in. Unbelievable, I couldn't have made it up! Seeing what a huge risk this was I tried connecting from my home PC not really expecting to get anywhere as the router firewall would block me right? Wrong, again I was in and had complete control of the CCTV including the ability to move PTZ cameras and view the neighbouring houses (no privacy blackout). So after the holidays I informed the HT of my findings and don't hear anymore about it until the first day of the summer holidays when a letter arrives at home informing me that I am being investigated for accessing the CCTV system without authorisation. The meeting was in five weeks time. I contact my union rep and he attends the meeting with me together with the HT, chair of governors, and the LA education HR bod. They basically tell me accessing the CCTV from my home PC is unacceptable and breaking loads of rules in doing so that's why they are investigating me. At the meeting I learn the company who fitted the system had done the same at other schools and they have lost the contract with the LA. There was another meeting a weeks or so later but nothing came of it and I was told not to do it again... but, I was told not to tell anyone about it or I could face dismissal. Sounds more like a cover up to me!More like they are in hot water for letting it happen. How dare they accuse you of wrong doing. Wow. And your union rep let them get away with that? I'm astounded. Edited February 25, 2018 by MkII
free780 Posted February 25, 2018 Posted February 25, 2018 Why on earth would you allow inbound 443/80 etc to a cctv system? It's just going to appear on Shodan. It's not that hard to setup a VPN even if you have to use the Windows Server one. The new GDPR world might force these companies to do installations properly. 1
mthomas08 Posted February 26, 2018 Posted February 26, 2018 Lets be honest here... CCTV tends to be covered by us IT people.. this is on top of everything which is fast becoming IT and all under O U R remit. Some years ago I wouldn't have even considered to be looking after CCTV. It was run by the premises staff installed by contractors and used only for theft/serious incidents not for bullying. Now we have budget cuts/squeezed, staff redundancies, being moved around in MATs. Schools would rather spend hours upon hours and thousands of pounds on pretty devices or projects that get cancelled. Instead of spending the time/money on improving what they currently have. We could also mention the amount of IT staff being TAs, PAs and every other word that means assistant in education. Some of us move jobs constantly for one reason or another. To top it all off.. we are very lucky IF leadership support us.. to do things properly.. GDPR is a prime example.. We can all sit there and say "common sense" but in the situation some of us are in.. I am very surprised it hasn't happened more often. I am very lucky, GDPR has full support from leadership and so does my team. One thing we have recently been doing is tightening security on CCTV and even the recordings. With GDPR/ICO we are seeing what breaches occur in education. I've seen quite a few pop up recently and I think it's needed. 1
Jobos Posted February 26, 2018 Posted February 26, 2018 More like they are in hot water for letting it happen. How dare they accuse you of wrong doing. Wow. And your union rep let them get away with that? I'm astounded. In hindsight I think the investigation was a smokescreen so they could say 'we have investigated the issue and dealt with it' as had they investigated the real issue it would have opened a whole can of worms. 1
FN-GM Posted February 26, 2018 Posted February 26, 2018 being moved around in MATs. I don't really know what that would have to do with it.
TechMonkey Posted February 26, 2018 Posted February 26, 2018 Often these systems will have been installed by alarm companies who generally have no clue about Internet security, or infact networks at all. The last time we had a security install here they asked me to install the software, setup the devices, to troubleshoot it, to contact the company to sort out an issue and to test it and then had the gall to try and charge us for the time. I threatened to send them a bill for my consulting rates, hinting at a figure, and they backed down. But they made all the stereotypical suggestions, just turn off the firewall as it gets inthe way, turn off the AV as it can causes issues, give it a direct IP as that will make it easier, etc etc. I can think of may uses for having CCTV accessible externally but it needs to be hardened and secure, having a proper central system, not just having the cameras accessible. Which then starts a discussion about what cameras and systems are bought and if they are suitable for a school when they are effectively home grade systems.
ITGURU Posted February 26, 2018 Posted February 26, 2018 No need for it to be internet connect. it's on a separate VLAN and accessible via VPN both on phone and computer if access is needed off-site.
jimmy_2k Posted February 26, 2018 Posted February 26, 2018 From reading the daily mail version of this article. It seems that some of the affected schools were BSF managed sites, who have their own network for facilities management including cameras.
atcoates Posted February 26, 2018 Posted February 26, 2018 No need for it to be internet connect. it's on a separate VLAN and accessible via VPN both on phone and computer if access is needed off-site. Internet connected cameras connected to cloud storage etc are the way forward but need to be implemented securely.
Katy Posted February 26, 2018 Posted February 26, 2018 It's hit the local press here, both Blackpool schools affected were part of BSF so their local IT presumably had little or no involvement in CCTV (or "weren't allowed" even if they wanted to advise) https://www.blackpoolgazette.co.uk/news/education/parents-reassured-after-live-footage-from-blackpool-schools-cctv-cameras-was-hosted-on-us-website-1-9036288
rom1984 Posted February 26, 2018 Posted February 26, 2018 The schools ICT Helpdesk System also asks them to enter their username and password over http. I wonder if the back ends authenticates to AD
mthomas08 Posted February 27, 2018 Posted February 27, 2018 I don't really know what that would have to do with it. If they are being moved around.. it takes time to really get to know 'that' school. How things are setup... how things work... when a single school is being half ignored in favour of the Trust as a whole. Someone I know went through it. Thank you for nit picking though... I could have carried on listing things but I'd be here all day.
mthomas08 Posted February 27, 2018 Posted February 27, 2018 Often these systems will have been installed by alarm companies who generally have no clue about Internet security, or infact networks at all. Sadly yes... I have dealt with around 2 different companies and a few contractors. Security of the actual equipment or networking wasn't exactly their speciality. Hopefully though, most of us are
DCUK6 Posted February 27, 2018 Posted February 27, 2018 CCTV companies can be dreadful. I got asked to take over the cctv a month ago. Default passwords on everything, they were all connected using different switches (4 systems) and when i tried plugging 2 together i found out why. All the cameras started at 1 on a certain IP range for each system so instead of change the ips they put in a different switch. Currently going through cameras and changing their default passwords and IPs.
Katy Posted February 27, 2018 Posted February 27, 2018 CCTV companies can be dreadful. I got asked to take over the cctv a month ago. Default passwords on everything, they were all connected using different switches (4 systems) and when i tried plugging 2 together i found out why. All the cameras started at 1 on a certain IP range for each system so instead of change the ips they put in a different switch. Currently going through cameras and changing their default passwords and IPs. I think most CCTV companies set up when everything was BNC/coax from camera to recorder, no networking involved and then slept through IP cameras becoming a thing and suddenly realised they had to work with IP and hadn't bothered to employ anyone who knows networking. Then they find which existing employee "is good with computers" and get them to make a mess of it.
FN-GM Posted February 27, 2018 Posted February 27, 2018 If they are being moved around.. it takes time to really get to know 'that' school. How things are setup... how things work... when a single school is being half ignored in favour of the Trust as a whole. Someone I know went through it. Thank you for nit picking though... I could have carried on listing things but I'd be here all day. That is not something that happens to all MATS and certainly doesn't happen to ours. Bit unfair to generalise in the way you did. 1
southhamster Posted February 27, 2018 Posted February 27, 2018 It's probably other things too. How many BMS installers keep up with firmware updates and configure their systems securely (and can prove it)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now