Exploring the Attacks, Impacts, and Mitigations in a Real-Time Streaming Protocol Service of IP Cameras

The constant need for security has paved the way for the use of IP Cameras and CCTVs. Given that everyone now has an internet, IP cameras have become more popular as it allows Real-Time Streaming Protocol (RTSP) which grants the user video and audio streaming over the internet. This allows for pausing, playing, and recording video and audio data for later usage. Despite its popularity, RTSP has multiple vulnerabilities which pose a security risk for its users. Although multiple studies are exploring these risks, there is a lack of understanding about the specific ways that these vulnerabilities are exploited. This paper discussed the possible specific attacks, impacts, and mitigations that could occur on an RTSP-enabled IP Camera. Based on the gathered studies, four vulnerabilities were found: (1) Unencrypted URL of the Streaming Server; (2) Unencrypted User Account, Wi-Fi, and RTSP credentials; (3) Unsecured System and Lack of Security Measures for Input Validations for RTSP requests; and (4) Improper Quality Assurance of Firmwares. These vulnerabilities lead to attacks such as Packet Sniffing, Man in the Middle Attacks, Denial of Service, and Brute Force Dictionary Attacks. Additionally, the impacts of these attacks were explored as well, such as loss and theft of data, service disruption, and brand reputational risks. Mitigations for these attacks and exploited vulnerabilities include the following: Utilizing OpenSSL to provide encryption and authentication of data over the networks, Implementing Cryptography-based APIs in the system development, Implementing an Access Control List to control authentication, changing default passwords to strong passwords, updating softwares and firmwares to ensure patches are applied, and making use of secure authentication modules that implement hashing algorithms, QR codes, and other authentication values.