How To Detect Spy Cameras

Many users ignore it, but by using their laptop camera or any other camera with a WiFi connexion, their MAC address will become visible to anyone on the Cyberspace. Likewise, network security experts from the International Found of Cyber Security (IICS) mention that it is possible to observe multiple data from a user even if their camera is non direct connected to the network.

If the camera is using a wired network, the methods described below cannot detect that device. Moreover, WiFi devices and their MAC addresses can be collected using airodump-ng, for devices on the network we are continued to, MAC addresses can be obtained using Nmap, although nosotros demand a database of hidden camera manufacturers and cameras in full general.

Databases with MAC addresses

Many times we will not be able to find such databases, although we will be able to resort to the lists created past enthusiasts, mention the experts in network security. Another useful tool is the https://directory.ifsecglobal.com/video-surveillance-code004812.html website, which has multiple lists containing this kind of information.

The correct manufacturer name can easily match the MAC database, so we only need to collect the vendor names; this is perfect for our goal of finding hidden cameras.

Create a vendors.sh file :

Copy the following code into the file:

#!/bin/bash    TMP_FILE='/tmp/vendors.txt' FILE='vendors.txt'    whorl -s 'https://directory.ifsecglobal.com/screens-monitors-code004843.html' | grep -East 'ed-companyName' | grep -E -o '">[^/]+<' | sed 'southward/<//' | sed 's/">//' > $TMP_FILE roll -s 'https://directory.ifsecglobal.com/cameras-code004815.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE gyre -due south 'https://directory.ifsecglobal.com/cctv-poles-and-columns-code004816.html' | grep -East 'ed-companyName' | grep -Eastward -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE curl -southward 'https://directory.ifsecglobal.com/data-storage-solutions-code009685.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 'southward/">//' >> $TMP_FILE curl -south 'https://directory.ifsecglobal.com/voice-video-integrated-information-systems-code004908.html' | grep -E 'ed-companyName' | grep -Eastward -o '">[^/]+<' | sed 's/<//' | sed 'due south/">//' >> $TMP_FILE coil -s 'https://directory.ifsecglobal.com/dvr-code004822.html' | grep -Due east 'ed-companyName' | grep -E -o '">[^/]+<' | sed 'southward/<//' | sed 's/">//' >> $TMP_FILE ringlet -due south 'https://directory.ifsecglobal.com/vocalism-video-integrated-information-storage-code004941.html' | grep -Due east 'ed-companyName' | grep -E -o '">[^/]+<' | sed 'south/<//' | sed 's/">//' >> $TMP_FILE curl -south 'https://directory.ifsecglobal.com/nvr-code004827.html' | grep -E 'ed-companyName' | grep -East -o '">[^/]+<' | sed 's/<//' | sed 'south/">//' >> $TMP_FILE curl -s 'https://directory.ifsecglobal.com/4k-cameras-code009684.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 'due south/<//' | sed 's/">//' >> $TMP_FILE curl -s 'https://directory.ifsecglobal.com/anpr-code004813.html' | grep -E 'ed-companyName' | grep -Due east -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE whorl -due south 'https://directory.ifsecglobal.com/body-worn-cameras-code007865.html' | grep -Eastward 'ed-companyName' | grep -East -o '">[^/]+<' | sed 'south/<//' | sed 's/">//' >> $TMP_FILE coil -s 'https://directory.ifsecglobal.com/hard disk-quality-cameras-code007866.html' | grep -Due east 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 'due south/">//' >> $TMP_FILE scroll -southward 'https://directory.ifsecglobal.com/depression-light-level-camera-systems-code007867.html' | grep -E 'ed-companyName' | grep -East -o '">[^/]+<' | sed 's/<//' | sed 'due south/">//' >> $TMP_FILE curl -s 'https://directory.ifsecglobal.com/camera-housings-code004814.html' | grep -E 'ed-companyName' | grep -Eastward -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE curl -s 'https://directory.ifsecglobal.com/internet-remote-surveillance-code004932.html' | grep -E 'ed-companyName' | grep -Due east -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE curl -due south 'https://directory.ifsecglobal.com/cctv-monitoring-code004999.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 'due south/<//' | sed 's/">//' >> $TMP_FILE gyre -due south 'https://directory.ifsecglobal.com/dome-photographic camera-code004821.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE scroll -s 'https://directory.ifsecglobal.com/ip-cameras-code004823.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 'due south/">//' >> $TMP_FILE curl -s 'https://directory.ifsecglobal.com/security-camera-lenses-code004824.html' | grep -Due east 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 'southward/">//' >> $TMP_FILE ringlet -s 'https://directory.ifsecglobal.com/security-monitors-code004825.html' | grep -East 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE curl -s 'https://directory.ifsecglobal.com/security-screens-code007437.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 'southward/<//' | sed 'due south/">//' >> $TMP_FILE curlicue -s 'https://directory.ifsecglobal.com/ptz-camera-code004828.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 'south/">//' >> $TMP_FILE ringlet -south 'https://directory.ifsecglobal.com/switches-code004968.html' | grep -Eastward 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE curl -south 'https://directory.ifsecglobal.com/remote-surveillance-code004829.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 'southward/<//' | sed 's/">//' >> $TMP_FILE curl -s 'https://directory.ifsecglobal.com/public-space-surveillance-code005012.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 'due south/<//' | sed 'south/">//' >> $TMP_FILE scroll -s 'https://directory.ifsecglobal.com/infrared-cameras-code007439.html' | grep -East 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE curl -southward 'https://directory.ifsecglobal.com/thermal-imaging-code004833.html' | grep -E 'ed-companyName' | grep -Due east -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE curl -s 'https://directory.ifsecglobal.com/ai-machinelearning-code009668.html' | grep -Due east 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE curl -southward 'https://directory.ifsecglobal.com/security-cameras-code007485.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 's/<//' | sed 'southward/">//' >> $TMP_FILE curl -s 'https://directory.ifsecglobal.com/video-surveillance-code007482.html' | grep -Due east 'ed-companyName' | grep -East -o '">[^/]+<' | sed 's/<//' | sed 's/">//' >> $TMP_FILE curl -s 'https://directory.ifsecglobal.com/video-surveillance-code004812.html' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 'south/<//' | sed 's/">//' >> $TMP_FILE #gyre -s '' | grep -E 'ed-companyName' | grep -E -o '">[^/]+<' | sed 'due south/<//' | sed 's/">//' >> $TMP_FILE     curl -s 'https://www.ispyconnect.com/sources.aspx?letter=A' | grep -Eastward -o 'human being\.aspx\?northward=[^"]{1,}"' | sed 's/human being.aspx?n=//' | sed 's/"//' | while read -r line ; do grep -East "$line " vendors.txt >> $TMP_FILE done   coil -s 'https://www.ispyconnect.com/sources.aspx?letter=B' | grep -E -o 'man\.aspx\?n=[^"]{ane,}"' | sed 's/homo.aspx?due north=//' | sed 's/"//' | while read -r line ; do grep -Due east "$line " vendors.txt >> $TMP_FILE washed   curl -south 'https://world wide web.ispyconnect.com/sources.aspx?alphabetic character=C' | grep -E -o 'homo\.aspx\?due north=[^"]{1,}"' | sed 's/man.aspx?n=//' | sed 's/"//' | while read -r line ; exercise grep -E "$line " vendors.txt >> $TMP_FILE done   curl -southward 'https://www.ispyconnect.com/sources.aspx?letter=D' | grep -East -o 'homo\.aspx\?due north=[^"]{1,}"' | sed 's/human.aspx?n=//' | sed 'southward/"//' | while read -r line ; practice grep -E "$line " vendors.txt >> $TMP_FILE done   gyre -due south 'https://www.ispyconnect.com/sources.aspx?alphabetic character=E' | grep -E -o 'homo\.aspx\?n=[^"]{ane,}"' | sed 's/human.aspx?n=//' | sed 'south/"//' | while read -r line ; exercise grep -E "$line " vendors.txt >> $TMP_FILE done   curl -s 'https://www.ispyconnect.com/sources.aspx?letter=F' | grep -E -o 'human being\.aspx\?n=[^"]{1,}"' | sed 's/human being.aspx?n=//' | sed 's/"//' | while read -r line ; exercise grep -E "$line " vendors.txt >> $TMP_FILE washed   curl -s 'https://www.ispyconnect.com/sources.aspx?alphabetic character=M' | grep -E -o 'man\.aspx\?n=[^"]{one,}"' | sed 's/man.aspx?n=//' | sed 's/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE done   curl -south 'https://www.ispyconnect.com/sources.aspx?letter of the alphabet=H' | grep -E -o 'man\.aspx\?n=[^"]{ane,}"' | sed 's/man.aspx?n=//' | sed 's/"//' | while read -r line ; exercise grep -E "$line " vendors.txt >> $TMP_FILE done   curl -due south 'https://www.ispyconnect.com/sources.aspx?alphabetic character=I' | grep -E -o 'human being\.aspx\?n=[^"]{1,}"' | sed 's/man.aspx?northward=//' | sed 'due south/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE done   whorl -s 'https://world wide web.ispyconnect.com/sources.aspx?letter=J' | grep -Eastward -o 'man\.aspx\?n=[^"]{1,}"' | sed 'southward/human being.aspx?north=//' | sed 'due south/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE washed   curl -southward 'https://www.ispyconnect.com/sources.aspx?letter=K' | grep -E -o 'human\.aspx\?n=[^"]{1,}"' | sed 's/man.aspx?northward=//' | sed 's/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE done   curlicue -southward 'https://www.ispyconnect.com/sources.aspx?letter=L' | grep -E -o 'man\.aspx\?n=[^"]{ane,}"' | sed 's/human.aspx?n=//' | sed 'south/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE done   roll -s 'https://www.ispyconnect.com/sources.aspx?letter=M' | grep -East -o 'human being\.aspx\?n=[^"]{1,}"' | sed 's/human being.aspx?n=//' | sed 's/"//' | while read -r line ; exercise grep -East "$line " vendors.txt >> $TMP_FILE done   scroll -s 'https://www.ispyconnect.com/sources.aspx?alphabetic character=N' | grep -Due east -o 'human being\.aspx\?due north=[^"]{1,}"' | sed 's/human being.aspx?n=//' | sed 's/"//' | while read -r line ; practice grep -East "$line " vendors.txt >> $TMP_FILE done   curl -due south 'https://www.ispyconnect.com/sources.aspx?letter of the alphabet=O' | grep -E -o 'man\.aspx\?northward=[^"]{ane,}"' | sed 'due south/man.aspx?north=//' | sed 'southward/"//' | while read -r line ; do grep -East "$line " vendors.txt >> $TMP_FILE done   curl -s 'https://www.ispyconnect.com/sources.aspx?letter=P' | grep -E -o 'man\.aspx\?n=[^"]{1,}"' | sed 's/man.aspx?n=//' | sed 'south/"//' | while read -r line ; do grep -Eastward "$line " vendors.txt >> $TMP_FILE done   roll -s 'https://www.ispyconnect.com/sources.aspx?letter of the alphabet=Q' | grep -E -o 'man\.aspx\?due north=[^"]{1,}"' | sed 's/human.aspx?north=//' | sed 's/"//' | while read -r line ; practice grep -Eastward "$line " vendors.txt >> $TMP_FILE done   curl -due south 'https://world wide web.ispyconnect.com/sources.aspx?letter=R' | grep -E -o 'human\.aspx\?n=[^"]{i,}"' | sed 's/man.aspx?due north=//' | sed 's/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE washed   curl -due south 'https://www.ispyconnect.com/sources.aspx?letter=S' | grep -Eastward -o 'man\.aspx\?north=[^"]{1,}"' | sed 'due south/human.aspx?n=//' | sed 'south/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE done   curl -s 'https://www.ispyconnect.com/sources.aspx?alphabetic character=T' | grep -E -o 'human being\.aspx\?n=[^"]{1,}"' | sed 'due south/man.aspx?due north=//' | sed 's/"//' | while read -r line ; practise grep -East "$line " vendors.txt >> $TMP_FILE done   curl -s 'https://www.ispyconnect.com/sources.aspx?letter=U' | grep -East -o 'man\.aspx\?n=[^"]{1,}"' | sed 's/man.aspx?n=//' | sed 's/"//' | while read -r line ; practice grep -E "$line " vendors.txt >> $TMP_FILE done   curl -s 'https://world wide web.ispyconnect.com/sources.aspx?letter=V' | grep -Eastward -o 'man\.aspx\?n=[^"]{1,}"' | sed 's/human being.aspx?n=//' | sed 'south/"//' | while read -r line ; do grep -Eastward "$line " vendors.txt >> $TMP_FILE washed   curlicue -south 'https://www.ispyconnect.com/sources.aspx?alphabetic character=West' | grep -E -o 'man\.aspx\?n=[^"]{ane,}"' | sed 'southward/human being.aspx?north=//' | sed 's/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE done   gyre -south 'https://www.ispyconnect.com/sources.aspx?letter=X' | grep -Due east -o 'human\.aspx\?northward=[^"]{1,}"' | sed 's/man.aspx?due north=//' | sed 's/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE done   curl -s 'https://www.ispyconnect.com/sources.aspx?letter=Y' | grep -E -o 'man\.aspx\?northward=[^"]{i,}"' | sed 'south/human.aspx?n=//' | sed 's/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE done   curl -southward 'https://www.ispyconnect.com/sources.aspx?alphabetic character=Z' | grep -Due east -o 'man\.aspx\?northward=[^"]{i,}"' | sed 'southward/man.aspx?n=//' | sed 's/"//' | while read -r line ; exercise grep -E "$line " vendors.txt >> $TMP_FILE done   curl -s 'https://www.ispyconnect.com/sources.aspx?letter=2' | grep -E -o 'man\.aspx\?northward=[^"]{one,}"' | sed 's/human being.aspx?northward=//' | sed 's/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE done   roll -s 'https://world wide web.ispyconnect.com/sources.aspx?letter=3' | grep -E -o 'man\.aspx\?northward=[^"]{1,}"' | sed 's/homo.aspx?n=//' | sed 's/"//' | while read -r line ; do grep -Eastward "$line " vendors.txt >> $TMP_FILE done   coil -s 'https://world wide web.ispyconnect.com/sources.aspx?alphabetic character=4' | grep -E -o 'human\.aspx\?due north=[^"]{1,}"' | sed 's/human being.aspx?n=//' | sed 'due south/"//' | while read -r line ; do grep -E "$line " vendors.txt >> $TMP_FILE done   gyre -s 'https://www.ispyconnect.com/sources.aspx?letter=5' | grep -E -o 'man\.aspx\?n=[^"]{1,}"' | sed 'due south/man.aspx?n=//' | sed 'southward/"//' | while read -r line ; exercise grep -E "$line " vendors.txt >> $TMP_FILE washed   curl -southward 'https://world wide web.ispyconnect.com/sources.aspx?letter=7' | grep -E -o 'man\.aspx\?n=[^"]{i,}"' | sed 's/man.aspx?n=//' | sed 'due south/"//' | while read -r line ; do grep -Eastward "$line " vendors.txt >> $TMP_FILE done   whorl -s 'https://world wide web.ispyconnect.com/sources.aspx?letter of the alphabet=8' | grep -E -o 'man\.aspx\?due north=[^"]{1,}"' | sed 's/homo.aspx?n=//' | sed 's/"//' | while read -r line ; practice grep -E "$line " vendors.txt >> $TMP_FILE done   gyre -s 'https://www.ispyconnect.com/sources.aspx?letter=ix' | grep -Eastward -o 'man\.aspx\?n=[^"]{i,}"' | sed 'south/homo.aspx?n=//' | sed 'southward/"//' | while read -r line ; do grep -Due east "$line " vendors.txt >> $TMP_FILE done        echo 'Tenda Technology Co., Ltd.' >> $TMP_FILE #https://world wide web.google.com/search?q=Tenda+Technology+CCTV&tbm=isch repeat 'LG Innotek' >> $TMP_FILE #https://world wide web.google.com/search?q=LG+Innotek+CCTV&tbm=isch echo 'Hand Held Products Inc' >> $TMP_FILE #Handheld Thermal Cameras echo 'Wistron Neweb Corporation' >> $TMP_FILE #https://www.wnc.com.tw/index.php?action=pro_detail&id=76 echo 'HangZhou KuoHeng Technology Co.,ltd' >> $TMP_FILE #https://www.google.com/search?q=HangZhou+KuoHeng+Technology&tbm=isch repeat 'VCS Video Communication Systems AG' >> $TMP_FILE echo 'D-Link International' >> $TMP_FILE repeat 'Cisco-Linksys, LLC' >> $TMP_FILE echo 'ICP Internet Communication Payment AG' >> $TMP_FILE echo 'China Dragon Technology Limited' >> $TMP_FILE echo 'SAMSUNG TECHWIN CO.,LTD' >> $TMP_FILE echo 'Hanwha Techwin Security Vietnam' >> $TMP_FILE echo 'Beward R&D Co., Ltd.' >> $TMP_FILE echo 'Lorex Technology Inc.' >> $TMP_FILE echo 'TP-LINK TECHNOLOGIES CO.,LTD.' >> $TMP_FILE repeat 'ABUS Security-Eye GmbH & Co. KG' >> $TMP_FILE echo 'ACM Systems' >> $TMP_FILE echo 'Aztech Electronics Pte Ltd' >> $TMP_FILE echo 'Axium Technologies, Inc.' >> $TMP_FILE echo 'Ace Axis Express' >> $TMP_FILE #repeat '' >> $TMP_FILE       echo "Total vendors in the list: "`cat $TMP_FILE | wc -l` true cat $TMP_FILE | sort| uniq > $FILE echo "Unique vendors in the list: "`true cat $FILE | wc -fifty`

The code runs every bit follows:

This will create a vendors.txt file.

Statistics:

Total vendors in the list: 1665 Unique vendors in the list: 680

La imagen tiene un atributo ALT vacío; su nombre de archivo es hiddencam01.jpg

In total, 680 unique vendors were found, network security experts mention. You can then explore the list of vendors.txt and remove any unnecessary entries. For case, I noticed that many entries mention "HUAWEI TECHNOLOGIES CO., LTD", as this company besides makes mobile phones.

WiFi subconscious camera scanner using MAC addresses

At present that we have a database of hidden camera manufacturers, nosotros demand to collect MAC addresses at our reach. Nosotros will use a method that has proven successful before. The following are the commands to kickoff collecting information. Network security experts recommend consulting additional fabric if y'all do not fully understand the following instruction.

To parse the .csv file, airodump-ng needs to create information technology. To practise this, nosotros transfer the wireless menu to monitor mode. I always get-go with the following two commands and then that no process gets in the way:

sudo systemctl terminate NetworkManager sudo airmon-ng check kill

Later on that, we will put the WiFi menu in monitor mode:

sudo ip link set wlan0 down sudo iw wlan0 set monitor command sudo ip link prepare wlan0 upward

At present we run airodump-ng with the post-obit control:

sudo airodump-ng --berlin 60000 -westward /tmp/examination wlan0

If you lot are too interested in the 5 GHz band and if your wireless card supports it, you tin can run it with the following command:

sudo airodump-ng --channel 1-thirteen,36-165 --berlin 60000 -w /tmp/test wlan0

In the case, it is saved in the / home/mial/cameras-01.csv file; you become a response of 1600 lines there, and so this will not exist parsed manually.

cat /habitation/mial/cameras-01.csv | wc -l 1600

Next we will take to use a lighter script that will merely check if there is a surveillance camera around. And if so, you can run a heavier script to clarify which access points they are continued to.

Create the fc.sh file:

Copy the following code there:

#!/bin/bash   if [[ "$1" && -f "$1" ]]; and then     FILE="$1" else     echo 'Укажите .csv файл, который вы хотите проанализировать.';     echo 'Пример запуска:';     echo -eastward "\tbash fc.sh /tmp/examination-01.csv";     get out    fi   while read -r line ; do   newline="$(echo $line | grep -E '([A-Z0-ix:]{17})')"       if [ "$newline" ]; and then         MAC2=`repeat "$newline" | sed 'due south/ //m' | sed 's/-//k' | sed 's/://chiliad' | cut -c1-six`         resultshort="$(grep -i ^$MAC2 ./oui.txt)";         vendor=`echo "$resultshort" | cut -f 3`         #vendor=`echo "$resultshort" | awk -F '\t' '{print $iii}'`           if [ "$vendor" ]; then             result3=${vendor%,*}               iscamera=''             iscamera=`true cat vendors.txt | grep -i "$result3"`               if [ "$iscamera" ]; then                 echo                 repeat $newline                 echo $vendor                 repeat -e "\t\t\t\033[7mВероятно, это камера или другое устройство слежения\due east[0m"                 echo             fi         fi     fi   done < <(grep -E '([A-Za-z0-ix._: @\(\)\\=\[\{\}\"%;-]+,){5} ([A-Z0-nine:]{17})|(not associated)' $FILE | awk -F ',' '{print $ane}')

The code runs as shown beneath:

bash ./fc.sh /ПУТЬ/ДО/ФАЙЛА.csv

If the file nosotros got from airodump-ng is in /tmp/test-01.csv , then the control is as follows:

bash fc.sh /tmp/exam-01.csv

We also need a file with a database of MAC addresses and their respective manufacturers; download it to the aforementioned directory where y'all placed the fc.sh file. You must download this file before running fc.sh and all other scripts in this article:

wget http://standards-oui.ieee.org/oui/oui.txt

Nosotros gear up the downloaded file as it uses a DOS / Windows line break. In our instance, without applying the necessary corrections the grep program could not detect the line, fifty-fifty if it matches the pattern:

The script, using a database that maps manufacturers to their assigned MAC addresses (oui.txt), will determine the vendor proper noun for each MAC address collected and then cheque if this vendor is present in the list of photographic camera manufacturers from surveillance, network security experts mentioned.

The script will display the MAC address and manufacturers' names of all possible cameras. If the script didn't show anything, null was institute.

La imagen tiene un atributo ALT vacío; su nombre de archivo es hiddencam02.jpg

Call up that some vendors produce other devices besides security cameras, therefore "simulated alarms" are very likely to occur. If something is constitute, or even if the script shows a dozen devices, this does non mean that they are all hidden WiFi cameras. Outset, pay attention to the manufacturer, as these are often smartphone manufacturers.

Withal, if you observe something interesting, network security experts recommend using a script that shows which access points all the devices are connected to.

Create the findcameras.sh file:

Re-create the following code into it:

#!/bin/bash   if [[ "$i" && -f "$ane" ]]; and so     FILE="$1" else     echo 'Укажите .csv файл, который вы хотите проанализировать.';     repeat 'Пример запуска:';     repeat -eastward "\tbash findcameras.sh /tmp/test-01.csv";     go out    fi   echo -east "\033[1mВсего точек доступа: \033[0;31m`grep -E '([A-Za-z0-9._: @\(\)\\=\[\{\}\"%;-]+,){14}' $FILE | wc -l`\due east[0m" repeat -eastward "\033[1mВсего клиентов: \033[0;31m`grep -Eastward '([A-Za-z0-9._: @\(\)\\=\[\{\}\"%;-]+,){5} ([A-Z0-nine:]{17})|(not associated)' $FILE | wc -fifty`\e[0m" repeat -e "\033[1mИз них клиентов без ассоциации: \033[0;31m`grep -E '(non associated)' $FILE | wc -50`\e[0m"   echo -e "\033[0;36m\033[1mИнформация о сетях:\e[0m"   while read -r line ; do       if [ "`echo "$line" | cut -d ',' -f 14`" != " " ]; then         repeat -east "\033[1m" `echo -e "$line" | cut -d ',' -f xiv` "\e[0m"     else         repeat -e " \due east[3mне удалось получить имя сети\e[0m"     fi       fullMAC=`echo "$line" | cut -d ',' -f 1`     repeat -e "\tMAC-адрес: $fullMAC"       MAC=`echo "$fullMAC" | sed 's/ //g' | sed 's/-//k' | sed 's/://chiliad' | cut -c1-six`       effect="$(grep -i -A ane ^$MAC ./oui.txt)";        if [ "$result" ]; then         echo -eastward "\tПроизводитель: `echo "$issue" | cutting -f 3`"     else         echo -e "\tПроизводитель: \east[3mИнформация не найдена в базе данных.\eastward[0m"     fi       is5ghz=`echo "$line" | cut -d ',' -f 4 | grep -i -E '36|twoscore|44|48|52|56|threescore|64|100|104|108|112|116|120|124|128|132|136|140'`       if [ "$is5ghz" ]; then         echo -e "\t\033[0;31mРаботает на 5 ГГц!\e[0m"     fi       printonce="\tИнформация о подключённых клиентах:"       while read -r line2 ; do           clientsMAC=`repeat $line2 | grep -E "$fullMAC"`         if [ "$clientsMAC" ]; then               if [ "$printonce" ]; then                 echo -east $printonce                 printonce=''             fi               echo -e "\t\t\033[0;32m" `repeat $clientsMAC | cut -d ',' -f 1` "\due east[0m"             MAC2=`echo "$clientsMAC" | sed 's/ //g' | sed 's/-//g' | sed 'south/://g' | cut -c1-6`               result2="$(grep -i -A 1 ^$MAC2 ./oui.txt)";                if [ "$result2" ]; then                 echo -e "\t\t\tПроизводитель: `echo "$result2" | cut -f three`"                 ismobile=`echo $result2 | grep -i -E 'Olivetti|Sony|Mobile|Apple|Samsung|HUAWEI|Motorola|TCT|LG|Ragentek|Lenovo|Shenzhen|Intel|Xiaomi|zte|MEIZU'`                 warning=`echo $result2 | grep -i -Eastward 'ALFA|Intel'`                 if [ "$ismobile" ]; then                     echo -due east "\t\t\t\033[0;33mВероятно, это мобильное устройство\e[0m"                 fi                   if [ "$warning" ]; then                     echo -eastward "\t\t\t\033[0;31;5;7mУстройство может поддерживать режим монитора\due east[0m"                 fi                                                     resultshort="$(grep -i ^$MAC2 ./oui.txt)";                           vendor=`echo "$resultshort" | cut -f iii`                 if [ "$vendor" ]; then                     result3=${vendor%,*}                     iscamera=''                     iscamera=`true cat vendors.txt | grep -i "$result3"`                     if [ "$iscamera" ]; then                         repeat -eastward "\t\t\t\033[7mВероятно, это камера или другое устройство слежения\due east[0m"                     fi                 fi                                              else                 echo -e "\t\t\tПроизводитель: \e[3mИнформация не найдена в базе данных.\east[0m"             fi               probed=`repeat $line2 | cut -d ',' -f 7`               if [ "`repeat $probed | grep -E [A-Za-z0-9_\\-]+`" ]; then                 echo -eastward "\t\t\tИскал сети: $probed"             fi                  fi     done < <(grep -Due east '([A-Za-z0-nine._: @\(\)\\=\[\{\}\"%;-]+,){v} ([A-Z0-9:]{17})|(not associated)' $FILE)       done < <(grep -E '([A-Za-z0-nine._: @\(\)\\=\[\{\}\"%;-]+,){xiv}' $FILE)   echo -e "\033[0;36m\033[1mИнформация о неподключённых клиентах:\e[0m"   while read -r line2 ; do       clientsMAC=`echo $line2  | cut -d ',' -f ane`       echo -e "\033[0;31m" `echo $clientsMAC | cut -d ',' -f 1` "\east[0m"     MAC2=`echo "$clientsMAC" | sed 's/ //thou' | sed 'south/-//m' | sed 'due south/://g' | cut -c1-6`       result2="$(grep -i -A ane ^$MAC2 ./oui.txt)";       if [ "$result2" ]; then         echo -e "\tПроизводитель: `echo "$result2" | cut -f iii`"         ismobile=`repeat $result2 | grep -i -Due east 'Olivetti|Sony|Mobile|Apple|Samsung|HUAWEI|Motorola|TCT|LG|Ragentek|Lenovo|Shenzhen|Intel|Xiaomi|zte'`         warning=`echo $result2 | grep -i -Due east 'ALFA|Intel'`         if [ "$ismobile" ]; then             echo -east "\t\033[0;33mВероятно, это мобильное устройство\e[0m"         fi         if [ "$warning" ]; then             repeat -e "\t\033[0;31;5;7mУстройство может поддерживать режим монитора\e[0m"         fi                             resultshort="$(grep -i ^$MAC2 ./oui.txt)";                   vendor=`repeat "$resultshort" | cut -f 3`         if [ "$vendor" ]; then             result3=${vendor%,*}             iscamera=''             iscamera=`true cat vendors.txt | grep -i "$result3"`             if [ "$iscamera" ]; then                 echo -e "\t\t\t\033[7mВероятно, это камера или другое устройство слежения\e[0m"             fi         fi                         else         echo -east "\tПроизводитель: \eastward[3mИнформация не найдена в базе данных.\e[0m"     fi       probed=`echo $line2 | cut -d ',' -f 7`       if [ "`repeat $probed | grep -Eastward [A-Za-z0-9_\\-]+`" ]; then         repeat -east "\tИскал сети: $probed"     fi            done < <(grep -Due east '(not associated)' $FILE)

The code will run as follows:

fustigate findcameras.sh /ПУТЬ/ДО/ФАЙЛА.csv

For example:

bash findcameras.sh /tmp/test-01.csv

This script, like the previous one, requires oui.txt and vendors.txt files. Hand Held Products Inc articles both thermal imaging cameras and various barcode readers, etc. It tin can be whatever of these devices, since it is a TD from a store.

La imagen tiene un atributo ALT vacío; su nombre de archivo es hiddencam03.jpg

Wistron Neweb Corporation articles a variety of electronic products, including a very pop IP photographic camera.

La imagen tiene un atributo ALT vacío; su nombre de archivo es hiddencam04.jpg

Instead of connecting via a WiFi network, cameras can use a wired network; these cameras will non be included in the list.

Search for surveillance cameras on the local network

This method works only on networks where you can go the MAC addresses of other devices, that is, only on local networks. Scanning the Internet is useless. Amongst the LANs we often connect to we can find public WiFi access points in airports, hotels, restaurants and public transportation, etc.

Create the fcl.sh file:

Re-create the following code into information technology:

#!/bin/fustigate   if [[ "$one" ]]; then     Cyberspace="$1" else     echo 'Укажите подсеть для поиска камер наблюдения';     echo 'Пример запуска:';     repeat -e "\tbash ./fcl.sh 192.168.0.0/24";     exit    fi found=0 while read -r line ; exercise   newline=$line         if [ "$newline" ]; then         MAC2=`echo "$newline" | sed 's/ //1000' | sed 'south/-//thou' | sed 'southward/://g' | cut -c1-vi`         resultshort="$(grep -i ^$MAC2 ./oui.txt)";         vendor=`echo "$resultshort" | cut -f 3`           if [ "$vendor" ]; and so             result3=${vendor%,*}             iscamera=''             iscamera=`cat vendors.txt | grep  -i "$result3"`             if [ "$iscamera" ]; then                 echo                 echo $newline                 repeat $vendor                 echo -e "\t\t\t\033[7mВероятно, это камера или другое устройство слежения\e[0m"                 echo                 found=1             fi         fi     fi   done < <(sudo nmap -n -sn -PR -PS -PA -PU -T5 $NET | grep -Eastward -o '[A-Z0-ix:]{17}')   if [ $institute -eq 1 ]; then     sudo nmap -A $NET fi

Run it like this (remember that Nmap requires administrator privileges):

sudo bash fcl.sh СЕТЬ/МАСКА

For example:

sudo bash ./fcl.sh 192.168.0.0/24

If devices with MAC addresses from surveillance camera manufacturers are found, they volition be displayed below. Otherwise, no response will be displayed.

La imagen tiene un atributo ALT vacío; su nombre de archivo es hiddencam05.jpg

Co-ordinate to network security specialists, if at to the lowest degree i camera is constitute, another even more aggressive Nmap browse volition be launched, with consummate output of the results and so that you can see the device's IP, and it will also try to determine the version of the device, operating organization and services.

Additional scan output snippet:

|_http-title: NETSurveillance WEB 554/tcp  open up  rtsp    H264DVR rtspd 1.0 |_rtsp-methods: OPTIONS, Depict, SETUP, TEARDOWN, GET_PARAMETER, SET_PARAMETER, PLAY, PAUSE 8899/tcp open  soap    gSOAP 2.7 |_http-server-header: gSOAP/2.7

The NETSurveillance WEB heading suggests that it is a network surveillance photographic camera. Open ports 554 and 8899 pertain to IP camera specific RTSP and ONVIF services.

Conclusion

The quality of the browse is mainly adamant past the quality of the surveillance camera manufacturers list; in other words, more and better MAC accost lists are required, which is completely upwards to upstanding hacking enthusiasts.

Note that multiple vendors were added to the vendors.sh file. This information was obtained in the post-obit means:

Data captured in places where cameras are visible (stores, banks, etc.)
Googling terms like "CCTV vendor found", "vendor camera constitute", etc.

This secure material volition be of keen use to researchers and network security specialists. To run into more than works like this, visit the official platforms of the International Plant of Cyber Security (IICS).

Cyber Security Specialist with 18+ years of industry experience . Worked on the projects with AT&T, Citrix, Google, Conexant, IPolicy Networks (Tech Mahindra) and HFCL. Constantly keeping world update on the happening in Cyber Security Area.