LuxHawk.lu (+352) 27 52 67 45

← Back to knowledge

The building’s cameras against the building

Buildings and co-ownership 11 min Author : Arnaud Colin Updated : 19/09/2026

Summary

A camera or a video door entry system is a computer connected to the network: delivered with a factory password and never updated, it can be used to attack third parties (Mirai, Hikvision), accept a hidden account that survives a factory reset (Dahua) or be watched through the cloud provider (Verkada). The co-owners’ association remains responsible for footage of the common areas and the managing agent is its processor. Unique passwords, no direct exposure to the Internet, an inventory and updates entrusted to a person named in the contractor’s contract: these are the measures that emerge from the four cases.

Who are the lobby cameras filming for?

A camera in the lobby, a recorder in the plant room, a video door station at the car park entrance: this equipment has become ordinary in residential buildings and office blocks. These devices are also small computers connected to the network, delivered with a factory password, fitted with a web server and rarely updated once the installation has been signed off.

Four documented cases between 2016 and 2026 show what that implies. In two of them, cameras were used to attack third parties without their owners’ knowledge. In another, a camera vulnerability opened building door entry systems. In the last, the weakness lay with the cloud provider hosting the footage. The question that emerges for a managing agent (syndic), a property manager or a company director is not primarily technical: are my cameras filming for me or for someone else, and who answers for what they see?

Mirai, 2016: cameras enlisted with their factory password

On 20 September 2016, the website KrebsOnSecurity suffered a 620 Gbit/s denial-of-service attack; the same month, the hosting provider OVH absorbed one of at least 1.1 Tbit/s. On 14 October, the US CERT published an alert on the Mirai botnet. On 21 October, an attack on the company Dyn made Twitter, Netflix and Reddit unavailable; as the source code had been released at the end of September, Krebs does not attribute it to the original authors.

Mirai scans the Internet for cameras, recorders and routers whose Telnet service (ports 23 and 2323) is reachable, then tries a list of 62 default credentials. The documented vector is not a software flaw but factory passwords that were never changed; no CVE corresponds to it. The alert points out that the program lives only in memory — a reboot wipes it — but that the device is quickly reinfected as long as the password stays the same.

According to the US Department of Justice press release of 13 December 2017, the three authors, Paras Jha, Josiah White and Dalton Norman, pleaded guilty on 8 December 2017. At the height of its activity, the network numbered “hundreds of thousands” of devices; Krebs cites a study that counts more than 300,000, including 175,000 for the 20 September attack alone. On 18 September 2018, the sentences handed down were five years’ probation, 2,500 hours of community service, 127,000 dollars in restitution and continued cooperation with the FBI. Hundreds of thousands of camera owners had taken part, unknowingly, in attacks on third parties.

Hikvision, 2021-2024: a patch published, tens of thousands of cameras never updated

Hikvision is one of the world’s leading video surveillance manufacturers, widely present in common areas and car parks. On 18 September 2021, a researcher writing as “Watchful IP” disclosed the vulnerability CVE-2021-36260, rated 9.8 out of 10: a crafted web request, containing a command slipped into a language parameter, gives full access to the camera without a password and without any action by a user. The manufacturer published an advisory the very next day and a patch the same month; CISA issued an alert on 28 September, then added the flaw to its catalogue of exploited vulnerabilities on 10 January 2022.

On 6 December 2021, FortiGuard described Moobot, a Mirai derivative that uses this flaw to install itself on the camera and launch traffic floods. On 22 August 2022, eleven months after the patch, BleepingComputer relayed a count by the company CYFIRMA: of 285,000 servers analysed, more than 80,000 cameras remained vulnerable, in 2,300 organisations and around a hundred countries; France accounted for 2,377 of them. These are vulnerable cameras, not compromised cameras; the distinction matters.

The flaw then had a second life. The joint advisory from the FBI, CNMF and NSA of 18 September 2024 lists it among those exploited by the network known as “Raptor Train”. In March 2024, according to an FBI note of 16 December 2024, the HiatusRAT campaign was still scanning cameras and recorders for this flaw, with no compromise confirmed by that route. If exploitation continues three years after the patch, it is because the cameras are not being updated — and an update presupposes that someone has been given the responsibility.

Dahua, 2021-2026: the camera flaw opens the door entry system

At Dahua, another major manufacturer, VTO door stations and VTH indoor monitors belong to the same firmware family as the cameras and recorders. Two vulnerabilities, CVE-2021-33044 and CVE-2021-33045, discovered by the researcher Bashis and fixed in June and July 2021, make it possible to open an administrator session without a password by sending a forged login packet to the device’s service port (TCP 37777) or to its web interface. The manufacturer rates them 8.1 out of 10 in its advisory of 1 September 2021, the US NVD database 9.8; the difference lies in the estimated difficulty of exploitation.

These flaws first served a state actor. CISA added them to its catalogue on 21 August 2024, and the joint advisory AA24-249A of 5 September 2024 then established that Unit 29155 of Russian military intelligence (GRU) had exploited them against Dahua cameras in critical infrastructure.

Between 17 June and 22 July 2026, an operation known as “CameraSwarm”, which the company Hunt.io reconstructed from a working directory left accessible by its operators and described in a report published on 18 August 2026, compromised more than 14,530 Dahua devices in 35 days, by three routes: brute force on passwords (12,324 addresses), the authentication bypass of the two 2021 flaws (1,923 cameras) and abuse of the manufacturer’s cloud “P2P” relay, by targeting serial numbers (283 devices that were nonetheless not directly exposed). The affected devices include building entrance door stations; the compromises are concentrated in Ukraine and Russia, and The Hacker News reported on it the following day.

On the 1,923 cameras entered through the flaws, the attackers created a hidden account named “p2pwn”, which survives a password change and, on most firmware versions, a factory reset. A manager who had “reset the camera” after a suspicion would have handed it back to the attacker intact. Hunt.io offers no attribution; its recommendation comes down to three points: look for the “p2pwn” account, disable P2P, update the firmware. The flaws have been fixed since July 2021; the cases observed concern devices that were never updated.

Verkada, 2021: when the weakness lies with the cloud provider

Entrusting cameras and badges to a cloud service moves the problem without removing it: the building inherits its provider’s flaws. Verkada, an American company whose cameras and badge readers are managed from its platform, demonstrated as much. A security assessment carried out in February 2021 had identified critical gaps, not remedied by 8 March.

On 8 and 9 March 2021, an intruder accessed a misconfigured customer support server exposed on the Internet, found administrator credentials there and used the internal tool that lets support see the platform as any customer would, with a so-called “Super Admin” account. No product flaw, no CVE: a precaution missed during a planned update. Verkada did not notice it itself: according to the Federal Trade Commission’s complaint, the company learned of it on 9 March because the intruder had made contact with a media outlet, which contacted the company. Access was cut off in under two hours, and customers were notified within six hours.

The tally according to the incident report published by Verkada on 7 April 2021: 97 customers, or less than 2% of around 6,000, whose cameras were viewed; up to 4,530 cameras affected; 87 video archives viewed; the badge data of 8 customers. The FTC further contends that password hashes were exfiltrated, which Verkada disputes. The press, as relayed by Threatpost, named among the targets Tesla (Shanghai factory, 222 cameras), Cloudflare, Halifax Health, the Madison County jail and the Sandy Hook school. The FTC, for its part, finds that the intruder had the ability to access “more than 150,000 live cameras”, including in psychiatric hospitals and women’s health clinics.

Till Kottmann, 21, from Lucerne, whose name is associated with this intrusion, was indicted in the United States on 18 March 2021; the Department of Justice press release does not name Verkada. The sanction for the provider came three years later: the stipulated order negotiated with the FTC, announced on 30 August 2024 and subject to a judge’s approval, provides for a security programme audited by a third party for twenty years and a penalty of 2.95 million dollars, owed for the sending of more than 30 million unsolicited emails and not for the breach itself.

What this teaches a building or a co-ownership in Luxembourg

None of these cases took place in Luxembourg, and no hacking of a Luxembourg building intercom appears, as at 18 September 2026, in a first-rank source. The same equipment is nonetheless installed there.

  • Change the factory password on every camera, recorder and door station, one per device. This is the Mirai vector, and brute force remains CameraSwarm’s first route ten years later.
  • Take the devices off the Internet and isolate them. No port forwarding on the router, and no manufacturer P2P relay if it can be done without: that relay is Internet exposure in disguise. Remote access goes through a VPN, and the video network stays separate from the managing agent’s and the residents’, because a compromised camera does not break down: it keeps filming and attacks third parties.
  • Keep an inventory: every device, its firmware version, and the name of whoever is responsible for updating it. The Hikvision and Dahua flaws, fixed in 2021, were still in use in 2024, and Dahua’s in 2026.
  • Write these requirements into the contract with the video surveillance contractor: inventory delivered, unique passwords handed over to the co-owners’ association, update plan, logged remote access, removal of all access at the end of the contract.
  • After a suspicion, do not settle for a factory reset. CameraSwarm’s hidden account survives it: update the firmware, then check the list of accounts; a reboot alone cures nothing as long as the cause remains.
  • Question the cloud provider before signing: is there a support account capable of seeing every customer, and how is that access compartmentalised and logged? At Verkada, a single compromised account opened every site.
  • Decide and frame it at the general meeting. The CNPD points out that video surveillance in a co-ownership is decided at the general meeting by a majority of the members representing at least three quarters of the votes, that only the common areas may be filmed, that the co-owners’ association is the controller and that the managing agent acts as processor within the meaning of Article 28 of the GDPR.
  • Plan for notification. Lobby footage is personal data: if a third party has been able to view it, this may be a breach to be notified to the CNPD within the 72 hours provided for by the GDPR. The association and its managing agent must have decided in advance who makes that judgement and who informs the residents.

A compromised camera does not break down: it keeps filming, and nothing shows in the lobby. These incidents are not noticed; they are prevented.

Sources