Slovakia Finds Russian Backdoor in Roadside Speed Cameras

Slovakia's National Security Authority (NBU) has issued a warning against the use of NERO R-ONE high-speed roadside cameras. According to the agency, the devices contain a covert access mechanism: upon receiving an SMS from one of the Russian phone numbers “hardcoded” into the firmware, the camera grants access to its command shell and to the network.

The investigation began after the opposition accused the government of buying Russian-made cameras, and local media linked the deal to a Cypriot shell company that had presented forged certificates. The NBU determined that the NERO R-ONE is a rebrand of the Russian CORDON PRO.M model, manufactured by the St. Petersburg company Semicon.

A 30-Million Procurement

The cameras were purchased as part of a €30 million project to modernize the national road-monitoring system, funded with EU money. According to available information, Slovakia's Interior Ministry bought 279 devices and was preparing to install them along selected stretches of road across the country.

At first the ministry denied that the equipment was of Russian origin and insisted there was no reason to fear data theft: the cameras were supposedly meant to operate on an isolated departmental network. The NBU's technical report, however, lists not only the backdoor itself but a whole set of security flaws. The SecureBoot feature, which is supposed to verify the authenticity of the firmware, is disabled, so the origin of the microcode is in no way controlled. The management web portal contains numerous vulnerabilities. Finally, anyone who knows a device's broadcast IP address can watch its live stream without any password at all.

Rollout Suspended

After the report was published, Interior Ministry officials put the installation of the cameras on hold and promised to commission an additional review by an independent auditor to confirm the security authority's findings.

Slovakia is apparently not the only country to have bought this equipment: similar devices are reportedly already installed in Croatia, and possibly in other Eastern European countries as well. The overall lesson from this story suggests itself — surveillance cameras, especially ones watching over the roads of an entire country, are hardly something to buy from manufacturers based in states with which relations leave much to be desired.

Source: Hacker News