The Plot Thickens

Before I start, let me explain that what follows is merely a musing, a contemplation of where ultimately something could lead. It might make a basis for a plotline, it arose as I was working out details for something totally unrelated that I'm planning to write.

I was musing about cameras and internet connectivity and wondering if (a) now we have cameras connected to the internet whether we now need ant-virus software on them and (b) whether taking that one step further the technology could be used to actually plant images on someone's camera and thus frame them for something?

(a) probably is the more practical question and (b) maybe a long time off as a possibility, but do we think ultimately it could be done?

John - from what I understand of your musing, you are basically asking if a camera can be hacked, or not. I'd say (at the moment) it's not possible, as there would have to be that connectivity to the internet in order to "plant" rogue software/images. If I was a hacker, I'd be more likely to write a program that surrepticiously embeds an image onto a digital card, such as an sd card. That image could then have code written to it that, upon insertion to the camera, it further embeds that image in the flash ram (if that's the part of the pcb that temporarily stores photos). As this would be done on an "ad-hoc" basis, I don't see it being worth a "script-kiddy's" time doing that on a one-to-one basis. I think their m.o. is mass infection, so such a scenario would have to infect a whole range of digital cameras, from Nikon through to Pentax, from "point and shots" through to DSLR's. Having said that, I wouldn't be at all surprised if someone's already written such code for mass infection of smartphones in that way.

Good thing is John, they wouldn't bother with Pentax, just like Tamron

What is this virus that ants can get?

Not being a technological expert, I don't see this happening. Can smart phones get viruses and non Windows tablets?

John Riley - "...and thus frame them for something?"

Like what?

I understand they can, but it's quite rare.

I've no idea, it's a hypothetical question. I suppose being somewhere someone hasn't actually been, meeting someone never actually met? Political thriller springs to mind, but it's not really the thrust of the question.

The novels of Jeff Noon ,talk about this kind of thing ...jeff...

I would have thought it was technically possible to infect anything that had access to the internet whether wired or by WiFi.

Viruses and other nasties have already been sent through the air wirelessly and can infect phones, tablets, etc. If a tablet can be infected then presumably it can pass on the 'infection' to a camera or other device that connects wirelessly to the tablet.

At the moment Pentax are a bit behind in the connectivity stakes (until the next range arrives) so it's more likely to be an issue for users of the other makes.

This whole subject matter will increase in importance though and we will likely see cases in court before the decade is out that hinge on whether or not 'incriminating'images, information etc was knowingly downloaded or was 'put there' by persons or governments unknown deliberately to 'set someone up'. This has already happened on peoples PCs and is one reason why Linux is becoming more popular as an alternative to Windows.

only thing I can add is that viruses can jump from a computer to your computer through the memory card. I copied some images at an internet cafe in london onto their machine, then onto a DVD. When I got home and inserted the card into my own machine there was an extra file on the card (the virus), which my anti-virus programme caught.
not a virus affecting the camera but I was surprised.

I don't know whether it has yet happened, but if it can be done it will be done, so the answers to both those questions will probably be "Yes".

Philip

As far as I'm aware, at the moment 'cameras' (as opposed to cameras built around Android smart devices) do not have the ability to run what we commonly call 'apps' today. That is to say they can't run a user installed program that does something different to the firmware. The firmware will probably be protected against accidental overwriting & hacking (presumably by some form of cryptographic function). Whilst it's possible for hackers to target cameras, they'll always get more milage from hacking PCs & tablets which use much more standard operating systems and carry more personal information.

The most likely way to hack a camera is to hack the firmware update mechanism and then peddle modified firmware on the net as genuine (spoofing the manufacturer site etc.). Even if you achieve the former (the hack), you still need to write the modifications into the firmware and get it to run (no small task even if you're the manufacturer). Bricking a camera would be much easier, although I suspect the code to accept firmware downloads is probably write protected by hardware (one time programmable) and the first code to run in the boot-up sequence.

If cameras appear with WIFI and much more regular (or partial upgrades - software patches) automatic web based firmware updates (like PCs), then it becomes much easier to hack/brick (and even genuine firmware updates could have bugs that cause problems).

Writing a file to an SD card via WIFI is much easier as you only have to breach the security of the Adhoc network - or whichever similar mechanism will be provided for users to share photos. Spoofing it to represent it being taken by that camera is another story though.

My Pentax EI2000 (from 2001) allows IR transission of photos from the camera to other devices like printers (not sure about other cameras?) using HPs JetSend technology.

John.

The WiFi cards will be vulnerable to a hacker wanting to load images or a virus.

If there was the will, a hacker could write a new part of the standard code for a camera - say to look for a specific image file on the card and pull that into the camera's ROM. Then at a specific time to load it onto a memory card as if it was a "new" image.

So, hack the WiFi card, load the image file, then as the camera is turned on it will load the new firmware version and that will run, looking normal until it is time to frame someone.

Complex, but if there was a need it could certainly be achieved.

Hesitate to mention other makes, but there is a thriving "hack" community for Canon - CHDK. It allows people with cheap Canon compacts to do all sorts of things, like for example getting them to save images as RAW / DNG, implementing a full intervalometer etc etc. People with basic Canon DSLRs can implement more advanced functions in them. You can also write your own code (in LUA) which can get the camera to do things which were certainly not intended by the manufacturer. You do have to deliberately overwrite the firmware, so it would be difficult to imagine it being done steathily, but it is certainly possible. This isn't a virus - this is implementing modified firmware. Once you have modified firmware and a camera with a wifi connection, uploading images does not sound too difficult.
Interesting idea, John.

Paul

It is an interesting thought. As someone who administers networks as part of my day job, having to consider threats from all sources is part of my working practise.

Keeping the technical details at a high level, a malicious program commonly referred to as a virus is much like any other program that we run: it is the actions performed by a program to meet the objectives of the author that determines whether a program is ”good” or ”bad”. A program can be transferred by any medium, whether that be a network connection or a storage device. As such, introducing a network doesn't place a device that is connected to the network at risk per se, rather it changes the risk profile and possibly (most likely probably in today's world) increases the risk of a malicious program being run.

Keeping things in perspective, cameras are not a valuable target to the writers of malicious software. Something to bear in mind though is that knowledge of secure programming techniques isn't widespread amongst the wider developer community, instead programming efforts tend to focus on functionality. Hence the code written to drive devices such as cameras isn't subjected to rigorous security testing. A recent example has been Internet-connected fridges being used to deliver spam (not the edible kind!). The software being used in the fridges has been selected purely on a cost and functional basis, with little regard to how such a network device may be protected from those with a nefarious intent and no method to maintain the operating system as new vulnerabilities are discovered.

Where does this leave our world of digital photography? As long a basic best practise is used both by designers / manufacturers of our cameras and by ourselves, we should survive the ”wild west” of the so-called dark Web and those who inhabit it. An apocalyptic future where our cameras become the eyes of networks and organisations who are up to no good may make for a good film script though. Perhaps you should write such a script and make your millions John before someone else has the same idea

Alas, I think if it wasn't thought of before, it's certainly been given away now.

Thanks for all the input guys, it's all very interesting.