Exploiting Security Cameras with Infrared LEDs - Part One

A few years ago I read a Boing Boing article covering how infrared LEDs could be used to hide the identity of individuals from security cameras. The described method allows one to render their face unrecognizable to many cameras.

This article was written six years ago and as a security professional I couldn't help but wonder, "Have camera manufacturers compensated for this issue since then? Can the cameras that protect the areas and Information Security assets I am charged with guarding be exploited by this type of vulnerability?"

Only one way to find out! Build a test rig, protocol for testing, and test camera that will allow me to evaluate cameras that may be vulnerable to the described exploit. Part One will focus on the build of the testing unit and Part Two will focus on testing and findings. (Including easier ways to perform these tests if you don't want to or can't build a test device yourself. I wanted a permanent tool for testing.)

 

IR based security camera obfusctaor

"Officer, he looked like a
radiant ball of glowing light."

See the build after the break


How does this work? 
Many modern security cameras have cheap infrared light filters or are specifically designed to pick up infrared light. Modern low cost "night vision" security cameras use a technique that floods an area with infrared light and then picks up that light to achieve "night vision". A security camera that has a ring of LEDs around it likely has "night vision". This feature opens these cameras up to being blinded by a strong infrared light pointed back at them. The cameras have no way to differentiate between their "night vision" and infrared light attempting to hide the identity of a individual.

The Build

For this build I purchased a 5 LED Cap Light from Harbor Freight for $6.00 USD. This model already has a form factor that attaches to a baseball cap. There are cheaper options on Amazon or other online re-sellers.








LEDs - The most important part of the build. These are 850nm IR LEDs from Sparkfun.com. There are other wavelengths available (specifically 950nm). The 850nm are recommended for this project versus the 950nm as they have a better potential for overwhelming the CCD. The ten pack cost about $12.00 USD with shipping to the United States.






The problem with testing IR LEDs is our stupid human eyes can't see infrared. This is easily overcome with a cheap webcam. The one pictured is a $15.00 USD model. It was buried in the "random electronics I can't throw away because I may be able to hack them up later" box. Turning a old webcam into a IR enabled webcam is pretty straight forward. Open the camera and remove the lens from in front of the CCD. On the back of the lens you are looking for a small square piece of glass. This is the infrared filter. Remove it. You may have to pry it off, it my crack a little, that is OK. (You are wearing eye protection, right? Very good.) You can see the square piece of glass I removed on the silver ring of the outside camera housing in this photo. Your webcam disassembly may very. A better tutorial can be found here.

Now to make sure the camera works. Here you can see me holding an IR LED between my fingers and a CR 2032 coin cell battery. Success! The camera can now see the infrared light.

Now is as good a time as any to talk about resistors. This build has a noticeable lack of resistors. The build uses five LEDs and two CR 2032 coin cell batteries. As such no resistors are needed as it has little chance of burning out the LEDs. If we want more power, we will need resistors. A good resistor tutorial can be found here.

Breaking apart the LED flashlight: There is not much to explain or see here. Gently pry open the case for the flashlight. I used nylon tools for opening an iPod. A butter knife may have the same result with more marring of the plastic.








A close up of the work area. I need to remove the regular boring LEDs and replace them with the new, sexy, IR LEDs.

IR LEDs coming out. Helping hands do your thing. Desoldering components is not incredibly easy, nor is it impossible. Solderwick can be used for the task or a desoldering pump. This two minute tutorial will give you some of the basics.

New LEDs going in. A solder wizard I am not, but I get the job done. These are some fairly small pads to solder. In the end, I am pleased with the result. If you have never soldered before check out Sparkfun's basic guide to through hole soldering.

New IR LEDs in and ready for assembly.













All put back together and ready for testing.













Face without IR Camera Obfuscator.











Face with IR Camera Obfuscator.










Ready for real world testing.

Part two will evaluate:

• How well the devices works against specific camera models.
• Alternate testing methods.
• Improvements to the test model.