The two organizations that ended up in the network of the Postal Police of Milan resold on the net the images and videos stolen in private homes and changing rooms of gyms, swimming pools and dressing rooms. For 20 euros it was possible to have recordings or live images of the hacked systems 08 Jun 2022 Antonello Salerno
They "stole" the images taken by video surveillance systems inside private homes but also of the changing rooms of swimming pools and gyms or the dressing rooms of clothing stores in 10 Italian cities, putting the recordings or "live" images available to those who were willing to pay 20 euros for this illegal service. To end up in the network of the Postal Police of Milan, with the coordination of the Roman structure and the Public Prosecutor's Office of Milan, are two criminal organizations identified thanks to a judicial police operation. The accusation for the suspects, who were subjected to home and computer searches, with the seizure of the materials found, is to have set up a criminal system aimed at violating, through computer intrusions, video surveillance systems. The illegally obtained content was put on the market through social groups: a "premium" through which the administrators shared the recordings, and a "VIP" that allowed access to the live streaming of the violated video surveillance systems. Index of topics • The history of the investigations • How to defend yourself: the advice of the Postal Police The history of the investigations To start the investigation was the report of a citizen, from which a forensic analysis on the smartphone seized from one of the suspects in the context of another criminal proceeding started. For one of the two defeated organizations, the investigators have come to hypothesize the accusation of criminal association.
According to what was ascertained by the investigators, the first ring of the organizations was composed of cybercriminals who scanned the network in search of video surveillance systems connected to the Internet, and who dealt with hacking the systems and entering the networks used by the cameras, obtaining abusive access. Once in possession of the credentials to violate the systems, other operators of the same organizations cataloged the type of plant, the type of environments taken and the quality of the images, selecting the most "interesting" ones to keep under control, including bathrooms and bedrooms, to get to spy on the unwitting victims in their moments of intimacy, both in private homes and for example in hotels. Once this selection phase was completed, the credentials were passed to a third group of operators who had the task of creating real online "showcases" to sell the content on the net. According to the surveys, the organizations were also committed to reinvesting what they had achieved to improve their technological systems for future attacks. To spread the content, the hackers had chosen the "VKontakte" platform, a sort of Facebook for the Russian market, and the Telegram instant messaging system. The operation, in which the Postal Police of Naples and Catania also took part, 10 smartphones, 3 workstations, 5 laptops, 12 hard disks and capacity in the cloud were seized, for a cloud storage capacity, for a total of 50 Terabytes of available memory. All the social accounts used by the suspects and several thousand euros have also ended up under seizure, a part of which has been set aside in the form of cryptocurrencies. How to defend yourself: the advice of the Postal Police But how to defend yourself from this kind of cyber intrusions? The first step is "to rely, in the installation of video surveillance systems, on professionals of proven reliability, avoiding 'do it yourself' solutions, unless you have solid and specific technical skills – reads a note from the Postal Police – The current video surveillance systems, in fact, are in all respects computer systems connected to the internet and, as such, they are exposed to the physiological pitfalls of the network. They therefore need constant software updates to eliminate system vulnerabilities and, of course, must be configured appropriately". "For example – continues the Postal Police – it is preferable to inhibit access via the web for remote control of the cameras and opt for "peer to peer" systems via the cloud (provided, however, that we orient ourselves towards devices made by leading companies in the sector, absolutely avoiding products that can be purchased online at low cost). In addition, even if it may seem obvious and trivial, it is always recommended to change the default password for access to the configuration interface – choosing a robust one, which contains at least eight characters, with lowercase letters, uppercase letters (possibly not at the beginning), numbers and special characters – and orient the cameras so as not to frame bathrooms, bedrooms and other 'sensitive' environments for the intimacy of people ".