{"id":29771,"date":"2025-11-27T16:41:09","date_gmt":"2025-11-27T16:41:09","guid":{"rendered":"https:\/\/www.kaspersky.co.uk\/blog\/?p=29771"},"modified":"2025-11-27T16:41:09","modified_gmt":"2025-11-27T16:41:09","slug":"dashcam-hack-botnet-on-the-wheels","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/dashcam-hack-botnet-on-the-wheels\/29771\/","title":{"rendered":"Botnets on wheels: the mass hacking of dashcams"},"content":{"rendered":"

Dashcams, popular in some countries and while illegal in others, are typically seen as insurance in case of an accident or roadside dispute. But a team of Singaporean cybersecurity researchers have a different take. They see offline (!) dashcams as a suitable foundation for\u2026 a mass surveillance system \u2014 moreover, one that can broaden automatically. They presented the details of their research at the Security Analyst Summit 2025<\/a>.<\/p>\n

The espionage potential of a dashcam<\/h2>\n

So, how can offline device be used for surveillance? Well, though it\u2019s true that most dashcams aren\u2019t equipped with a SIM card or 4G\/5G connectivity \u2014 even inexpensive models have Wi-Fi. This allows the driver\u2019s phone to connect to the device through a mobile app to adjust settings, download videos, and for other purposes. And as it turns out, many dashcams allow authentication to be bypassed, meaning a malicious actor can connect to them from their own device and then download the stored data.<\/p>\n

An attacker has a lot to gain from this. First, there\u2019s the high-resolution video, which clearly shows license plates and road signs. Some dashcam models also record the car\u2019s interior, and others feature wide-angle lenses and\/or rear-facing cameras. Second, dashcams can record audio \u2014 primarily conversations \u2014 inside the vehicle. Third, these video and audio recordings are tagged with precise timestamps and GPS tags.<\/p>\n

Therefore, by downloading data from a dashcam, someone could track the owner\u2019s movements, obtain images of the locations where they drive and park, find out what they talk about in the car, and often get photos and videos of the vehicle\u2019s passengers or people near the car. Naturally, for targeted surveillance, a hacker would need to compromise a specific dashcam, while for mass surveillance, they\u2019d need to compromise a large number of devices.<\/p>\n

Attack vectors for dashcams<\/h2>\n

The researchers began their experiments with a popular Thinkware dashcam, but quickly widenend the scope of the study to include two dozen models from 15 or so different brands.<\/p>\n

They discovered many similarities in how the different devices operate. The initial connection is typically made to a Wi-Fi access point created by the dashcam itself, using the default SSID and password from the manual.<\/p>\n

Most of the models tested by the researchers had a hardcoded password, allowing an attacker to establish a connection with them. Once connected, a hacker gains access to a familiar setup found in other IoT gadgets: an ARM processor and a lightweight Linux build. The attacker then has a whole arsenal of proven tricks to choose from to bypass the manufacturer\u2019s authentication \u2014 designed to distinguish the owner from an unauthorized user. At least one of these methods typically works:<\/p>\n