Andrei Costin

Hannu Turtiainen, Andrei Costin, Timo Hamalainen

In this work, we present CCTV-Exposure -- the first CCTV-aware solution to evaluate potential privacy exposure to closed-circuit television (CCTV) cameras. The objective was to develop a toolset for quantifying human exposure to CCTV cameras from a privacy perspective. Our novel approach is trajectory analysis of the individuals, coupled with a database of geo-location mapped CCTV cameras annotated with minimal yet sufficient meta-information. For this purpose, CCTV-Exposure model based on a Global Positioning System (GPS) tracking was applied to estimate individual privacy exposure in different scenarios. The current investigation provides an application example and validation of the modeling approach. The methodology and toolset developed and implemented in this work provide time-sequence and location-sequence of the exposure events, thus making possible association of the exposure with the individual activities and cameras, and delivers main statistics on individual's exposure to CCTV cameras with high spatio-temporal resolution.

Lauri Sintonen, Hannu Turtiainen, Andrei Costin et al.

For the last several decades, the increased, widespread, unwarranted, and unaccountable use of Closed-Circuit TeleVision (CCTV) cameras globally has raised concerns about privacy risks. Additional recent features of many CCTV cameras, such as Internet of Things (IoT) connectivity and Artificial Intelligence (AI)-based facial recognition, only increase concerns among privacy advocates. Therefore, on par \emph{CCTV-aware solutions} must exist that provide privacy, safety, and cybersecurity features. We argue that an important step forward is to develop solutions addressing privacy concerns via routing and navigation systems (e.g., OpenStreetMap, Google Maps) that provide both privacy and safety options for areas where cameras are known to be present. However, at present no routing and navigation system, whether online or offline, provide corresponding CCTV-aware functionality. In this paper we introduce OSRM-CCTV -- the first and only CCTV-aware routing and navigation system designed and built for privacy, anonymity and safety applications. We validate and demonstrate the effectiveness and usability of the system on a handful of synthetic and real-world examples. To help validate our work as well as to further encourage the development and wide adoption of the system, we release OSRM-CCTV as open-source.

Tuomo Lahtinen, Lauri Sintonen, Hannu Turtiainen et al.

In order to withstand the ever-increasing invasion of privacy by CCTV cameras and technologies, on par CCTV-aware solutions must exist that provide privacy, safety, and cybersecurity features. We argue that a first important step towards such CCTV-aware solutions must be a mapping system that provides both privacy and safety routing and navigation options. To the best of our knowledge, there are no mapping nor navigation systems that support privacy and safety routing options. In this paper, we explore the feasibility of a CCTV-aware routing and navigation solution. The aim of this feasibility exploration is to understand what are the main impacts of CCTV on privacy, and what are the challenges and benefits to building such technology. We evaluate our approach on seven (7) pedestrian walking routes within the downtown area of the city of Jyvaskyla, Finland. We first map a total of 450 CCTV cameras, and then experiment with routing and navigation under several different configurations to coarsely model the possible cameras' parameters and coverage from the real-world. We report two main results. First, our preliminary findings support the overall feasibility of our approach. Second, the results also reveal a data-driven worrying reality for persons wishing to preserve their privacy/anonymity as their main living choice. When modelling cameras at their low performance end, a privacy-preserving route has on average a 1.5x distance increase when compared to generic routing. When modelling cameras at their medium-to-high performance end, a privacy-preserving route has on average a 5.0x distance increase, while in some cases there are no privacy-preserving routes possible at all. These results further support and encourage both global mapping of CCTV cameras and refinements to camera modelling and underlying technology.

Hannu Turtiainen, Andrei Costin, Tuomo Lahtinen et al.

In order to withstand the ever-increasing invasion of privacy by CCTV cameras and technologies, on par CCTV-aware solutions must exist that provide privacy, safety, and cybersecurity features. We argue that a first important step towards such CCTV-aware solutions must be a mapping system (e.g., Google Maps, OpenStreetMap) that provides both privacy and safety routing and navigation options. However, this in turn requires that the mapping system contains updated information on CCTV cameras' exact geo-location, coverage area, and possibly other meta-data (e.g., resolution, facial recognition features, operator). Such information is however missing from current mapping systems, and there are several ways to fix this. One solution is to perform CCTV camera detection on geo-location tagged images, e.g., street view imagery on various platforms, user images publicly posted in image sharing platforms such as Flickr. Unfortunately, to the best of our knowledge, there are no computer vision models for CCTV camera object detection as well as no mapping system that supports privacy and safety routing options. To close these gaps, with this paper we introduce CCTVCV -- the first and only computer vision MS COCO-compatible models that are able to accurately detect CCTV and video surveillance cameras in images and video frames. To this end, our best detectors were built using 8387 images that were manually reviewed and annotated to contain 10419 CCTV camera instances, and achieve an accuracy of up to 98.7%. Moreover, we build and evaluate multiple models, present a comprehensive comparison of their performance, and outline core challenges associated with such research.

Andrei Costin, Apostolis Zarras, Aurélien Francillon

Embedded devices are becoming more widespread, interconnected, and web-enabled than ever. However, recent studies showed that these devices are far from being secure. Moreover, many embedded systems rely on web interfaces for user interaction or administration. Unfortunately, web security is known to be difficult, and therefore the web interfaces of embedded systems represent a considerable attack surface. In this paper, we present the first fully automated framework that applies dynamic firmware analysis techniques to achieve, in a scalable manner, automated vulnerability discovery within embedded firmware images. We apply our framework to study the security of embedded web interfaces running in Commercial Off-The-Shelf (COTS) embedded devices, such as routers, DSL/cable modems, VoIP phones, IP/CCTV cameras. We introduce a methodology and implement a scalable framework for discovery of vulnerabilities in embedded web interfaces regardless of the vendor, device, or architecture. To achieve this goal, our framework performs full system emulation to achieve the execution of firmware images in a software-only environment, i.e., without involving any physical embedded devices. Then, we analyze the web interfaces within the firmware using both static and dynamic tools. We also present some interesting case-studies, and discuss the main challenges associated with the dynamic analysis of firmware images and their web interfaces and network services. The observations we make in this paper shed light on an important aspect of embedded devices which was not previously studied at a large scale. We validate our framework by testing it on 1925 firmware images from 54 different vendors. We discover important vulnerabilities in 185 firmware images, affecting nearly a quarter of vendors in our dataset. These experimental results demonstrate the effectiveness of our approach.