Hackers can steal private pictures from your digital camera - here's how to stop it

Representative image

Modern cameras which connect to a PC via USB or WiFi networks are vulnerable to ransomware and malware attacks, according to a research report from Check Point Research. The report attributes the threat to Picture Transfer Protocol (PTP) used to transfer digital images from camera to PC.

“Since modern cameras no longer use film to capture and reproduce images, the International Imaging Industry Association devised a standardised protocol known as Picture Transfer Protocol (PTP) to transfer digital images from camera to PC. Initially focused on image transfer, this protocol has evolved to include dozens of different commands that support anything from taking a live picture to upgrading the camera’s firmware,” the report says.

For the research, Check Point used Canon’s EOS 80D DSLR camera which supports both USB and WiFi, and critical vulnerabilities in the PTP were found. Given that the protocol is standardized and embedded in other camera brands, it is fair to assume similar vulnerabilities can be found in cameras from other vendors as well.

“Any ‘smart’ device, including the DSLR camera, is susceptible to attacks,” says Eyal Itkin, Security Researcher, Check Point Software Technologies. “Cameras are no longer just connected to the USB, but to the WiFi network and its surrounding environment. This makes them more vulnerable to threats as attackers can inject ransomware into both the camera and PC it is connected to. The photos could end up being held hostage until the user pays the ransom for them to be released.”

1. Make sure your camera is using the latest firmware version, and install a patch if available.
2. Turn off the camera's WiFi when not in use.
3. When using WiFi, try using the camera as the WiFi access point (simply put, configure the camera to act as a WiFi hotspot), rather than connecting your camera to a public WiFi network.

Since it was first discovered on a Canon device, Check Point Research informed the device maker about the vulnerabilities and the companies worked together to patch them. As a result, Canon has released a patch fixing the error as part of an official security advisory.