Slovakia Warns of Cybersecurity Risks in Speed Cameras
Connected speed cameras found vulnerable to cyber attacks and unauthorized access.
1Vulnerabilities in Speed Cameras
Slovakia's National Security Authority (NBÚ) identified serious cybersecurity vulnerabilities in certain speed camera systems. An examination of the NERO R-ONE camera system revealed discrepancies between documented and actual communication settings. Uncertainties about hardware and software origins, version inconsistencies, and weak security measures pose significant risks to public networks.
2Affected Camera Models
The warning specifically names three camera models: NERO R-ONE devices sold by Cyprus-based SODASUS, Cordon-series speed cameras made by Russia's Simicon, and Cordon-series products sold by Croatia's NEROline. These devices contain remote access functions not fully controllable by operators. The unclear provenance of both hardware and software components creates additional security concerns.
3Remote Access Threats
Pre-configured remote access and product management mechanisms in the cameras present major security risks. Normally, road cameras should be fully controllable and auditable by their owning organization. However, these devices contain management features outside complete customer control, potentially turning them into entry points for cyber attacks targeting broader infrastructure.
4Expanded Camera Capabilities
Modern speed cameras perform more than just speed measurement. They photograph vehicles, process license plate data, maintain timestamped records, and transmit information to backend systems used by authorities. Some installations may connect to mobile networks, roadside equipment, police systems, municipal platforms, or third-party maintenance services, expanding their potential attack surface.
5Potential Attack Scenarios
Compromised cameras could allow attackers to access data, alter or delete records, manipulate violation reporting, or completely disable devices. Without proper network segmentation, cameras could serve as footholds to reach other critical systems. The camera itself might not be the primary target, but rather an unlocked door to more valuable infrastructure.
6Slovak Response Measures
Slovakia's Interior Ministry removed affected equipment from pilot deployments and requested suppliers to replace non-compliant units with devices meeting Slovak and EU legal, technical and security requirements. While the Russian connection adds geopolitical context, NBÚ didn't claim every device contained proven backdoors or actively spied on users, focusing instead on identified security risks.
7Broader Implications
The warning aims to alert critical service operators about potential cybersecurity threats posed by these road cameras. Malicious actors could exploit vulnerable devices to disrupt networks, systems or services. These cameras are often inexpensive, easily overlooked, and managed by various public agencies, contractors and manufacturers, making them attractive targets.
8Critical Infrastructure Security
Smart cameras, license plate readers, parking sensors, environmental monitors, traffic lights and roadside communication systems are increasingly integrated into public infrastructure. Security checks for connected devices shouldn't rely solely on brand reputation, invoiced country of origin or vendor claims. Operators must fully understand device software, remote access mechanisms and control points to ensure proper security.
Original article: Security Affairs — Slovakya Hız Kameralarında Siber Risk Uyarısı Yaptı