Camera surveillance threat not detectable by rf or thermal.
by Charles Patterson, Exec Security.
When performing a sweep and searching for hidden or covert cameras, two tools that are frequently used are thermal imaging and radio signal analysis. During a recent inspection we came across a unique wireless camera system. The thing that makes these cameras different from other wireless covert cameras is that these are not detectable by rf inspection, wifi detection, or by thermal imaging.
Vuezone
The cameras are part of the Netgear Vuezone system. Netgear discontinued this product a few years ago, although many units are still in operation and they are available from a number of online retailers.
The cameras connect wirelessly to a dedicated base station, and the base station connects to the internet where the images can be stored and viewed on a computer or smart phone through a Vuezone cloud account.
There are other camera systems that work similarly to the Vuezone. Netgear has a newer system called “Arlo” which seems to work similarly. We obtained a Vuezone system for testing after finding it in the field.
Netgear Vuezone Wireless Camera with magnetic mount
Netgear Vuezone Wireless Camera
RF
Here is the trick- the cameras only transmit their rf signals while the cameras are being viewed. If the base is not actively connected and a user viewing or recording the image then there is no radio signal present. These are not Wifi IP cameras, so there is no 802.11 signature or ID.
If someone was actively watching the camera at the moment of a sweep, then you could see an rf signal. When active, the cameras transmit a spread spectrum video signal to their base unit. The base unit uses a wired ethernet connection on a local network that provides the internet access needed for viewing.
Vuezone camera active rf signal in 2.4 GHz band, can only be detected while camera is on and being viewed.
The same frequency range when the camera is off, shows only ambient Wifi signals were detected.
Thermal
Most video cameras generate a lot of heat, that makes thermal imaging a great tool for camera detection. These cameras on the other hand, will show no heat when they are idle. Again, since the camera is only transmitting during viewing, it would take a long time for it to heat up to be detectable by a thermal camera.
Vuezone camera is on, waiting to be viewed,
But thermal image shows no heat.
Batteries
The cameras are battery powered, with self contained batteries. The batteries can last up to 4 or 5 months before needing to be replaced. The battery is drained mainly while the video is active, so if the video is rarely turned on, then the batteries will last a very long time. With more frequent use the batteries would run down faster, but they still could easily last one or two weeks.
Surveillance Threat
As an eavesdropping system, they have limitations- there is no audio in these cameras, and the user must have an account registered with Netgear to view the images. The surveillance threat still exists, though. Someone could easily set up a dummy account and put them to use. In a work environment for instance, they would just need access to a wired internet port for the base station to be able to link the cameras to the cloud.
They have about a 200 to 300 foot wireless range so a camera could possibly be placed in a neighboring office or home, using a different network for internet than the network on site where the inspection is taking place. For domestic sweeps, an additional concern would exist, for example, in a divorce case where the system may have been installed prior to separation, then the partner may have left but still have access to the account for viewing, or they could have possibly hacked into the account if they could figure out the spouse’s user name and password.
The cameras are designed to mount using built in magnets that attach to a small metal dome base, but they are small and light enough that they could easily be covertly installed in drop ceilings or custom built into other objects or appliances.
Detection
To aid in detection, the sweep team should know what they look like and understand how they work. A non-linear junction detector would be able to find the electronics, and of course they could also be revealed by a thorough physical inspection. When inspecting the various pieces of computer hardware usually found in a home or office, look for the presence of the base station attached to the network. This would indicate that cameras could be nearby.
Vuezone Wireless Base Station
Another means of detection is to inspect router settings. If you can access a list of network devices attached to a router you can view the MAC addresses of all devices on the network. The Vuezone cameras all have the same starting digits in their mac address: 00:22:26:xx:xx:xx. It is a good procedure to identify all devices on the network. Any MAC address that cannot be identified could be suspicious.
Newer design, the Arlo camera and base station also by Netgear
UPDATE: 7/1/2016
On July 1, 2016, Netgear sent out a notice to all registered Vuezone users that they are shutting down the Vuezone servers as of December 2017. (Read notice here) They are recommending all of their Vuezone customers to upgrade to the Arlo system. Arlo does have a few more options but works pretty much in the same way as the Vuezone, so the threat continues.
Another UPDATE: 7/20/2016
After Netgear announced that they were shutting down the Vuezone service, they received so many complaints that they decided to keep it running. Vuezone cameras will continue to be in operation.
Also, we received a set of the Arlo cameras for testing and discovered that they do not operated the same as the Vuezone system. The Arlo cameras are Wifi cameras. The base station sets up it’s own wireless network with the cameras as clients. Thus the Arlo system is much easier to detect during regular Wifi inspections. The Vuezone system on the other hand, did not use Wifi so it would not be detectible during Wifi inspection.
Manufacturer’s websites: www.vuezone.com and www.arlo.com