SMART SURVEILLANCE IN THE WILD: LOCALIZATION, INFERENCE, AND MANIPULATION OF WIRELESS CAMERAS

Abstract

Wireless security surveillance systems are now widely used in smart homes and everyday environments because they are affordable, easy to install, and capable of automated monitoring. While these systems are designed to improve safety, their dependence on wireless communication, cloud services, and embedded sensing components also creates new security and privacy risks. This dissertation studies two non-intrusive attacks against modern wireless surveillance systems: passive service-state inference and active physical-world motion deception. The first study, When Free Tier Becomes Free to Enter: A Non-Intrusive Way to Identify Security Cameras with no Cloud Subscription, shows that an attacker can determine whether a wireless security camera is operating without a paid cloud subscription by observing its external wireless traffic patterns. This attack does not require compromising the camera, joining the local network, or accessing the victim’s cloud account. However, it can still reveal important information about whether the camera is likely to record and preserve security events. The second study, PhantomMotion: Laser-Based Motion Injection Attacks on Wireless Security Surveillance Systems, shows that motion-activated surveillance systems can be deceived into reporting false motion events through carefully controlled laser stimuli. The attacker can further confirm the camera’s response by observing wireless traffic, without physically entering the monitored area. The attack is effective across multiple commercial camera systems and demonstrates a practical way to manipulate surveillance behavior without disabling the device. Together, these studies show that wireless surveillance systems can be exploited in two serious ways: they can leak sensitive information about their monitoring state, and they can be manipulated through stealthy physical-world deception. By revealing these weaknesses, this dissertation improves the understanding of surveillance-system security and highlights the need for stronger defenses against wireless side-channel inference and sensor-level deception attacks.