Verkada: 150,000 cameras, one admin login
Hackers viewed live feeds from hospitals, schools and factories through a single exposed super-admin account.
Earlier this month a group of hackers got into Verkada, a cloud security-camera company, and viewed live feeds from around 150,000 cameras: hospitals, schools, prisons, factories, Tesla and Cloudflare offices. Reports say they used super-admin credentials they found exposed on the internet.
One login with access to every customer. That’s the design flaw, more than the leaked password.
If you use cloud-managed cameras or building systems:
- Ask the vendor who on their side can see your feeds, and how that access is logged and limited.
- Turn on MFA and review users on your own account.
- Think about where cameras point. Screens, keypads and whiteboards end up on video.
- Put cameras on their own network, away from your office systems.
If you build a SaaS product: avoid god-mode accounts. Support access should be per customer, time-limited, approved and logged.