01.11.2024
2 min
1174
Given Slovak Prime Minister Robert Fico’s favorable stance toward Vladimir Putin’s Russia, the discovery of several Russian backdoors embedded in the country’s speed cameras could have put his government in an awkward position. However, Fico himself does not appear particularly concerned.
An assessment conducted by the National Security Authority (NBU), Slovakia’s cybersecurity oversight body, uncovered an undocumented module in NERO R-ONE speed cameras linked to 12 Russian phone numbers.
According to the NBU, the module functions as a backdoor capable of executing malicious code received via SMS messages from one of these Russian numbers.
Cybersecurity expert Peter Bátor said that, when combined with a password, this is enough to give an operator full remote control over the camera. He also noted that the identified numbers are linked to St. Petersburg and the Kemerovo region.
The NBU began investigating the devices following numerous reports in the Slovak media that the cameras had been purchased through a direct deal, without a public tender, from Sodasus, a Cyprus-registered shell company that used forged certificates.
The opposition party Progressive Slovakia obtained the NBU assessment through a freedom-of-information request.
The NBU conducted a security analysis of a NERO R-ONE speed camera and identified several risks, including:
questions about the true origin of the camera’s hardware and software;
discrepancies between the documented and actual configuration of the device’s communication interfaces;
preconfigured remote access and device management mechanisms whose configuration is not fully accessible to the user;
discrepancies between the declared and actual software used to process measurement results;
poor software security.
Slovakia’s Interior Ministry initially denied that the cameras were of Russian origin and claimed there was no risk of data theft. Bátor, however, maintains that the threat is serious.
“This is a very concrete example of how Russia uses the technologies it sells for espionage,”
cybersecurity expert Peter Bátor told local media.
In addition, the NBU’s technical report states that the NERO R-ONE is a rebranded version of the Russian Cordon.Pro.M speed camera, manufactured in St. Petersburg. The analysis found that the devices have serious security flaws.
In particular, the web portal used to manage the cameras contains numerous vulnerabilities. The devices also allow access to live video feeds without a password. Anyone who knows the IP address used by a camera to broadcast its feed can access it.
Installation of the cameras has now been suspended, but the opposition is calling on Fico to replace Interior Minister Matúš Šutaj Eštok. The minister himself has acknowledged the risks, while Fico maintains that the cameras pose no threat to Slovakia.
According to Slovak daily SME, Fico also suggested that modern military satellites are supposedly advanced enough to read text on a sheet of paper from orbit. However, this does not reflect the actual capabilities of satellite imagery: the kind of “zoom and enhance” functionality often depicted in movies remains fictional.
Speaking to SME, security analyst Vladimír Bednár also said that Russia has gained access to speed cameras and surveillance cameras in Ukraine to help plan attacks and assess their results.
