Nexar hack: hackers obtained data from car cameras and faces of passengers

A hacker has breached a database of Nexar dash cams, gaining access to over 130TB of footage, including footage of taxi passengers and other private information. The incident has dealt a serious blow to the reputation of the company, which has marketed its devices as “virtual surveillance cameras.”

According to 404 Media, it took the hacker just two hours to break into Nexar’s system. He discovered that the key to access the database was embedded in each camera and had far too many privileges. This allowed him to not only upload his own videos, but also access other users’ recordings.

The open AWS bucket held over 130TB of video. Some of the clips provided as evidence show how the cameras captured the faces of passengers in car interiors, posing a serious privacy threat.

The hacker also found a document listing the companies and organizations that had access to Nexar’s data. They include Apple, Microsoft, Amazon, Google, Niantic, Lyft, Waymo, the cities of Los Angeles and Austin, and the NYPD.

Nexar touts its dash cams as a road safety tool, offering automatic cloud uploads of incidents, AI-powered analytics, and a CityStream feature that creates a map of road conditions from anonymized footage. But it has now been revealed that the data was vulnerable.

1. This is not just a privacy issue for users, but also a potential national security threat, as the recordings could be used by foreign governments or attackers. Nexar has since removed access after the leak was reported, but the company’s credibility has been severely damaged.

2. The Nexar incident shows once again that even companies working in the security field can become weak links themselves. Users should think carefully about what data they trust with “smart” devices, and manufacturers are required to implement the highest standards of security.