Scare-bnb: Family finds creeper cams hidden in their weekend rental by scanning Wi-Fi A family staying at an Airbnb rental in Ireland made an unsettling discovery when they found their unit had a hidden camera livestreaming their stay. The Barker Family of Auckland New Zealand were staying at a property in Cork as part of an extended trip through Europe when they spotted a hidden camera in the living room of …
Good on the dad to do some network inspection. Let's get IT dads (or moms) in every household to make sure the kids of all the land are protected from online threats, and so they can get increasingly annoyed at their kids for torrenting the latest Game of Thrones despite the fact a firewall blocking torrent traffic was installed.
> Our original handling of this incident did not meet the high standards we set for ourselves, and we have apologized to the family and fully refunded their stay.
Funny how these firms always trot out this excuse once an issue goes public.
Add to that their standard "we take XXXX very seriously".
I see to that AirBnB still has the listing per the article with no mention of the hidden cam.
Has there been a followup such that the camera has been removed? Or who installed the camera? Could have been a previous "guest". But then who knows who installed and who's watching.
"Could have been a previous "guest". "
Occam's razor makes the likelihood very improbable.
There are plenty of stories about AirBnb properties being used for big parties and illicit activities so an owner may have wanted to add some coverage to monitor what guests were up to. In a hotel a big party would get quashed, but a rented home won't have a security officer or a front desk getting complaints from other guests. It's much easier to rent through AirBnB when you're under 18/21 too from what I've heard. Invite a few friends to split the bill and spend the weekend with a small party hoisting a few and filling the air with the smell of burning cow pats where the parents can't see and not "staying the night at Jimmy's playing xBox" as you said.
It's almost as if an organisation dedicated to enabling people to let their houses and rooms while evading potential regulations and taxes might attract less than ethical people to use it, and less than ethical people to run it.
The way things are going, it wouldn't surprise me if hotels also start doing this at a certain point. You know, to "maximise their service" making sure you don't forget to not pack that fluffy bathrobe and towels in your suitcase...
They now do, to the point of simply listing towels and robes as chargeable items (with the usual hotel upmark, of course - as with drinks, you can buy two for their price from regular trade).
It's done on the same principle as the hotel fridge: you take something, they'll charge you for it. That's also why they want your card details (other than for losing it later with millions of others to hackers, of course).
I often stay in "4 star" hotels when I ski (**), from my experience, they have simply stopped supplying them. On the occasions they do, they're far too small anyway!
** I travel with a large organised group, so we get good discounts
They'd be sued, and they'd lose. The general rule (at least in the US) is that video recording is OK as long as there isn't a reasonable expectation of privacy. It'd be hard to get a jury to agree that someone in a hotel room didn't have an expectation of privacy.
Many years ago I worked for a chain of casinos. They had cameras EVERYWHERE, except one place -- the bathrooms. We were forbidden by policy to position cameras so that they could even see inside a bathroom when the door was opened.
One odd bit of trivia -- recording AUDIO actually has stricter rules in many states, because it's covered by wiretapping law.
This post has been deleted by its author
You're not actually renting, you're using the house under license. Its an important difference -- as a renter you've got a contract as a tenant between you and the landlord. As a licensee you're allowed to occupy the place for a set period of time.
As for the kiddie porn aspect, there's two things here. First, its quite likely that the camera was placed in the family room, there's no expectation that anyone will be undressing in front of it,. Secondly, there's a surprising number of people out there who have absolutely no sexual interest in children; this whole 'can't see a naked kid, it might inflame carnal passions' thing is an American import, it doesn't belong in a mature society like the UK's used to be. Sure, you want to go after perverts but this idea that we're all a glimpse of skin away from being perverts ourselves is just an example of how backward society has become. Maybe its time to learn something from the French?
there's no expectation that anyone will be undressing in front of it
IANAL, particularly not an Irish lawyer, but in the US I believe a court would very likely find a reasonable expectation of privacy regardless of what room the camera was in. In fact, it's well-established in US jurisprudence that the reasonable expectation of privacy includes not only the interior of the home but its curtilage as well, except for areas in plain view from public property.
In principle, in the US, I suspect that if:
- a home had a back yard surrounded by a privacy fence, and
- the homeowner installed a surveillance camera with a view of the back yard, which was not immediately obvious to people in the back yard, and
- the homeowner listed the property on Airbnb
then licensees would have a plausible case for suing for invasion of privacy even for activities conducted in the back yard, and the "child pornography" argument would be viable. That is, the REoP would apply to the licensees even outside the house, in that portion of the property, because it's curtilage not in plain sight from public property.
SCOTUS has been pretty clear about how REoP attaches to curtilage, as recently as last year. Of course, with today's SCOTUS, we'd probably have Gorsuch Kahn arguing that everyone involved should be summarily executed, just on principle.
Firstly you've let it out for a commercial purpose and you're in breach of your contract with AirBnB, and that's just some of your civil law problems.
For criminal law south of the Border it's a bit more murky but there are some new laws on Voyeurism, as well as the data protection act which actually comes with some really fierce fines since the passage of GDPR. Up until recently it was hard to even prosecute someone for putting a hiding cam in a public toilet.
If you pull the same stunt north of the border however it's much clearer, the offense is voyeurism. If you film anyone in a state of undress without their knowledge in a place where they would have a reasonable expectation of privacy (it doesn't matter who owns it) you commit an offense. If you think about it, the law being indifferent to ownership makes sense otherwise for example a stepdad could secretly film his stepdaughter in the bathroom without repercussions.
It's been a while since I did anything related to my legal degree but last I checked (since we are a common law jurisdiction):
In Ireland you have 'a reasonable expectation of privacy' only within:
The company of your solicitor (different from your lawyer)
Your bathroom or bedroom
While in cinsultation with your doctor.
That's it.
Everywhere else is fair game according to Irish law.
Post GDPR ymmv.
1) Plenty of small or pinhole cameras available that would fit in a smoke alarm housing. Cameras require power, so if you are running power to the camera there wouldn't be an issue running Ethernet as well, or just use a POE camera. If you have hardwired smoke alarms then you already have mains power there, so all you have to do is tuck an Ethernet over mains adapter and the camera power supply in a small box in the wall or ceiling behind it and you're done. Absolutely no reason to use WiFi unless you are going for battery powered, and that wouldn't last you a day trying to stream a video feed. Totally unfit for purpose.
2) Many people who would be trying to do this with nefarious intent would also know enough not to put it on the same network as the guest WiFi, as the guest WiFi is the only thing the guest (meaning you, the renter) could access.
dB gamely flailed, "1) Plenty of small or pinhole cameras available that would fit in a smoke alarm housing. ..."
1) Plenty of small or pinhole cameras available that come pre-assembled in a smoke alarm housing. Designed, built, and sold as hidden cameras. Presumably many also include the smoke detector function.
1a) Wired-in Smoke Detector installation location obviously already has AC power. But not likely to have Ethernet. Ceilings are not usually prewired with Ethernet.
So we're back to Wi-Fi as being 99% true, and the suggestion of using Ethernet cable (in this case) as being almost entirely impractical for almost the entire population.
I take it you didn't read far enough into the comment to see the part about "Ethernet over mains" - or perhaps you are an American that doesn't understand what "mains" means in this context? This link should help:
http://lmgtfy.com/?q=powerline+ethernet
Additionally, in this particular situation the smoke detector was installed in a room where a smoke detector would not normally be installed. If you are going to run wire to make such an installation, then running CAT5 was well as romex isn't going to be a problem.
And by the way FING won't find the device unless it is in the same subnet, either hardwired or wireless. It can't even find devices on the same subnet if the isolation is enabled on the guest network to which you are attached.
1) My lounge has a smoke alarm. Hard-wired by the builders. To install a homeplug or similar would involve making a (relatively large) hole in the ceiling and is not practical.
2) It's quite difficult to find little IP cameras which have physical ethernet ports. I've come to the conclusion that WiFi chipsets must be cheaper than the RJ45 sockets now, so they all come with WiFi as default.
3) It sounded to me like the man of the story ran a Fing scan, which would detect anything on the same network. AirBnB hosts tend not to be techy enough to set up guest vlans or similar. Most just give you the password off the back of their ISP-supplied router.
"1a) Wired-in Smoke Detector installation location obviously already has AC power. But not likely to have Ethernet. Ceilings are not usually prewired with Ethernet."
One man's ceiling is another man's floor. Or the same man. Depends on how many floors there are. Or men.
The point is, I have Ethernet cabling running from downstairs to upstairs in my house and it passes under the floor of the main bedroom. Which also happens to be the ceiling of the living room.
True that. I've got Cat 6A running all over the show in my gaff. I figure, PoE for the doorbell & camera in the doorbell, PoE to the PTZ cameras on the underside of the soffits, PoE to all the extra WAPs that you need in a stone cottage with walls made of two feet of granite and flint. It's not too difficult to get the camera modules that run off PoE, and even if the one you want doesn't have PoE, just Palin old ethernet, you can get little PoE modules now - just match the voltage required and bingo!
It might not be a creep doing it to get off on the video, but a host who thought they would install a camera to be able to monitor their property to make sure it was not being abused, but didn't think of the consequences of having a hidden camera in their property.
You do hear stories about Airbnb properties being used for parties, escorts using them to host clients, or they just generally get trashed by the renters.
It doesn't say where the camera was installed in the article, a camera installed in the bathroom or bedroom has different connotations than one installed in the kitchen/lounge/hallway. If the camera had been installed in to protect the owners property they should have told the renters that the camera was there before they rented it and then it is up to the rents to accept that or not.
It might be quite a common thing in airbnb properties to have hidden cameras but most people wouldn't know how to detect them.
"You do hear stories about Airbnb properties being used for parties, escorts using them to host clients, or they just generally get trashed by the renters."
It seems Airbnb is yet another example of optimistic thinking: if you deliver something running you can release updates to iron out the bugs. When the bugs turn out to be consequences of not thinking things through it's not so easy to patch. Will a concealed camera be a standard fitment to Airbnb properties in the future included in the T&Cs along with non-tamper clauses?
It doesn't say where the camera was installed in the article, a camera installed in the bathroom or bedroom has different connotations than one installed in the kitchen/lounge/hallway.
The article does say that the camera was concealed in a smoke detector in the living room.
The fact that the camera was in a living area and not a bedroom or bathroom does suggest that the intention may have been to check for evidence of abuse of the property, rather than simple voyeurism.
If the camera had been installed in to protect the owners property they should have told the renters that the camera was there before they rented it and then it is up to the rents to accept that or not.
That would just put honest renters off, and ensure that anyone intending to abuse the property would know to disable the camera (or just turn off the router).
I know an AirBnB host who has put in a cam that covers the exterior of the entrance door. The cam is large, obvious and pointed out to guests.
This is accepted as many people have similar installations for their own homes.
Having a hidden camera inside the property is a whole different ballgame.
"having people stay in your private property waive privacy"
You missed the bit where they are paying, obviously. Pounds to pennies this person is running a business, it's not a private residence. And hidden cameras are generally a no-no in most situations where there is 'a reasonable expectation of privacy', e.g., curtains drawn and nobody else in the room.
They absolutely do NOT "waive privacy".
You look at any legislation about renting/leasing any space in most of the western world, and it will mention "reasonable enjoyment of privacy" or something similar. This is why when you rent a house, a landlord can't just turn up when they feel like it (or install surveillance cameras on the property!)
Guess I'm just a lawless barbarian, but I never limit myself to being naked in the bedroom. If I'm in a private living space, rented or home, I figure I can roam freely in any state of undress that's comfortable. This may shock some but I've also (gasp!) had sex in the living room from time to time. The point is that guests can be naked and/or shagging anywhere in the rental.
There's NO acceptable location for spying on a rental, or even an acceptable format. Any kind of video or audio recording is going to violate rights or laws eventually.
Final nail for the Safe Living Room idea, consider that vacation-rental sex often starts with a DVD in the LIVING ROOM. I have a small collection of such discs I found in players, forgotten in the heat of passion (or drunken haze) and left behind at checkout. No kidding.
> Guess I'm just a lawless barbarian, but I never limit myself to being naked in the bedroom.
Me too. Fortunately I'm not at risk of having my manhood exposed to the internet via a ceiling mounted spy cam because I've cunningly trained my belly to obscure it. ;-)
The guest scanned the wifi network of the house. Is this computer crime? Probably some attorney will say that it is, in fact, computer crime. But a webcam without a proper password can be considered non-GDPR compliant, so again the home owner is at fault. That's 2-1 for the guests, I suppose.
The guest scanned the wifi network of the house. Is this computer crime?
No, the fact that they could scan suggests they had been given access to the network. Alternatively, it is not illegal to scan for the presence of WiFi networks. Trying to break in and/or using them without permission, THAT is illegal and there have been convictions for it in many countries.
Just nmapping is a crime, I think
Ah, but here's your second problem: evidence. If a basic home network is set up with tools that detect and log an nmap scan, the very fact that there is traffic logging and detecting needs to have been communicated to the user, or ye olde landlord may end up aiming both barrels at his own undercarriage if he/she/it tries to report such a "crime" - after all, said user could simply have a virus infection, especially if they use Windows like +99% of home users.
Infections are now a bit more intelligent, but, for instance, the ILoveYou virus was broadcasting like a maniac while it was trying to infect other hosts on the network, that's why it was so easy to spot on simple tools like etherape, even on the other side of a switch.
Not that the world isn't replete with idiots, but I would *love* to see that one bounce around a bit in court.
AC asked, "Which software?"
Fing (for example). Details below.
'Wireshark' is generally used to monitor traffic. A highly capable tool for digging into protocols and messages. A bit much for your purpose.
'Wi-Fi Analyzer' is generally used to monitor the Wi-Fi bands. A tool to find hotspots or empty channels. These apps don't usually go deeper than that.
Fing is a simple app that shows what is connected to a given Wi-Fi router. You need to be connected to the router, then run Fing. It'll list all the other IP addresses, providing as much detail as it can. Including, sometimes, details of manufacturer and device name; which may be exactly what's needed to zero-in on this mysterious device connected to the same router.
Not saying you shouldn't also get Wireshark and Wi-Fi Analyzer, but Fing (for example) answers your requirement directly.
First of all, good on the dad for a job well done and handling the incident in a calm manner. I would have been tempted to perform a bit of vandalism, cyber or physical
The trick he missed is to see if the surveillance is active and aggressive. When I was working in a certain central European country, my colleagues and I had a fun playing find-the-cam in our hotel rooms. Clock radio and phone seemed common. TV bezel was just a given, just throw your jacket over the TV. When you had good reason to suspect, say, the dark circle on the clock face was not kwite right ... Call your mates over to show them a "really important document" kept just outside the probable field of view of the clock face. Oooh and ahh, then go out for a pint. On your return? Note the new position of the clock, phone, or whatever! Just like magic.
In the AirBNB I'd be curious to see if the smoke detector rotates to image fun times outside the FOV
Good times.
This post has been deleted by its author
Here in Australia, There are constant horror stories of airbnb owners houses getting trashed from parties or fights breaking out.
Understandable for the owner wanting to protect their property or even use footage to give to police as evidence if a fight/stabbing occurs.
Camera was not in bathroom or bedrooms so I doubt the intent was for some pervert to spy on anyone in that way.
You don't really want the camera's standing out like dog's balls if you will pardon the expression, They are likely to get smashed or covered.
But at the same time concealing them is always going to look dodgy from others point of view, Even though it's more aesthetic.
It's a catch 22, You list your place as having a security camera and no one will want to rent it, You don't have one and risk having your place trashed with no evidence.
Maybe there needs to be some perks from airbnb company for clients renting places with cameras, Along with better deals/perks on insurance for owners having cameras?
And obviously change public listings to display a symbol for having cameras or not.
Put a disclosed camera in the entryway. Doesn't stop two people trashing your place - although if you accept bookings from someone who has never booked a place before, you're a mug. In the entryway, it will discourage those who rent the place and then turn it into party central for their mates.
" if you accept bookings from someone who has never booked a place before, you're a mug"
The only time I used AirBnB the owner asked a lot of questions about who we are and why we were travelling because I didn't have any history on the service. Once she was satisfied, she accepted us and told us nobody would be home but the key was in a boot in the porch.
I would have revelled in the level of prankage this allowed. Obscure the camera with not so subtle messages taped so that it blocked the view but could still be read. Messed about with a mirror to give them some fun views of video feedback. Had fun with some of the more extreme and sweary punk I listen too. Got ketchup and a knife and re-enacted a few scenes from CSI..... After that couple of hours was over - just disconnect the damn thing.
Presumes camera was placed by owner and not a previous guest.
Wonder if it would have been found if it was storing data locally and not pushing it over the wifi. If its purpose really was to record property abuse, there would be no reason to live monitor the video. Only need to pull it off the camera if there was actual damage found.
Most "security" cameras these days seem to do just that, be connected via pretty open WiFi and no other connection options.
insecam.org (IIRC) or shodan(?) can show you the results of buying standard 'security' cameras these days. Many seem to be very helpful to the miscreants, as they can give a clear indication of when you're not home - just sit outside the house, grap the WiFi signals, look over the stream from the cameras... Then to disable the whole security system disable the router (eg change the IP it's DNS client uses to something that does't handle DNS...) and the person who has trusted in their wonderful all-singing etc security system finds out that it actually aided the crims more than it aided them.
(Must remember to get more of me meds...)
.. by, for example, accidentally pointing a laser pen at it. ?
This website explains what could happen to the camera
https://laserpointersafety.com/ilda-camera-info.html
Not that I would suggest doing it because of the faint possibility that you could damage someone's eyes, but if you don't know that the camera was there and its existence was denied by both AirBnb and the property owner, then you are unlikely to get into trouble
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
