By now, most people who spend any time online know the importance of ensuring their software is up to date, using an antivirus app, and avoiding the darker corners of the internet to avoid getting infected by malware that locks your files until a ransom is paid. But don’t assume it’s just your computer being targeted. Your fancy digital camera and all your precious photos could be at risk as well.
In a report released by security firm Check Point Software Technologies for Def Con 2019, the company’s researchers used details revealed through Magic Lantern, a third-party firmware alternative for Canon DLSRs that unlocks additional functionality, to find and exploit vulnerabilities in the camera maker’s Picture Transfer Protocol that allows images to be transferred to other devices over a USB cable or Wi-Fi
As demonstrated in a video using a Canon 80D DSLR with Wi-Fi turned on, the researchers were able to install ransomware directly onto the camera. This not only encrypted the contents of its SD card, including photos and videos, but also locked the camera itself, rendering it useless until a requested ransom is paid and an unlock code is shared with the affected user.
Thankfully, Check Point didn’t have nefarious intentions with this discovery, and its Canon ransomware isn’t out in the wild. Instead, the researchers contacted Canon about the vulnerability back in late March, well ahead of the Def Con reveal, allowing the company to release a firmware update for the 80D last week.
However, a wide range of Canon cameras could potentially be at risk. It’s safe to assume someone else is going to figure out which firmware vulnerabilities were exploited here. As a result, Canon has also issued an official security advisory addressing the researchers’ discovery, advising users to avoid connecting their cameras to unsecure networks or devices, disabling their camera’s network functions when not in use, and ensuring they’ve updated to the latest firmware for their shooter.
If you use a Canon DSLR and haven’t seen a firmware update in a while, it’s probably an excellent idea to keep an eye on Canon’s support page until you do.