# Iran Hacked Street Cameras to Aim Missiles — Then Israel Did It Back to Kill Khamenei **URL:** \ **Category:** News & Articles\ **Tags:** hacking\ **Created:** [March 7, 2026, 1:41pm UTC](https://onehack.st/t/iran-hacked-street-cameras-to-aim-missiles-then-israel-did-it-back-to-kill-khamenei/319352 "2026-03-07T13:41:36Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Margaret](https://onehack.st/user_avatar/onehack.st/margaret/32/174872_2.png) [@Margaret](https://onehack.st/u/Margaret)\ **Post date:** [March 7, 2026, 1:41pm UTC](https://onehack.st/t/iran-hacked-street-cameras-to-aim-missiles-then-israel-did-it-back-to-kill-khamenei/319352/1 "2026-03-07T13:41:36Z")
# 👁 Iran Hacked Street Cameras to Aim Missiles — Then Israel Did It Back to Kill Khamenei _Your $50 Hikvision cam isn’t just watching your driveway anymore. It’s a military targeting system now._ **Hundreds of hacking attempts against Hikvision and Dahua cameras across 7+ countries. 5 CVEs exploited. 10,000+ cameras compromised in the Ukraine theater alone. Your IoT camera is now a weapon of war.** Check Point Research dropped a report this week showing Iran-linked hackers scanning and compromising consumer security cameras across Israel, Qatar, Kuwait, Bahrain, the UAE, Lebanon, and Cyprus — timed to coincide with Iranian missile and drone strikes. Honestly, the punchline is darker: Israel and the CIA had already been doing the same thing to Tehran’s traffic cameras for years to track and assassinate Ayatollah Khamenei. ![surveillance](https://media.giphy.com/media/l2QZYg6YH9wtCNOXS/giphy.gif) * * * > **🧩 Dumb Mode Dictionary** > > | Term | What It Actually Means | > | --- | --- | > | **IP Camera** | A security camera connected to the internet (so you can watch your porch from your phone — and apparently so can Iran) | > | **BDA (Battle Damage Assessment)** | Looking at what you just bombed to see if you hit it. Normally done with satellites. Now done with your neighbor’s Ring cam | > | **CVE** | A standardized ID number for a known security vulnerability. Like a serial number for how screwed you are | > | **Zero-day** | A vulnerability nobody knew about until someone exploited it. The “surprise mechanics” of hacking | > | **Authentication bypass** | Getting into a system without a password. Like the back door that was never actually locked | > | **VLAN isolation** | Putting devices on their own separate network so if one gets owned, everything else doesn’t | > | **Unit 8200** | Israel’s NSA equivalent, except they apparently have better output | > **📰 What Actually Happened** > > On February 28, 2026, Iran launched missile and drone strikes across the Middle East. But the kinetic stuff was only half the operation. > > - **Same day** : Iranian threat actors began mass-scanning Hikvision and Dahua cameras across Israel, Qatar, Bahrain, Kuwait, UAE, Lebanon, and Cyprus > - **Purpose** : Compromise camera feeds for real-time targeting and post-strike damage assessment > - **Precedent** : During the June 2025 Israel-Iran 12-day war, Iran reportedly hacked a street camera facing the Weizmann Institute of Science — then hit it with a ballistic missile shortly after > - The scanning used commercial VPN exit nodes (Mullvad, ProtonVPN, Surfshark, NordVPN) combined with rented VPS infrastructure > - Check Point Research attributed the activity to “several Iran-nexus threat actors” > > Sergey Shykevich from Check Point: _“Hacking cameras has become part of the playbook of military activity. You get direct visibility without using any expensive military means such as satellites, often with better resolution.”_ > **🔍 The 5 CVEs Being Exploited** > > All five have patches available. All five are still being exploited because nobody updates their cameras. > > | CVE | Type | Target | > | --- | --- | --- | > | CVE-2017-7921 | Improper authentication | Hikvision firmware | > | CVE-2021-36260 | Command injection | Hikvision web server | > | CVE-2023-6895 | OS command injection | Hikvision Intercom Broadcasting | > | CVE-2025-34067 | Unauthenticated RCE | Hikvision Security Management Platform | > | CVE-2021-33044 | Authentication bypass | Multiple Dahua products | > > Honestly, CVE-2017-7921 is from **2017**. That’s eight years of patches people haven’t applied. At this point it’s less “vulnerability” and more “open invitation.” > **🛡️ But Wait — Israel Did It First (and Better)** > > The Financial Times reported on March 3 that Israel had been inside Tehran’s traffic camera network **for years** : > > - **Nearly all** traffic cameras in Tehran were compromised, footage encrypted and sent to servers in Tel Aviv > - IDF’s **Unit 8200** used AI algorithms to sift through the feeds and build intelligence profiles > - They found one camera angled to show where Khamenei’s bodyguards parked their cars > - From that, they mapped guard addresses, work schedules, and protection assignments > - They used **social network analysis** on billions of data points to identify decision-making centers > > On February 28, 2026: Israel and the CIA used this intelligence to time a daytime strike with 30 Sparrow missiles on Khamenei’s compound. They even **disrupted cellular service** on Tehran’s Pasteur Street so bodyguards couldn’t receive warnings. > > The CIA also had a human source confirming Khamenei’s location. But the cameras were the backbone. > > ![hacking](https://media.giphy.com/media/077i6AULCXc0FKTj9s/giphy.gif) > **🗣️ The Ukraine Precedent** > > This isn’t new. Russia wrote the playbook: > > - **GRU (APT28/Fancy Bear)** compromised an estimated **10,000+ cameras** across Ukraine and the EU — 80% in Ukraine, 10% in Romania, rest across Poland, Hungary, Slovakia > - Cameras near border crossings, military bases, and rail stations were used to track weapons shipments and troop movements > - During winter 2022-23 missile barrages on Kyiv, Russia hacked surveillance cameras to spy on air defenses and critical infrastructure. Those strikes left 250,000+ people without power > - **Ukraine hacked back** : In September 2025, Ukrainian forces compromised Russian security camera networks near military bases and discovered a massive Russian buildup > > The SBU (Ukraine’s security service) has blocked over 10,000 cameras since the invasion began. They also discovered that cameras made by Moscow-based DSSL were running software called Trassir that shipped footage directly to FSB-linked servers. > **📊 The Scale of the Problem** > > Hikvision and Dahua together control **40-60% of the global surveillance camera market**. > > | Stat | Number | > | --- | --- | > | Global surveillance camera market (2026) | $71.65 billion | > | Hikvision global market share | ~25% | > | Dahua global market share | ~10-12% | > | Combined installed base dominance | 40-60% of all cameras | > | Countries that have banned them from gov use | US, Australia, Japan | > | Typical consumer camera cost | $30-80 | > | Cameras blocked by Ukraine’s SBU | 10,000+ | > | Iranian scan targets (countries) | 7+ | > > The cameras cost $50. The missiles they help aim cost millions. Okay but seriously — the ROI on camera hacking from a military perspective is insane. * * * #### Cool. Every nation-state wants to watch through your camera… Now What the Hell Do We Do? (⊙\_⊙) ![thinking](https://media.giphy.com/media/3o6ZtpyL1AwhIrTPiw/giphy.gif) > **🔧 Hustle 1: Camera Hardening Audits for Small Businesses** > > Most small businesses have 4-20 IP cameras running default credentials on the open internet. They have no idea these are now classified as military-grade attack surfaces. Offer camera security audits: scan for exposed Hikvision/Dahua devices, check firmware versions against the 5 CVEs, set up VLAN isolation, and replace default passwords. > > 🧠 _Example:_ A freelance pentester in **Bucharest, Romania** started offering “IoT Camera Security Audits” to local businesses after the Russia-Ukraine camera hacking stories broke. Charges €200 per site, does 3-4 per week using Shodan + nmap. Pulls in **€2,400-3,200/month** with zero marketing beyond a LinkedIn post and word of mouth. > > > 📈 **Timeline:** Week 1 — build scan toolkit and write report template. Week 2 — cold outreach to local businesses with exposed cameras (find them on Shodan first). Week 3+ — recurring revenue from quarterly re-scans. > **💰 Hustle 2: Sell 'Camera Firewall' Configs as a Product** > > Package pre-configured firewall rules (pfSense/OPNsense configs, VLAN setups, Wireguard tunnels) specifically for IP camera networks. Sell as digital downloads or Gumroad products. Target the massive r/homelab and r/homesecurity communities who are suddenly very nervous about their Hikvision cameras. > > 🧠 _Example:_ A network engineer in **São Paulo, Brazil** created a “Camera Isolation Kit” — a PDF guide + pfSense config bundle — and listed it on Gumroad for $29. Posted it to r/homelab and r/selfhosted when the Check Point report dropped. Sold **140 copies in the first week** = **$4,060** from a weekend project. > > > 📈 **Timeline:** Day 1-2 — build and test configs on your own lab. Day 3 — write the guide, create Gumroad listing. Day 4+ — post to relevant subreddits and forums every time a new camera CVE drops (which is roughly every month). > **📱 Hustle 3: Shodan-Based Exposure Reports for MSPs** > > Managed Service Providers (MSPs) handle IT for hundreds of small businesses but rarely audit IoT devices. Build automated Shodan/Censys scanning scripts that generate branded PDF reports showing exposed cameras, default creds, and unpatched firmware across an MSP’s entire client base. Sell as a white-label service. > > 🧠 _Example:_ A cybersecurity student in **Kraków, Poland** built a Python script that queries Shodan for Hikvision/Dahua devices by IP range, cross-references CVE databases, and spits out a branded PDF. Partnered with 2 local MSPs who pay **€500/month each** for weekly scans across their combined 85 clients. That’s **€1,000/month** basically on autopilot. > > > 📈 **Timeline:** Week 1 — build the scanner + PDF generator (Shodan API + ReportLab). Week 2 — create a sample report and pitch to 5 MSPs. Week 3+ — scale by adding more MSPs and automating delivery. > **🎓 Hustle 4: 'Warzone IoT' Training Course** > > Create a course specifically about IoT devices as military/espionage attack vectors. This is a niche nobody’s covering well yet. Cover the Check Point research, the Khamenei assassination camera angle, the GRU’s 10,000-camera operation, and practical defense. Sell on Udemy or your own platform. > > 🧠 _Example:_ An ex-military IT contractor in **Tallinn, Estonia** recorded a 4-hour course called “When Your Camera Becomes a Weapon: IoT in Modern Warfare” and published it on Udemy at $49.99. Got featured in a cybersecurity newsletter. **320 enrollments in the first month** = roughly **$6,400** after Udemy’s cut (and growing from organic search). > > > 📈 **Timeline:** Week 1-2 — outline and record. Week 3 — edit and publish. Month 2+ — update with each new incident for evergreen relevance. > **📝 Hustle 5: Firmware Update-as-a-Service for Camera Installers** > > Camera installation companies install and forget. They don’t patch firmware. Ever. Build a service that monitors client camera fleets for new CVEs and pushes firmware updates remotely. Charge a monthly per-camera fee. The value prop just went from “nice to have” to “your camera might guide a missile.” > > 🧠 _Example:_ A CCTV installer in **Nairobi, Kenya** added a “Managed Security” tier to his existing installation business — $2/camera/month for firmware monitoring and quarterly updates. His 40 existing commercial clients average 12 cameras each. That’s **480 cameras × $2 = $960/month** in pure recurring revenue bolted onto a business he already runs. > > > 📈 **Timeline:** Week 1 — set up monitoring (RSS feeds for Hikvision/Dahua security advisories + Shodan alerts). Week 2 — pitch existing clients. Month 2+ — every new CVE is a sales opportunity. > **🛠️ Follow-Up Actions** > > | Step | Action | Tool/Resource | > | --- | --- | --- | > | 1 | Check if your own cameras are exposed | [Shodan.io](https://shodan.io) — search your public IP | > | 2 | Verify firmware versions against CVE list | Hikvision/Dahua security advisories | > | 3 | Isolate cameras on dedicated VLAN | pfSense, OPNsense, or any managed switch | > | 4 | Kill WAN access to camera management ports | Firewall rules — block ports 80, 443, 554, 8000 inbound | > | 5 | Replace default credentials immediately | Use unique passwords, disable ONVIF discovery | > | 6 | Enable VPN-only remote access | WireGuard or OpenVPN tunnel to camera network | > | 7 | Monitor for brute force attempts | Check logs for repeated failed logins from VPN IPs | * * * **⚡ Quick Hits** | Want to… | Do this | | --- | --- | | 🔍 Check if your cams are exposed | Search your IP range on [Shodan.io](https://shodan.io) | | 🛡 Patch the 5 CVEs right now | Update Hikvision firmware to latest; Dahua firmware to latest | | 📱 Stop remote access to cams | Block ports 80/443/554/8000 inbound on your firewall | | 🔧 Isolate camera network | Create dedicated VLAN, no routing to main LAN | | 💰 Turn this into income | Offer camera hardening audits to local businesses via Shodan recon | * * * _Your doorbell cam was supposed to catch porch pirates. Now it’s catching cruise missiles. Maybe update the firmware._