Slovakia Finds Russian Backdoor in 279 EU-Funded Traffic Cameras
This digest was compiled by AI from multiple sources — links to the originals are below.
Slovakia's National Security Authority found backdoors in 279 NERO R-ONE high-speed traffic cameras acquired with 30 million euros in EU funds. The cameras, now disabled, contained 12 Russian-linked phone numbers enabling SMS-triggered remote access to live feeds. The Ministry of the Interior halted deployment even as the government claimed the cameras pose no credible threat.
Key Facts
- The National Security Authority found backdoors in 279 NERO R-ONE high-speed cameras.
- The cameras were acquired through a 30 million euro EU-backed modernization fund.
- SMS activation from any of 12 Russian phone numbers triggers the backdoor, granting full control of live camera feeds.
- Secure Boot was disabled on the cameras, and investigators found additional vulnerabilities in the web management portal and communication interfaces.
- Slovak media outlet Aktuality linked the cameras to Cyprus-based shell company Sodasus, which sold rebranded Russian-made CORDON PRO. M cameras.
Backdoor Discovery
The National Security Authority discovered backdoors embedded in a module of 279 NERO R-ONE high-speed cameras. The cameras were acquired through a 30 million euro European Union-backed modernization fund. The module contained 12 Russian-linked phone numbers that enable backdoor access to the country's traffic systems. SMS activation from any of these numbers triggers the backdoor, allowing hackers to access and gain full control of live camera feeds without needing a device IP or password.
Technical Vulnerabilities
Secure Boot, a standard security feature that authorizes digital software signatures before startup, was disabled on the cameras. NBU investigators, with assistance from an independent auditor, confirmed the report's findings. They cited additional vulnerabilities in the devices' web management portal and communication interface configurations. Researchers also flagged poor software security, hidden remote access, and product management mechanisms.
Supply Chain and Government Response
Slovak media outlet Aktuality linked the cameras to Cyprus-based shell company Sodasus. The company reportedly sold rebranded versions of the Russian-made CORDON PRO. M to the Slovakian government in a no-bid deal. The Ministry of the Interior halted installation and deployment of the cameras. The ministry initially denied ties between the devices and Russian manufacturer Semicon, based in St. Petersburg. Prime Minister Robert Fico's government claims the cameras pose no credible threat to the nation.
1 source
Slovakia Finds Russian Backdoor in 279 EU-Funded Traffic Cameras
