Suspect a hidden camera in your Airbnb or hotel? Here’s how to tell

In the years since Airbnb and its competitors have launched, there have been dozens of reports of hosts using hidden cameras to spy on their guests.

While home rental organizations like Airbnb and VRBO tell hosts that they must disclose the presence of security cameras and otherwise respect guest privacy—no monitoring, and no cameras in areas where guests would “reasonably expect privacy”—such rules and guidelines are hard to enforce, and they aren’t likely to concern hackers who find footage online.

The problem of surreptitious guest surveillance isn’t limited to home rental organizations, of course: A hotel chain was caught spying on more than 1,600 guests across 10 South Korean cities in March.

As the Internet of Things continues to balloon, Internet-connected video cameras have become the driving force behind the growth of the video camera marketplace. Research and strategy company Global Market Insights estimates that the industry will reach $20 billion by 2024, an estimated bump of more than 20 percent from 2017. And established tech leaders such as Google and Amazon.com have bought their way into the competition, with Google laying down $3.2 billion for smart-home device manufacturer Nest in 2014, and Amazon acquiring Ring for at least $1 billion in 2018.

READ MORE ON TRAVEL AND SECURITY

How to protect your data when traveling internationally
New Zealand defends its border device search policy (Q&A)
Your next flight itinerary could be easily hacked
How to securely send your personal information
How to protect yourself when using airplane Wi-Fi

Few of the lower-cost, Internet-connected surveillance cameras flooding the market are equipped with strong security technology, says Ted Harrington, executive partner at Independent Security Evaluators and organizer of the IoT Village at the DefCon hacking conference. This means that anyone who knows the camera’s Internet address or is otherwise able to hack into it can potentially view the footage it captures.

“Surveillance equipment gives attackers new ways to violate guest privacy or even guest safety,” Harrington wrote in an email to The Parallax. “Countless security researchers have shown IoT cameras and voice-activated devices to be troubled by exploitable security flaws. Look no further than IoT Village, the community movement that has found more than 300 zero-day exploits in more than 50 different types of IoT devices.”

VRBO parent company HomeAway did not respond to a request for comment.

“If a guest discovers an undisclosed camera, Airbnb will provide a full refund and rebooking assistance,” company representative Charlie Urbancic said in a statement to The Parallax.

Concerned about hidden cameras at your next home away from home? Or just want to verify where a disclosed camera is installed (and protect your privacy)? The good news for consumers is that video cameras’ physical footprint makes them detectable with a relatively lightweight mix of real-world and digital sleuthing.

Before even booking a stay, advises Shannon Morse, co-host of hacking podcast Hak5, consumers should read the home description’s fine print for a required disclosure of surveillance cameras. Even if you don’t see a disclosure, however, she recommends taking several steps after checking in.

Scanning Wi-Fi easier than it sounds

First, she advises, scan the wireless network of the guest home where you’re staying. “A lot of Airbnb hosts will give you access to a Wi-Fi network, and a lot of times, you can see if there’s anything publicly accessible on that network.”

Scanning a wireless network once required a modicum of hacking skills. Today, it’s as simple as downloading an app. Morse recommends Fing (for iPhones and Androids) or WiFi Analyzer (for Android), though there are a plethora of other network-scanning apps. Once you’re connected to the rental’s Wi-Fi network, you can use the app to see whether other devices are connected to the network.

Some apps list the Internet Protocol address of each device on the network. If a camera on the network is publicly accessible, and you navigate to its IP address in a Web browser, you could potentially see yourself on the camera—“a bit creepy,” Morse says.

Fing, for its part, generally identifies the maker and function of each device it detects on the network. Some listed devices, such as a Microsoft Xbox, will have obvious functions; others less so.

The number of connected devices listed could be an important clue as to the presence of hidden recording devices. If you see only one security camera at the door, but the app lists more than one, you might want to start searching for an interior camera. Tech-savvy hosts may also segment their Wi-Fi networks: one for guest phones and laptops, one for Internet-connected devices. Either way, it’s a good idea to conduct a physical search for a camera, Morse says.

Look for the reflection

After Wi-Fi analysis, Morse suggests turning off all the lights in a room and slowly panning your smartphone’s flashlight across it. If you see glints of light reflecting back at you from an unexpected spot, look closely for a lens.

Check for hot spots

Morse also recommends splurging a little for a heat-sensitive smartphone attachment. FLIR ($200) and Seek Thermal ($250) make a thermal imaging and infrared sensor for Androids and iPhones. Attach it to your phone, point it around a room, and you can see any device generating heat in the vicinity. It’s important to point it at ceilings and in the corners of rooms, where Internet cameras may have been hidden in smoke detectors or motion sensors.

“You have to kick off your own investigation in that house,” she says.

What to do next

If you do find hidden cameras in your rental, don’t panic, advises Matthew Hickey, co-founder and director of the cybersecurity research and training company Hacker House. But don’t indicate that you know you’re being recorded, either.

“If you find something, take pictures of it. We always say that if you are the party of surveillance, don’t let on that you know that you’re under surveillance. Don’t let the person know that you’re watching,” Hickey says.

If you discover a hidden camera in a short-term rental, check the guidelines of the company through which you made the booking, document everything, and prepare to deal with customer service. VRBO’s policies on host surveillance are not clear. Airbnb offers full refunds to guests and permanently bans hosts, but as a university professor and a New Zealand family discovered while on vacation in Europe this year, it inconsistently applies the policy.