# Attacks and Preventive Measures on Video Surveillance Systems: A Review
## 4 Review and Analysis of Existing VSS Frameworks  
[PERSON], the director of security research at Checkmarx [48] has explained a critical Android vulnerability CVE-2019-2234: the attacker can access the camera peripheral of popular smartphone devices such as Samsung and Google. The attacker can exploit this vulnerability and can access the victim's location, take photos of them and their surroundings, and record audio and video without the user's knowledge or consent. Additionally, the attacker can access the memory of the phone even when it is locked, the mobile screen is turned off or when the user is using another app such as call or browsing. [PERSON] et al. [49] demonstrate the two methods to hack into a camera application and take photos of the users without their consent. These malicious applications use background services and are able to capture the images and store them temporarily on the device using standard compression techniques. [PERSON] et al. [50] present a smart optimized surveillance system integrated with a smartphone or laptop using Raspberry Pi and a PIR sensor. The paper used an algorithm named ViBE (Visual Background Extractor) for detecting unwanted movement. The system transmits the video stream to smartphones or laptops for monitoring. They used a blowfish encryption and decryption algorithm to provide security for the transmission of video files between the source and destination. [PERSON] et al. [51] studied the concept of criticality in Android permissions by analyzing the exploitation of permissions by known malware applications and their legal usage by useful applications. To measure the security risks of those malware applications, a new security model is proposed based on this analysis and the definition of large numbers of malware and benign apps. Computed risk values are most affected by the informative permissions and in turn, it gives rise to more security concerns. Two new datasets have been constructed from malicious and non-malicious Android apps and were analyzed against existing datasets to evaluate the proposed criterion. Usage pattern permissions of Android apps are changed over time to analyze the performances. A new risk measurement named \"entropy-based risk score (ERS)\" is introduced where entropy values are calculated from user applications based on the definition. As the security risk of giving permission is obtained, which can be similarly computed for Android calling as a security risk of giving permission. [PERSON] et al. [52] present the architecture of two different methods of DDoS attacks that can be carried out by botnets. The first method is completely based on a mobile botnet which takes advantage of the open Wi-Fi networks and a loophole in the mobile security which cannot blacklist the IP address which is frequently changing in the case of mobile devices. The second scenario consists of both mobile and PC, where a PC acts as a bot and acts as a proxy machine only because it has high computational ability compared to a smartphone. In both the methods and architecture, where the user presents the analysis of DNS amplification and/or TCP flooding how the proxy is initialized, mitigation, recovered and used to attack, [PERSON] et al. [53] explain the basic idea of Mirai's bot attack and the steps for executing the attack. An overview of its variants such as BrickerBot and Hajime botnet are presented. [PERSON] et al. [54] focused on security issues of frames captured by the surveillance camera by applying a background bootstrapping method, which eliminates background motion and allows for the precise estimation of salient motion. Salient motion estimation features can be measured by computing the block-level changes in current and reference frames. This motion estimation algorithm can detect even small background changes by usingimage-based temporal gradients for salient motion. VSSs capture videos in the combination of Red, Green, and Blue (RBG) format using pixel sensors with a high resolution and frequency.