A security flaw in Smart Sampa, São Paulo’s city surveillance system, reportedly enabled unauthorized access to 17,000 cameras. The issue is the second major breach involving the service to emerge in three weeks.
The latest incident follows an investigation opened by São Paulo’s Public Prosecutor’s Office in October into earlier leaks that reportedly exposed 58,000 cameras over an 11-month period. The report said compromised links to footage hosted by cloud provider Monuv remained accessible for five days before being removed.
The feeds included live views of streets where public figures including Supreme Federal Court Justice Alexandre de Moraes and former presidents Michel Temer and Fernando Henrique Cardoso live.
The newly reported vulnerability was attributed to a flaw in the source code of Sentinelx, which manages Smart Sampa’s technology platform. Files available online disclosed addresses for services used to retrieve data, potentially exposing records and links to camera streams.
Security specialist Rafaela Silva told Canaltech that the system lacked safeguards such as multi-factor authentication and separation between environments. She also said camera platforms should apply privacy masks to blur faces in video, limiting access to identifiable images to authorized personnel.
After the earlier incident, the São Paulo city government said facial recognition would be required to access Smart Sampa. In a statement to UOL, the city said the repository containing the camera links had never been public and described the leak as a criminal act. It said there was no indication of an attack on Smart Sampa and that PRODAM and the Smart City SP Consortium had hired an independent company to conduct security reviews.
Monuv, which provides the cloud service, said it maintains a security structure aligned with industry best practices.
Sources: Canaltech.