Slovak Cyber Authority Uncovers Russian Backdoors and Undocumented Hardware in Speed Cameras
Slovakia's national cybersecurity agency, the NBÚ, published an advisory detailing significant security anomalies in roadside speed enforcement cameras. The investigation focused on the NERO R-ONE family from Cyprus-based SODASUS alongside Cordon-series hardware manufactured by Russia's Simicon and Croatia's NEROline. An audit requested by the Slovak Ministry of the Interior revealed marked discrepancies between the hardware documented on paper and the physical components inside the devices. Security analysts uncovered undisclosed remote access capabilities outside operator control, substandard baseline security, and measurement software that did not match declared specifications. Industry reporting from security consultant Samuel Kohen highlighted that the firmware contained 12 hardcoded Russian telephone numbers and hidden cellular communications hardware. Furthermore, raw video streams were reportedly accessible over unauthenticated RTSP endpoints to anyone with IP connectivity. While marketed under European assembly guarantees and backed by 30 million euros in EU recovery funding, the underlying systems incorporated Russian parts. The Slovak Ministry of the Interior initially rejected Russian supply chain ties before acknowledging the components and terminating agreements with supplier Soitron. The NBÚ has formally warned critical infrastructure operators across the country to verify their deployments and report any operational units for remediation.
Commentary
This incident serves as a textbook breakdown of hardware supply chain integrity and the pitfalls of relying on paper certifications. A shell company in Cyprus was enough to whitewash gear developed by Russian manufacturer Simicon into EU-funded public infrastructure projects. The technical findings—ranging from hardcoded cellular dial-back strings to unauthenticated RTSP feeds—point to intentional backdoors and total architectural negligence rather than accidental engineering bugs. Municipalities, transportation departments, and critical infrastructure operators utilizing NERO R-ONE, Cordon, or NEROline edge devices need immediate auditing and network isolation. First, traffic enforcement segments should never share routing domains with municipal or core networks, and edge camera drops must be isolated via strict 802.1X and firewall egress rules blocking outbound cellular/WAN traffic. Second, procurement workflows cannot trust assembly stamps without independent hardware tear-downs, binary firmware extraction, and thorough software bill of materials (SBOM) validation to detect rebadged blacklisted hardware.
The Quote to Remember
“12 numéros de téléphone russes codés en dur dans le firmware”
“Un certificat et une adresse à Chypre ne remplacent jamais l'audit technique du produit”