Hackers squeeze through DVR hole, break into CCTV cameras
Miscreants can copy, delete streams and even control the device
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
The digital video recorders of several CCTV video cameras are vulnerable to attacks that create a means for hackers to watch, copy or delete video streams, according to security researchers.
The researchers added that unless systems are properly firewalled, security flaws in the the firmware of the DVR platform also create a jumping-off point for attacks aimed at networks supporting these devices. The hackable CCTV devices from an estimated 19 manufacturers all use allegedly vulnerable firmware from the Guangdong, China-based firm Ray Sharp.
The issue was first exposed last week by a hacker using the handle someLuser, who discovered that commands sent to a Swann DVR of port 9000 were accepted without any authentication. The vulnerability created a straightforward means to hack into the DVR's web-based control panel. To make matters worse, the DVRs support Universal Plug And Play, making control panels externally visible on the net. Many home and small office routers enable UPnP by default. This has the effect of exposing tens of thousands of vulnerable DVRs to the net.
And to cap everything off, the Ray Sharp DVR platform stores clear-text usernames and passwords.
The litany of security problems allowed someLuser to develop a script to lift passwords which, once obtained, gives hackers control of vulnerable devices via built-in telnet servers thanks to wide open open control panel problem.
HD Moore, CTO of security tools firm Rapid7 founder of Metasploit, has collaborated with someLuser over the last week to validate his research.
"In addition to Ray Sharp, the exposures seem to affect rebranded DVR products by Swann, Lorex, URMET, KGuard, Defender, DEAPA/DSP Cop, SVAT, Zmodo, BCS, Bolide, EyeForce, Atlantis, Protectron, Greatek, Soyo, Hi-View, Cosmos, and J2000," Moore explained in a blog post. "The vulnerabilities allow for unauthenticated access to the device configuration, which includes the clear-text usernames and passwords that, once obtained, can be used to execute arbitrary system commands root through a secondary flaw in the web interface. someLuser's blog post includes a script for obtaining the clear-text passwords as well as a standalone exploit that yields a remote root shell on any vulnerable device.
"In short - this provides remote, unauthorised access to security camera recording systems," Moore concludes in a blog post that does a good job of summarising the issue.
Scans suggest 58,000 hackable video boxes across 150 countries are vulnerable to attack. The majority of exposed systems are in the US, India and Italy, said the researchers. Fixing the problem would seem to involve pushing out a firmware update.
A Metasploit module has been added that can be used to scan for vulnerable devices.
We've put out a query to Ray Sharp asking for comment on the alleged firmware flaws. We'll update this story as and when we hear more. ®
COMMENTS
That's my problem with UPnP port forwarding
That's my biggest problem with UPnP port forwarding: there simply is no control - you enable it, and any device can punch a Christmas Island-sized hole in your firewall, and there's not much you can do about it.
Had UPnP port forwarding been designed by somebody who understood and cared about systems administration, every UPnP device would have been required to have some shared secret assigned by the administrator, and the firewall would present a list of entities that requested forwarding and allow the administrator to say yeah or nay. You could even have made it more stupid-user friendly by having dedicated firewalls and and devices have a button (like the WiFi paring button) that could allow for this to be done automatically: Press the gizmo's button, press the firewall's button at the same time, done.
But that would have required the makers of UPnP port forwarding to understand the concepts of "security", "administrator", and "responsibility".
Thanks
I enabled UPnP for some testing a short while ago I got distracted during the testing and and forgot to disable.
I run a web server at home and port 80 has been the only port ever visible from my public IP address. After reading your post I remembered I still had UPnP enabled and did a quick scan. I found port 443 open to the Internet. I connected using https:mydomainname.co.uk and my NAS logon appeared in the browser window!!!
I blocked https in and out over the WAN to both the NAS box and the web server yet my NAS log on still appeared when I connected over the Internet. I disabled UPnP and 443 is no longer open. So UPnP completely ignored my firewall rules.
I have always known UPnP was a security risk, but it was a shock to discover, at least on my router, that it just bypasses the firewall.
Re: That's my problem with UPnP port forwarding
Agreed, I've never paid the slightest interest in the benefits of UPnP because the risk simply isn't worth it. The only thing I've ever done with it is disable it.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
