Feeds

Hackers squeeze through DVR hole, break into CCTV cameras

Miscreants can copy, delete streams and even control the device

Securing Web Applications Made Simple and Scalable

The digital video recorders of several CCTV video cameras are vulnerable to attacks that create a means for hackers to watch, copy or delete video streams, according to security researchers.

The researchers added that unless systems are properly firewalled, security flaws in the the firmware of the DVR platform also create a jumping-off point for attacks aimed at networks supporting these devices. The hackable CCTV devices from an estimated 19 manufacturers all use allegedly vulnerable firmware from the Guangdong, China-based firm Ray Sharp.

The issue was first exposed last week by a hacker using the handle someLuser, who discovered that commands sent to a Swann DVR of port 9000 were accepted without any authentication. The vulnerability created a straightforward means to hack into the DVR's web-based control panel. To make matters worse, the DVRs support Universal Plug And Play, making control panels externally visible on the net. Many home and small office routers enable UPnP by default. This has the effect of exposing tens of thousands of vulnerable DVRs to the net.

And to cap everything off, the Ray Sharp DVR platform stores clear-text usernames and passwords.

The litany of security problems allowed someLuser to develop a script to lift passwords which, once obtained, gives hackers control of vulnerable devices via built-in telnet servers thanks to wide open open control panel problem.

HD Moore, CTO of security tools firm Rapid7 founder of Metasploit, has collaborated with someLuser over the last week to validate his research.

"In addition to Ray Sharp, the exposures seem to affect rebranded DVR products by Swann, Lorex, URMET, KGuard, Defender, DEAPA/DSP Cop, SVAT, Zmodo, BCS, Bolide, EyeForce, Atlantis, Protectron, Greatek, Soyo, Hi-View, Cosmos, and J2000," Moore explained in a blog post. "The vulnerabilities allow for unauthenticated access to the device configuration, which includes the clear-text usernames and passwords that, once obtained, can be used to execute arbitrary system commands root through a secondary flaw in the web interface. someLuser's blog post includes a script for obtaining the clear-text passwords as well as a standalone exploit that yields a remote root shell on any vulnerable device.

"In short - this provides remote, unauthorised access to security camera recording systems," Moore concludes in a blog post that does a good job of summarising the issue.

Scans suggest 58,000 hackable video boxes across 150 countries are vulnerable to attack. The majority of exposed systems are in the US, India and Italy, said the researchers. Fixing the problem would seem to involve pushing out a firmware update.

A Metasploit module has been added that can be used to scan for vulnerable devices.

We've put out a query to Ray Sharp asking for comment on the alleged firmware flaws. We'll update this story as and when we hear more. ®

Mobile application security vulnerability report

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you on YouPorn lately, perhaps? White House website?
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.