Digital video recorders of CCTV video cameras are vulnerable to the point where attackers could watch, copy or delete video streams, researchers found.
Unless systems end up properly firewalled, security flaws in the firmware of the DVR platform also create a jumping-off point for attacks aimed at networks supporting these devices, the researchers said. The CCTV devices from 19 manufacturers apparently all use firmware from the Guangdong, China-based firm Ray Sharp, the researchers said.
The issue first came to light last week by a hacker using the handle someLuser, who discovered that commands sent to a Swann DVR of port 9000 ended up accepted without any authentication. The vulnerability created a straightforward means to hack into the DVR’s web-based control panel. The DVRs support Universal Plug And Play, making control panels externally visible on the net. Home and small office routers enable UPnP by default. This has the effect of exposing tens of thousands of vulnerable DVRs to the net.
In addition, the Ray Sharp DVR platform stores clear-text usernames and passwords.
The security woes allowed the hacker to develop a script to lift passwords which gives attackers control of vulnerable devices via built-in telnet servers thanks to an open control panel problem.
HD Moore, CTO of security tools firm Rapid7 founder of Metasploit, has collaborated with someLuser over the last week to validate his research.
“In addition to Ray Sharp, the exposures seem to affect rebranded DVR products by Swann, Lorex, URMET, KGuard, Defender, DEAPA/DSP Cop, SVAT, Zmodo, BCS, Bolide, EyeForce, Atlantis, Protectron, Greatek, Soyo, Hi-View, Cosmos, and J2000,” Moore said in a blog post. “The vulnerabilities allow for unauthenticated access to the device configuration, which includes the clear-text usernames and passwords that, once obtained, can be used to execute arbitrary system commands root through a secondary flaw in the web interface. someLuser’s blog post includes a script for obtaining the clear-text passwords as well as a standalone exploit that yields a remote root shell on any vulnerable device.
“In short – this provides remote, unauthorized access to security camera recording systems,” Moore said in his blog post.
Scans suggest 58,000 hackable video boxes across 150 countries are vulnerable to attack. The majority of exposed systems are in the U.S., India and Italy, the researchers said. Fixing the problem would seem to involve pushing out a firmware update.