Some 175,000 Internet of Things (IoT) connected security cameras are vulnerable to hacks that would allow cybercriminals to enter a user's network, spy on the owner, or become part of a malicious botnet, according to a new report from security provider Bitdefender.
Buffer overflow vulnerabilities
The cameras are manufactured by Shenzhen Neo Electronics, a Chinese company that provides surveillance and security solutions such as sensors, alarms, and IP cameras. Researchers found several buffer overflow vulnerabilities present in two cameras studied: The iDoorbell model, and the NIP-22 model. However, it's likely that all cameras sold by the company use the same software, and are also vulnerable, the report noted.
"These vulnerabilities could allow, under certain conditions, remote code execution on the device," the report stated. "This type of vulnerability is also present on the gateway which controls the sensors and alarms." This could allow hackers to potentially disable alarms or sensors as well.
Universal Plug and Play (UPnP)
The cameras use Universal Plug and Play (UPnP) to open ports on the router, so they can be accessed from the outside world, the report stated. Using the Shodan search engine, researchers could find all cameras discoverable on the internet. They found between 100,000 and 140,000 devices when searching for the HTTP web server, and a similar number when searching for the RTSP server—both of which are vulnerable. However, researchers estimate the actual number of unique, at-risk devices is about 175,000. Researchers were able to compromise the vendor's IPTV and gateway products by remote exploitation that is easy to do due to the devices' use of UPnP.
In 2016, Bitdefender security researchers also detected multiple vulnerabilities in a number of IoT devices, including WeMo switches, LinkHub, LIFX Bulb, and the MUZO Cobblestone audio receiver.
Gartner predicts that 2017 will see 8.4 billion connected devices in use worldwide—more than the number of humans on the planet |
"This proof of concept attack confirms once again that most Internet of Things devices are trivial to exploit because of improper quality assurance at the firmware level," the report stated. "Paired with the fact that the bug affects the authentication mechanism (i.e. it does not require the user to already be authenticated to exploit the flaw) and the massive pool of affected devices, we can only imagine the impact a harvested botnet of devices might have."
Flaws in IoT security
IoT is growing in nearly every sector, from consumers to home automation to industry. Gartner predicts that 2017 will see 8.4 billion connected devices in use worldwide—more than the number of humans on the planet.
Yet IoT manufacturers constantly overlook security in most devices that land on the market, either due to the extra costs and expertise required to build in security measures, or because of the device's CPU power and battery constraints, the report stated. This creates many security loopholes and backdoors, which are especially problematic in security cameras, which can be used to enter the user's network, or for spying on their owners.
Security experts predict a rise in IoT security breaches this year, making it extremely important for manufacturers to ensure devices are secure, and for enterprise and consumer users to have proper security protocols in place.
"If not taken care of, the weak state of IoT security increases the number of vulnerabilities and attack vectors which could soon massively affect users' privacy and personal life," the report concluded
-920.jpg)
