Endpoint
12/7/2016
04:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Researchers Find Backdoors, Bugs In Sony, White Box IP Cameras

New vulnerabilities discovered by SEC Consult and Cybereason highight increasing IoT threat to enterprises.

Two alerts this week about vulnerabilities in widely used IP cameras should help dispel any lingering notions about the Internet of Things (IoT) security threat being largely a consumer problem.

One of the alerts was from Austrian security firm SEC Consult, while the other was from Cybereaon.

In research published Tuesday, SEC Consult said it had found a backdoor in as many as 80 Sony IPELA Engine IP camera models.

The backdoor gives attackers a way to take complete control of vulnerable devices and use them to spy, to launch attacks on other enterprise systems, disrupt camera functionality or to make the devices part of a Mirai-like botnet.  Sony’s website shows that the cameras range in price from under $500 to over $6,000 and appear designed for monitoring purposes in commercial and industrial settings.

Sony has updated its firmware to address the issue after SEC Consult informed the company of its discovery.

Enterprises need to view this as the canary in the coal mine for IoT security,” says Brian NeSmith, the founder and CEO of Arctic Wolf Networks. “Hacking consumer video cameras don’t pose a huge risk, but as more enterprises try to leverage IoT technology and put more devices online, they need to understand they are significantly increasing the attack surface for cyberattacks,” he cautions.

SEC Consult said it stumbled upon the issue when uploading a firmware update from a Sony IP camera into SEC’s IoT Inspector firmware analysis system.

The analysis uncovered two hardcoded passwords in the firmware, one for user administration and the other for gaining root access.  Further investigation showed the presence of two user accounts one named ‘primana’ and the other ‘debug’.

Depending on the services that are started at runtime, an attacker could use the accounts to log in via the serial port or via Secure Shell and Telnet, SEC Consult said.

The backdoor does not appear to have been installed by an unauthorized third party, according to the company. Rather Sony developers seem to have created the accounts on purpose likely in order to give them a way to debug devices or to run functionality tests on them.

Johannes Greil, head of SEC Consult’s vulnerability lab, says attackers can use the backdoor in the IP cameras to attack other systems on the network. “If an attacker successfully compromises the IP camera remotely, it can be used as a jump host to attack other internal systems, depending on the network and firewall configuration of course,” Greil says.

SEC Consult’s analysis shows that an attacker can use the backdoor ‘primana’ account to remotely target undocumented functionality within the web interface of the Sony IP cameras to enable Telnet and SSH on them.

The ‘primana’ account has access to other functionality as well such as for picture manipulation, calibrating settings for or turning the device heater on, if it has one, Greil says. Similarly, the ‘debug’ user accounts has access to undocumented functions that SEC Consult did not investigate.

Organizations using the vulnerable devices should immediately install the updated Sony firmware, he says. In addition, they should restrict access to the devices as much as possible and disallow Internet access via VLANs and firewalls, Greil says.

Cybereason’s alert meanwhile involved two zero-day bugs that it says is present in hundreds of thousands of low-cost IP cameras.

The first zero day bug enables information disclosure and authentication bypass. An attacker can exploit the flaw to basically request any file from vulnerable devices including the password people use to access the camera. So even if a user had set an extremely hard password, an attacker would simply be able to ask the device for it. The other bug enables attackers to gain root access to a vulnerable device after authenticating themselves using the password obtained.

The bugs exist in software developed by a company that assembles the cameras for so-called white box vendors who distribute the devices often without a manufacturer’s name or logo.

Cybereason did not release technical details of the flaws, or how they can be exploited because of how widespread the issue is and the difficulty involved in identifying the suppliers of the devices and getting them to update. And even if they were willing to update, the cameras are not designed to receive updates so the zero-days cannot be patched.

“The only way to guarantee that an affected camera is safe from these exploits is to throw it out,” says Amit Serper principal security researcher at Cybereason.

In comments to Dark Reading, Serper says bugs like these show its high time for organizations to stop viewing the IoT as some sort of a separate Internet. Organizations need to treat IoT devices as just other computers on the network that can have vulnerabilities and need to be protected, he says, adding that the focus, as always needs to be on security and not just price.  “People need to stop buy cheap crap, just because it is cheap,” he says.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
cyclepro
100%
0%
cyclepro,
User Rank: Strategist
12/8/2016 | 9:29:14 AM
Sony Camera
In the article it says that the IoT backdoor should be a lesson for people in not buying cheap items. In the case for Sony the camera's affected range in price from $500.00 to $6,000.00

Pretty cheap huh?

 
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] Assessing Cybersecurity Risk
[Strategic Security Report] Assessing Cybersecurity Risk
As cyber attackers become more sophisticated and enterprise defenses become more complex, many enterprises are faced with a complicated question: what is the risk of an IT security breach? This report delivers insight on how today's enterprises evaluate the risks they face. This report also offers a look at security professionals' concerns about a wide variety of threats, including cloud security, mobile security, and the Internet of Things.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.