Researchers Find Backdoors, Bugs In Sony, White Box IP Cameras

Two alerts this week about vulnerabilities in widely used IP cameras should help dispel any lingering notions about the Internet of Things (IoT) security threat being largely a consumer problem.

One of the alerts was from Austrian security firm SEC Consult, while the other was from Cybereaon.

In research published Tuesday, SEC Consult said it had found a backdoor in as many as 80 Sony IPELA Engine IP camera models.

The backdoor gives attackers a way to take complete control of vulnerable devices and use them to spy, to launch attacks on other enterprise systems, disrupt camera functionality or to make the devices part of a Mirai-like botnet.  Sony’s website shows that the cameras range in price from under $500 to over $6,000 and appear designed for monitoring purposes in commercial and industrial settings.

Sony has updated its firmware to address the issue after SEC Consult informed the company of its discovery.

“Enterprises need to view this as the canary in the coal mine for IoT security,” says Brian NeSmith, the founder and CEO of Arctic Wolf Networks. “Hacking consumer video cameras don’t pose a huge risk, but as more enterprises try to leverage IoT technology and put more devices online, they need to understand they are significantly increasing the attack surface for cyberattacks,” he cautions.

SEC Consult said it stumbled upon the issue when uploading a firmware update from a Sony IP camera into SEC’s IoT Inspector firmware analysis system.

The analysis uncovered two hardcoded passwords in the firmware, one for user administration and the other for gaining root access.  Further investigation showed the presence of two user accounts one named ‘primana’ and the other ‘debug’.

Depending on the services that are started at runtime, an attacker could use the accounts to log in via the serial port or via Secure Shell and Telnet, SEC Consult said.

The backdoor does not appear to have been installed by an unauthorized third party, according to the company. Rather Sony developers seem to have created the accounts on purpose likely in order to give them a way to debug devices or to run functionality tests on them.

Johannes Greil, head of SEC Consult’s vulnerability lab, says attackers can use the backdoor in the IP cameras to attack other systems on the network. “If an attacker successfully compromises the IP camera remotely, it can be used as a jump host to attack other internal systems, depending on the network and firewall configuration of course,” Greil says.

SEC Consult’s analysis shows that an attacker can use the backdoor ‘primana’ account to remotely target undocumented functionality within the web interface of the Sony IP cameras to enable Telnet and SSH on them.

The ‘primana’ account has access to other functionality as well such as for picture manipulation, calibrating settings for or turning the device heater on, if it has one, Greil says. Similarly, the ‘debug’ user accounts has access to undocumented functions that SEC Consult did not investigate.

Organizations using the vulnerable devices should immediately install the updated Sony firmware, he says. In addition, they should restrict access to the devices as much as possible and disallow Internet access via VLANs and firewalls, Greil says.

Cybereason’s alert meanwhile involved two zero-day bugs that it says is present in hundreds of thousands of low-cost IP cameras.

The first zero day bug enables information disclosure and authentication bypass. An attacker can exploit the flaw to basically request any file from vulnerable devices including the password people use to access the camera. So even if a user had set an extremely hard password, an attacker would simply be able to ask the device for it. The other bug enables attackers to gain root access to a vulnerable device after authenticating themselves using the password obtained.

The bugs exist in software developed by a company that assembles the cameras for so-called white box vendors who distribute the devices often without a manufacturer’s name or logo.

Cybereason did not release technical details of the flaws, or how they can be exploited because of how widespread the issue is and the difficulty involved in identifying the suppliers of the devices and getting them to update. And even if they were willing to update, the cameras are not designed to receive updates so the zero-days cannot be patched.

“The only way to guarantee that an affected camera is safe from these exploits is to throw it out,” says Amit Serper principal security researcher at Cybereason.

In comments to Dark Reading, Serper says bugs like these show its high time for organizations to stop viewing the IoT as some sort of a separate Internet. Organizations need to treat IoT devices as just other computers on the network that can have vulnerabilities and need to be protected, he says, adding that the focus, as always needs to be on security and not just price.  “People need to stop buy cheap crap, just because it is cheap,” he says.

Related stories: