Endpoint

12/7/2016
04:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Researchers Find Backdoors, Bugs In Sony, White Box IP Cameras

New vulnerabilities discovered by SEC Consult and Cybereason highight increasing IoT threat to enterprises.

Two alerts this week about vulnerabilities in widely used IP cameras should help dispel any lingering notions about the Internet of Things (IoT) security threat being largely a consumer problem.

One of the alerts was from Austrian security firm SEC Consult, while the other was from Cybereaon.

In research published Tuesday, SEC Consult said it had found a backdoor in as many as 80 Sony IPELA Engine IP camera models.

The backdoor gives attackers a way to take complete control of vulnerable devices and use them to spy, to launch attacks on other enterprise systems, disrupt camera functionality or to make the devices part of a Mirai-like botnet.  Sony’s website shows that the cameras range in price from under $500 to over $6,000 and appear designed for monitoring purposes in commercial and industrial settings.

Sony has updated its firmware to address the issue after SEC Consult informed the company of its discovery.

Enterprises need to view this as the canary in the coal mine for IoT security,” says Brian NeSmith, the founder and CEO of Arctic Wolf Networks. “Hacking consumer video cameras don’t pose a huge risk, but as more enterprises try to leverage IoT technology and put more devices online, they need to understand they are significantly increasing the attack surface for cyberattacks,” he cautions.

SEC Consult said it stumbled upon the issue when uploading a firmware update from a Sony IP camera into SEC’s IoT Inspector firmware analysis system.

The analysis uncovered two hardcoded passwords in the firmware, one for user administration and the other for gaining root access.  Further investigation showed the presence of two user accounts one named ‘primana’ and the other ‘debug’.

Depending on the services that are started at runtime, an attacker could use the accounts to log in via the serial port or via Secure Shell and Telnet, SEC Consult said.

The backdoor does not appear to have been installed by an unauthorized third party, according to the company. Rather Sony developers seem to have created the accounts on purpose likely in order to give them a way to debug devices or to run functionality tests on them.

Johannes Greil, head of SEC Consult’s vulnerability lab, says attackers can use the backdoor in the IP cameras to attack other systems on the network. “If an attacker successfully compromises the IP camera remotely, it can be used as a jump host to attack other internal systems, depending on the network and firewall configuration of course,” Greil says.

SEC Consult’s analysis shows that an attacker can use the backdoor ‘primana’ account to remotely target undocumented functionality within the web interface of the Sony IP cameras to enable Telnet and SSH on them.

The ‘primana’ account has access to other functionality as well such as for picture manipulation, calibrating settings for or turning the device heater on, if it has one, Greil says. Similarly, the ‘debug’ user accounts has access to undocumented functions that SEC Consult did not investigate.

Organizations using the vulnerable devices should immediately install the updated Sony firmware, he says. In addition, they should restrict access to the devices as much as possible and disallow Internet access via VLANs and firewalls, Greil says.

Cybereason’s alert meanwhile involved two zero-day bugs that it says is present in hundreds of thousands of low-cost IP cameras.

The first zero day bug enables information disclosure and authentication bypass. An attacker can exploit the flaw to basically request any file from vulnerable devices including the password people use to access the camera. So even if a user had set an extremely hard password, an attacker would simply be able to ask the device for it. The other bug enables attackers to gain root access to a vulnerable device after authenticating themselves using the password obtained.

The bugs exist in software developed by a company that assembles the cameras for so-called white box vendors who distribute the devices often without a manufacturer’s name or logo.

Cybereason did not release technical details of the flaws, or how they can be exploited because of how widespread the issue is and the difficulty involved in identifying the suppliers of the devices and getting them to update. And even if they were willing to update, the cameras are not designed to receive updates so the zero-days cannot be patched.

“The only way to guarantee that an affected camera is safe from these exploits is to throw it out,” says Amit Serper principal security researcher at Cybereason.

In comments to Dark Reading, Serper says bugs like these show its high time for organizations to stop viewing the IoT as some sort of a separate Internet. Organizations need to treat IoT devices as just other computers on the network that can have vulnerabilities and need to be protected, he says, adding that the focus, as always needs to be on security and not just price.  “People need to stop buy cheap crap, just because it is cheap,” he says.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
cyclepro
100%
0%
cyclepro,
User Rank: Strategist
12/8/2016 | 9:29:14 AM
Sony Camera
In the article it says that the IoT backdoor should be a lesson for people in not buying cheap items. In the case for Sony the camera's affected range in price from $500.00 to $6,000.00

Pretty cheap huh?

 
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Well, at least it isn't Mobby Dick!
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4035
PUBLISHED: 2019-03-22
IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X...
CVE-2019-4052
PUBLISHED: 2019-03-22
IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544.
CVE-2019-9648
PUBLISHED: 2019-03-22
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.
CVE-2019-9923
PUBLISHED: 2019-03-22
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
CVE-2019-9924
PUBLISHED: 2019-03-22
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.