June 21, 2018
Over 400 types of Axis Communications’ safety cameras contain weaknesses that might be abused by malevolent actors to interrupt and see camera footage, take complete control of the cameras, or deactivate them completely.
The safety cameras are used by several companies, including industrial companies, banks, and hotels. The weaknesses were found by the cybersecurity firm VDOO as part of its inquiry into the safety of IoT appliances.
If an attacker was capable to locate the IP address of the cameras, three of the weaknesses might be abused together to distantly hack and get access to the cameras – to be precise evade verification (CVE-2018-10661), send requests like root (CVE-2018-10662), and insert shell orders (CVE-2018-10660).
Altogether, seven weaknesses were found. The remaining four might be abused to disable or crash the cameras and get data from the memory.
A lot of firms have their safety cameras directly interfacing with the Internet, which would make an attack easy to succeed. An attacker would only be needed to find the appliances using an unfussy Internet scanner, after which an attack could be carried out extremely rapidly.
Cameras with an open port would need that port to be identified before an attack could be carried out, although that would not pose too much of a problem for an expert hacker. Even if the cameras are safeguarded behind a firewall, and insider might easily pull off an attack.
VDOO has circulated proof-of-concept code and an explanation of the attack and has listed the weak models and firmware types. No proof has been disclosed to indicate the faults are presently being abused in the wild, however, users must take action quickly to make sure the weaknesses are not abused.
VDOO is advising all users of susceptible Axis Communications safety cameras to upgrade to the latest type of firmware to rectify the faults. In instances where there is no available firmware update, users must find the cameras behind firewalls and block port 80 and 443 and avoid the cameras from starting any outbound links.
This is not the first time that the Axis Communications’ cameras have been found to be susceptible. A third-party part was found to be susceptible by Senrio, which similarly let distant code execution if the fault was abused.
VDOO also lately found specific Foscam cameras had weaknesses that might easily be abused distantly. Those weaknesses have now been repaired.
VDOO informs that its latest research has emphasized numerous areas where camera producers are making it too easy for weaknesses to be found an abused, such as the lack of privilege separation, lack of correct input purification, lack of binary firmware encryption and too much use of shell writings.