Slashdot Mirror
IZON IP Cameras Riddled With Security Flaws
An anonymous reader writes "With recent action by the FTC against TRENDnet, the 'Internet of Things' has taken a sharp turn in the eyes of the public and government with regard to security. This week, Duo Security employee Mark Stanislav presented security research he did on the IZON IP camera from Stem Innovation. Through his testing, Mark found hardcoded credentials for Linux accounts (accessible by Telnet; Yes, — really), an undocumented web interface allowing for viewing a camera's stream (also with hardcoded credentials, user/user), and a variety of other failings including a lack of cryptography in most of the camera's functionality, including when uploading videos to Amazon Web Services's S3 storage." According to the above-linked article, "Contacted by The Security Ledger, Stem Innovation CTO Matt McBeth said that the IZON firmware, server system and iOS applications tested by Stanislav have since been updated, and that the research contains “inaccurate and misleading information.” Stem did not provide specific information about any inaccuracies."
WASHINGTONâ"Denying widespread claims that the franchise is being offensive or disrespectful, the Washington Redskinsâ(TM) kike owner announced Monday that he remains steadfast in his refusal to change the teamâ(TM)s derogatory name. âoeThe Redskins represent 81 years of great history and tradition, and itâ(TM)s a source of pride for our fans,â said the hook-nosed kike, stressing that the teamâ(TM)s insulting moniker is "absolutely not a racial slur by any means." "'Washington Redskins' is much more than just a name. It stands for strength, courage, and respectâ"the very values that are so intrinsic to Native American culture." The shifty-eyed hebe went on to assure fans that he will do âoeeverything in his powerâ to preserve the teamâ(TM)s proud heritage.
Who cares about izon?
You really need to worry more about dogs named Skippy.
...so do a lot of things - who gives a shit!
Do we really need a new story for each one of these?
I'll be generous and guess that IZON farmed out too much of their software development to ... wherever. Perhaps the company's principals are more hardware oriented, but it's interesting that they're now advertising for an iOS team lead.
Luke, help me take this mask off
Here's what happens... The company gets a Linux SDK from some chip vendor which works on some reference platform. This is intended for development and evaluation purposes and has many interfaces exposed, which is generally what you want for development. The producer then hires some cheap amateurish programmers to write some application code on top of the SDK to make the product do stuff. The stock kernel and filesystem is deployed as-is. No security audit is done, no unnecessary services are closed, and few things are removed from the stock SDK filesystem. It will never get fixed for any or all of the following reasons: 1) No one at the company has enough experience to lock down/strip down Linux - they just know how to write applications on-top. 2) There are deadlines and the management has a "it works, ship it!" mentality. 3) Some developer/engineer might know how to do things properly, but is so swamped with deadlines and babysitting all the juniors that it can't happen.
Oh, how many of this story fills out spots on the Public Relations Security Bingo game? I counted four. You have to refresh to get all of the possible options; there are more than fit on any one card :)
For your security, this post has been encrypted with ROT-13, twice.
Anybody that would think these systems offer any level of security is only kidding themselves. They are a simple convenience to avoid needing to set up a VPN for trivial data. I wish I could find a better solution, but for a camera that sits in the window looking at the street not especially worried.
RTSP is an access method that serveral cameras either leave open (no user/password, LevelOne PT 1060) or make optional. Check yours. Then there is Dahus which has similar telnet flaws as this IZON, and Dahua's OnVif is wide open after a reset (admin/admin is the default user/password after a reset, and users don't even know there is an onvif access method to these Dahuas). Since OnVif is over port 9988 the router needs to have the open so at least that's one mitigation, but RTSP at port 554 is often opened.
Yeah, it's sloppy and these guy's suck, but who would ever know? Why would anyone put a device like this on a network that anybody but them could access? All my shitty linux devices are protected by OpenBSD firewalls.
Until the really awfully managed company decided to outsource all of the software development to contractors. This was after wiping out the team in place before I joined. They are a very unstable company, which really favors knee-jerk decision making. I'm not surprised by any of this, the company is run by the idiot kid of a rich guy who doesn't know the first thing about tech. The hardware was well designed by the CTO, who apparently isn't able to steer the technology decisions of the company. Unfortunate. He's a good guy. But the company is ultimately helmed by the CEO, and he's a fat fucking moron.
would he be a skinny fucking moron?
I'm logged in via Telnet. root@izon #
But, when I go to port 80 or port 8080 I am not prompted for anything. Port 80 is just a base page referencing the IOS app. Port 8080 does not respond.
Any ideas on the URL for web access?
So... who's going to post a google search that will find these compromised cameras?
I lost interest when I saw it requires an iPod, iPhone, or iPad.
So the NSA forces them to put in a back door then the FTC fines them for putting in a back door. No wonder nobody wants to do do business in this country anymore.
So many things wrong with article...
I've looked at the security of many IOT devices and this is what I have to say about the Izon.
1st) the only thing that is right on the money in the article is that they are idiots for putting the Root password for telnet in the app where anyone can strings | grep for it, just dumb.
But besides that idiotic move is the Izon really as bad as the article says, comparing it to a trend-net camera?
The main difference is that the Izon does not live on the internet like most other embedded devices, there is no port forwarding, so the security risk is much different. And while there are security issues with the camera they are no different than your router or any other device on your network, if an attacker gains access to your network you have other problems.
Comparing the security of an izon to a trendnet, forscam, tp-link, sony, sparkland is unfair, since they need to live on the internet via port forwarding making them targets to search engines like shodan and default passwords.
I do however think they should fix the default password issues, but really it not any more dangerous than admin admin on your router or other internal device on your network.