Slashdot Mirror
Cheap Web Cams Can Open Permanent, Difficult-To-Spot Backdoors Into Networks
An anonymous reader writes: They might seems small and relatively insignificant, but cheap wireless web cams deployed in houses and offices (and connected to home and office networks) might just be the perfect way in for attackers. Researchers from the Vectra Threat Lab have demonstrated how easy it can be to embed a backdoor into such a web cam, with the goal of proving how IoT devices expand the attack surface of a network. They bought a consumer-grade D-Link WiFi web camera for roughly $30, and cracked it open. After installing a back-door to the Linux system that runs the camera, and then turning off the ability to update the system, they had an innocent seeming but compromised device that could be stealthily added to a network environment.
They've learned to tape over the webcam in their laptops but this? Oh man.
If you the kind of person who thinks it's a good idea to place an off-brand $20 Internet connected web cam on your network, that's probably the least of your worries.
The article mentions the d-link embeds Linux.
Is there a dd-wrt equivalent for webcams and a list of compatible models? or are these things generally tivoized?
Put ANY compromised hardware on your network, and it's no longer secure. This is news?
Yep. Everyone wants cheap. Cheap, cheap, cheap.
All questionable devices should go on a separate network segment that is isolated via a strict firewall. If I can not compile and install OpenWRT on my device, it does not go onto my main network.
If it's a random internet-connected camera that you control, you can just use it as a camera to steal passwords.
"Smart" webcams are always a risk, manufacturers insist on believing those devices should be available from the Internet and will try to use UPNP and other tricks to open themselves up for access from there. I have a need for a WiFi-enabled webcam that I can stream live-video from, but I was planning on just getting a ~$20 400MHz ARM-CPU WiFi-router with OpenWRT on it and a regular USB-webcam, and streaming the MJPEG - stream over RTP/RTSP -- since the video coming out of the camera is already encoded it doesn't require almost anything from the router's CPU to stream it as-is, and this way I have complete control over the entire stack and I control who and where the stream goes to.
In a perfect corporate environment no network equipment is trusted by default, i.e. even if you install a malicious device the network will remain secure.
Nowadays, there's no other way due to BYOD: even though some companies may explicitly forbid the use of your own devices, realistically it's nigh impossible to implement which means you cannot and mustn't trust any devices on the intranet.
If you want to know what consumer devices pose a security threat (whether cheap or expensive, webcam, router/modem or other device), just look at the list of devices that other people have loaded some version of a Linux based O/S on to. These are the devices that can be easily subverted. If your organisation is sensitive to security threats, the list of "hackable" devices should also be your list of products that should never be allowed to connect inside your company's security fence.
Of course, there's probably a "dark" list of devices that can be hacked - just not by kiddies with a simple PC. Ultimately, nobody can defend against them.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
I have a cheap Chinese made ip camera and the first thing I did was ensure that it did not have access to the Internet. Sure it can access the local network and try to do something malicious if the firmware is programmed to do so but it won't be able to phone home.
There is currently a report by a German computer magazine (no so good Google translation) where IP cameras sold by a large German supermarket chain had an awfull standard configuration in
a) Not asking for a new password for external access and
b) automatically opening (via UPnP) an existing firewall.
Seemingly even after an update there are still hundreds of these cameras reachable on-line.
So one does not have to wait for a malign party to 'crack' a camera. Insufficient security knowledge at manufacturer and user is enough.
"Limitations to this type of attack are obvious: attackers must be skilled enough to create a backdoored flash image, and find a way to deliver it to the device - either by "updating" an already deployed device, or by getting their hands on it before it's installed." ref
Yeah, I still can't get over that a 1995 era win 95 computer, minus hard drive, can cost less than one dollar to fab today. It's fucking ludicrous. Whereas, software is as expensive as ever. So, you need something to control where a webcam is aimed? Slap in an entire PC. Done.
You're buying a webcam, you're already exposing yourself.
This needed to be proved?
so I'll ask the question. Aren't there USB cameras available with sufficiently high resolution and sufficient light sensitivity to do the job? If so, couldn't one install a secure configuration of Linux on an SBC, (a Raspberry Pi perhaps), pack it into a suitable enclosure, and call the job done?
Granted, the camera might take a little longer to boot up than a purpose-built one, but in many cases that won't be much of a disadvantage. Also, non-geeks aren't going to put these things together. So maybe there's a business opportunity here to package a customized OpenWRT-based SBC with an off-the-shelf USB camera and sell 'truly secure' security cameras? Just a thought...
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
People seem to be getting lost in the weeds on this story. This issue isn't that webcams or any IoT device is a risk if it contains a backdoor. That's obvious and not new.
The real issue is that SO many of these webcams and IoT devices are intentionally exposed to the internet while having poor security and virtually no updates from the manufacturer. This leaves a plethora of devices directly exposed to the internet just waiting to be rooted by various vulnerabilities and then malicious actors have full access to your LAN.
This isn't new. But the volume has been turned way up. The number of installed devices is huge and getting bigger every day. The number of products being rushed to market by inept startups is ridiculous as is the number of companies that are failing leaving installed devices never to be updated.
And, don;t fool yourself thinking that it's only the camera management apps that are risky. Just recently an openSSH vulnerability was found, as others in the past. How many IoT devices are running vulnerable openSSH or DropBear and will never be patched?
Your super secure network is totally owned the moment some Chinese IP camera or wireless media player or TV stick phones out.
This is one reason to segregate devices and have firewall rules that control which devices can make outgoing connections. That way you can insure IoT and other devices that have no business talking to the Internet can't talk to the Internet.
I also run a monitoring job that collects MAC addresses and associated IP addresses from the router's ARP cache and reports on unexpected changes. It doesn't make it impossible to slip a device onto my network without it being noticed, but it takes a fair amount more work that the likely intruders won't be putting forth. It also helps find the MAC addresses of new equipment that doesn't like to say what it's MAC address is.
Who in their right mind leaves UPnP enabled in an internet-facing device like a router?
Did you know that it is possible to hack hard disk controller and have it dial home and leak data? Know-how is way beyond hacking web cams.
I have several 1080P Onvif china security cameras that are known to send video back to China. it is trivial to make these 100% secure and hacker proof disabling all backdoors if you have education and knowledge.
At home, I can see people having the problem as 99% of all citizens are IT Uneducated. but a business? there is ZERO excuse.
I put them on their own VLAN separate from everything else, they can only talk to the recorder PC and that PC can talk to both networks so we can view the camera streams. Camera VLAN has zero access to the internet, Recording PC that is straddling two networks has simple rules as well to prevent data leaking.
And this is the sad part. Most businesses don't have competent IT that even has the first clue about network security. Plus you should ALWAYS have no trust for any device on your network. Treat them all as hostile and only let them have what is needed to do what you want.
Businesses that don't spend money on IT that is competent deserve what they get.
Do not look at laser with remaining good eye.
If you want to know what consumer devices pose a security threat (whether cheap or expensive, webcam, router/modem or other device), just look at the list of devices that other people have loaded some version of a Linux based O/S on to. These are the devices that can be easily subverted. If your organisation is sensitive to security threats, the list of "hackable" devices should also be your list of products that should never be allowed to connect inside your company's security fence.
That's a stupid argument. The devices where it's easy to replace the firmware are also the ones that are the easiest to make sure they are secure, just replace the firmware yourself and then you can do anything you want to make it as secure as ever possible. The more closed the device is the less you can actually do to secure it!
Way to make it complicated for no reason whatsoever... why not just download the GPL licensed open source firmware from DLink, make desired modifications and compile it? The camera will happily accept custom firmware. I know because I've used this method to enable telnet access and add custom features to my DLink cameras.
This is just sensationalist bullshit. Pretty much any device can be made into an attack vector if the hacker has access to it's admin interface... no need to crack anything open.
Firmware can be found here: http://tsd.dlink.com.tw/downloads2008detail.asp
Just put a backdoor in every device. Then this government agency can just scan and remotely verify that the device is safe.
What happened?
What about services which allow you to admit houseguests with access to your network? There's already been an accusation of an AirBNB host leaving surreptitious webcams about: http://observer.com/2015/01/co... ...but it would be pretty simple for an unscrupulous guest to leave hidden cameras about to stream other guests' activities.
I predict a business model in selling modified routers or network attached devices that search for network behaviour indicating this.This is a specialised subset of IDS I guess. I could secure my own setup, but I kinda know what I'm doing, but I don't see 99% of hosts being able to do this, so get going, entrepreneurs! I could see an AirBNB API certifying LANs...