Backdoor In MVPower DVR Firmware Sends CCTV Stills To an Email Address In China (softpedia.com)

An anonymous reader writes: An IoT security research company has discovered that a DVR model manufactured by MVPower includes a backdoor-like feature in its code that takes a screenshot of your CCTV feed and sends it to an email address hosted somewhere in China. The device's firmware is based on an open source project from GitHub that was pulled by its developer when someone confronted him about the backdoor.

Comments

DUH.

[Lumpy]

All of the China crap you need to ASSUME it is riddled with backdoors and other security problems and even sending your info elsewhere. The China ONVIF security cameras are FILLED with this kind of crap.

Firewalls for the Great Wall

[The Eight-Bit Link]

Whenever I use something that connects to my network that I ordered direct from China, as a rule-of-thumb I don't let anything to or from it cross my router. I have a specific access point for anything wireless, and ports on my managed switch for anything wired.

Try google better

[Anonymous Coward]

They could not find a reference to MVPOWER???
How hard did they try?

Did they not try looking up trademarks? There is that little (R) symbol ya know....

Aukey E-Business Co. owns the trademark MVPower
Anthea Lee is registered name
Been active since 2013.

Shosho II, Ernest is the lawyers name that registered
Other company registered same people is Aglaia

The parent companies name is Aukey E-Business Co., Ltd
www.aukeys.com

LongGang
Huanan City
Shenzhen, 518111
China

Re:Default Gateway

[Aqualung812]

When in doubt, don't give it a route.

I recall some of those Kronos time card devices I used years ago would learn the default gateway address on their own without being provided a route. They didn't even have a place to put in the default gateway.

I have to assume these devices can find their way out, so I VLAN all IP cameras and don't allow them to access anything.