Slashdot Mirror
CCTV DVR Vulnerabilities Traced To Chinese OEM Which Spurned Researchers' Advice (softpedia.com)
An anonymous reader writes: RSA security researcher Rotem Kerner has identified a common vulnerability in the firmware of 70 different CCTV DVR vendors, which allows crooks to execute code and gain root privileges on the affected devices. The problem was actually in the firmware of just one DVR sold by Chinese firm TVT. The practice of "white-labeling" products helped propagate this issue to other "manufacturers" who did nothing more than to buy a non-branded DVR, tweaked its firmware, slapped their logo on top, and sold it a their own, vulnerability included.
It's a mandatory feature. Deal with it.
CCTV, aka China Central Television, traced to the Chinese.
Realty?
Recent Foscam security cameras: http://krebsonsecurity.com/201...
IoT concerns: http://thenewstack.io/snooping...
I deny that I have not avoided attaining the opposite of that which I do not want.
I wish he had. We are up to our eyeballs in this problem.
Support your local school shooter, give them your firearms.
Which wants all device and operating system vendors to standardize on vulnerabilities on the assumption that only the "good guys" will know how to exploit them.
“Common sense is not so common.” — Voltaire
Europe, bunch of weak kneed pansies. They can't do anything without the US to keep them in line.
The Chinese OEMs don't care about security or anything else. They are remarkably dense and will reject changes coming from anywhere. It's hard enough to get them to change anything when you're a paying customer, and if you do get them to change, the moment you are satisfied and think things are under control, they'll change it right back to the old way.
This is because the smart people want to be thought of as creative. When someone else is telling them what to do, they're not being creative and think they're being forced into being mindless slaves. Follow an established security vetting process? That's not what creatives do. That's following procedure, only factory assembly workers do that, and even then only because they are forced to do so. Also, being predictable violates the maxim that one should conceal one's true goals. They're not at war but the Sun Tzu thinking will tell.
Second, details are boring. If you're creative, you think of the effects you want the product to have, not the stupid security protocols it has to follow. And if the product is selling, who cares?
The Western customers who buy the OEM products are clueless about everything, that's why they're buying whitebox in the first place. We shouldn't blame them for security, although perhaps it's tempting. It's not like they can complain and get it fixed. If they make too much of a fuss the OEM will just point out that none of their other 70 customers has any problem and fire them as a customer.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
Is anyone at all surprised that the manufacturers don't care? - Chinese companies seem to place little value on software quality - once it's just good enough to be useable, out the door it goes and they have no interest in improving it.
This attitude is so widespread that I can only assume it must be some sort of cultural thing
Seems to be good on topic links.
As to whether he can be trusted... who cares, the information he gave is independent of the person saying it, thus your Ad Hominen attack is worthless shit from a troll.
Of Chinese government espionage, just far away to blame a supposedly independent company and subtle enough that it can be blamed on a coding error if ever discovered.
On my common cheapo 'H960 DVR' I used Nessus for discovery. /etc/password file.
Nessus navigated my directory structure via the web interface.
Nessus showed me the contents of the
It only took me a minute to google "rainbow table" and find JTR.
It took JTR less than 1/4 hour to crack the SIX CHARACTER password WITHOUT any rainbow tables.
It took me many many many emails to convince the distributor's cust. serv. that I was talking about an actual vulnerability.
I never expected it to be secure at the price I paid.
I'm glad I can root my box.
Now I can, if I choose, fix the shitty user interface.
I doubt the typical user would think it is a 'feature' as I do.
The fact that it BY DESIGN interfaces with an external server not under my control convinced me never to use the web features.
I knew that before the purchase, I wanted an offline recorder.
Oddly, the typical user DOES consider the remote server a feature. Most people hand a stranger the keys on day #1.
I have an inexpensive 'H.264 tribred' DVR that is slightly more secure. Provided I don't hand the keys to an unknown 3rd party.
So someone ate an "s" big freaking deal
So it's all a bunch of other chinese manufacturers with no reputable brand in the mix. This is not a vulnerability, it's a government requirement.
So CCTV systems were being hacked for two years, and only now someone decided to take a look at it? That sounds about right.
Is there anywhere you can buy IP cameras, DVRs, and NVRs that aren't made in China and full of vulnerabilities? Does any company offer secure security camera systems?
If anyone knows of any I'd love to hear about your experience with them. I've looked and even the "high-end" (aka expensive) name-brand devices like Sony and Panasonic have major security flaws like TVT firmware, HTTP only access, passwords stored on the device in plain text, etc.
We had to separate the camera systems at my company onto their own VLAN that can only be accessed from a few computers on our internal network or over our VPN. It is a pain but much better than letting anyone in the world onto our camera system. I want to replace all of them with something better, but it seems like OEM or branded its all the same insecure, never patched, never updated Chinese garbage.
Maybe it's time that all items sold for in the US go thru a UL rating like most appliances in the home. I don't think the UL guys want this. Too much work for too little money. They might not catch all problems with ITA (Internet Tech Appliance) but if they get the stupid ones off the market that's good enough. Whats also needed is a way to revoke the ULITA rating when the device gets updated with new bugs. I'd pay more if I knew that the devices I was buying are at least somewhat trustworthy.
What I would'nt want UL to do is make demands on design that limit the users ablity to make mistakes. Eg.. No Ralph Nader devices. Maybe it's time for a OSS emblem/tradmark to be put on devices.
For the DVR and management interface, Zone Minder is THE open source solution and has been for a long time. It can do all kinds of things like run motion detection on the feeds and when motion is detected it turns on the light and pans your high-quality camera to view the area where the motion was.
It's -more- secure than the stuff made by Happy Fun Camera Ltd, in China, with instructions that read "button the press longly is record of picture motions", which also happens to be the exact same system sold under many brand names. I don't know that it's had a complete security audit, but it's better than Chinese "button the press longly ".
https://zoneminder.com/
As others have mentioned, configuring a separate video vlan (or ssid) which isn't connected to the internet will get you most of the way there for camera security. Your cheap consumer wifi router can do a no-internet ssid by using the parental control feature.
Ubiquiti makes a line of cameras with an NVR, that is probably more trustworthy than the loads of cheap Chinese DVRs heading to our shores.
https://www.ubnt.com/products/...
It's all IP based stuff no Analog/CVI/TVI - so you can't use your existing siamese cable.
Up to your eyeballs in free labor, cotton, grandfathers, or black people?
"So long and thanks for all the fish."
Nah, they're pretty good at starting wars or setting the situations up to be volatile enough to where war is the likely outcome.
Weak? Not at all. They've been warring since the dawn of recorded history in that area.
Which leads me to this... Going to war against China is going to be bad. Not just typical-bad 'cause it's war but a badness on a scale not seen in a very long time. Look at the percentage of casualties, displaced persons, and economic negative impacts of the larger wars. Now imagine that with a pissed off China, now modernized and organized under one heading, and see if war versus China still sounds like a good idea.
"So long and thanks for all the fish."
And then make sure not provide source code after modifying 'their' OS. ;P
Crappy manufacturer (OEM, ODM, call them what you want) makes crappy equipment with crappy security.
When someone tells me that a reputable manufacturer is selling garbage, then I get more concerned. And if I cannot get decent equipment from any manufacturer, then I get really concerned. This should either lead to the reputable manufacturer patching their stuff, or at the very least issuing patches on the current production runs, or a hit to their reputation.