Slashdot Mirror
AVTECH Shuns Security Firm and Leaves All Products Vulnerable Without a Patch (softpedia.com)
An anonymous reader writes: AVTECH, a Taiwanese CCTV equipment manufacturer, has failed to respond to Search-Lab, a Hungarian security firm, who spent more than a year trying to inform the company about 14 security bugs affecting the firmware of ALL its products. Almost a year after it first contacted the hardware maker, Search-Lab published a public advisory about the vulnerabilities it discovered, warning sysadmins that their AVTECH products may be in danger of exploitation and remote takeover. Search-Lab says their researchers is not the only one that spotted these issues. Currently, the term "AVTECH" is the second most popular search term on Shodan, where anyone can find more than 130,000 of these devices available online. Taking into account the recent attacks from IoT botnets, AVTECH is now on the same level of incompetence and indifference as other CCTV hardware makers such as AVer, Dahua, and TVT, all Chinese and Taiwanese companies. A list of confirmed affected firmware versions is available here, proof of concept exploitation code is available on GitHub, and an exploitation video is available here.
another perfect example of why everything doesn;t fucking need to be connected to the internet
Consumers get all the security they are willing to pay for.
I am guessing they have ONE guy answering these e-mail, and that person isn't fluent in English (if at all.)
As long as order continue to pour in, there's no problem.
ELOI, ELOI, LAMA SABACHTHANI!?
Not even once.
Why is it so hard to only have politicians for a few years, then have them go away?
This is a typical situation with most firms ignoring support calls or answering them with a "we will reply as soon as we can" but you never get a reply. Being a bit of a fascist I would like to see these companies who ignore things (especially security issues) go belly up big time so we can all feel nice and warm
After all this is about popular security cameras. And you wrote:
IoT is still just computers when you get to the root of it.
Well said. Bravo! And well played!
WARNING: Smartphones have side effects--most of them undocumented.
Comment removed based on user account deletion
I heard you like exploits, so we didn't secure our webcams so you can be part of a DDOS botnet while random people on teh intarwebs spy on your baby.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Yey... more IoT botnets... I love DDoS attacks on Steam while I'm playing.
Perhaps I buy one for a (Not So Good) Friend..... :)
Prices are not too bad.
http://amzn.to/2e9WRKM
PROS
Great hardware
Great Installation options (poe/ac/alarm trigger cables)
Solid construction
Great picture with beautiful wide angle and resolution
Great night vision (not all washed out like others)
CONS
Uhm, simply doesn't work half the time.
Camera suddenly goes offline, is not responsive to web or software connections
The mac software "Video Viewer" crashes 80% of the time when trying to load the camera
The ePTZ feature doesn't seem to work at all
The mobile device video quality is very poor (even set to highest settings)
The IOS app "EagleEyes" only supports AVTECH cams, so I ended up using a third party app
No support at all
We tried contacting avtech through their website and have never received a response.
I'm curious if there are any home brew open source firmware options for these devices. Like DD-WRT only for CCTV. That way owners of these systems have an alternative.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Why shouldn't white hats now start crafting and sending kill bits to these cunts' tawdry wares? It could honestly be justified as self-defence.
Man, this freaked me out for a minute. I thought they were talking about the AVTECH that makes environment monitors for datacenters. Don't get me wrong, those very well could have their own vulnerabilities, but it's a relief to know it's not this company.
Why is it that, even after a a couple of decades of experience and examples, a company would just ignore security researchers?
If you are a real asshole; and think you can get away with it, I can see why you might try to threaten them into silence; but if you can't do that, or you aren't scum, they are doing your work for you. What do you gain by not taking advantage of that?
Especially in this case. By the look of their product lineup, these guys appear to have aspirations higher than the '8 lousy cameras bundled with a POS DVR and sold under a mystery brand' caliber of 'security' product(they allege some institutional deployments; and they offer some SAS-attached drive shelves for their bigger DVRs); if you are trying to play with the professionals, isn't free security advice a bonus?
And more worrisome:
Most of these devices use specialized ARM processors with additional opcodes for the video encoding/decoding operations with proprietary software handling the image generation.
Meaning: you can't simply replace it with an all open source stack, and in many cases can't even replace the system library with an alternative (musl just got switched out for uClibc in OpenWRT, having both a smaller profile and more complete modern conformance than either uClibc or glibc, albeit without legacy development compatibility (which is broken in many cases on glibc, and doesn't exist on uClibc anyway.)
Point being: Unless somebody makes a concerted effort to reverse engineering those undocuemnted opcodes, or gets ahold of the proprietary datasheets/architecture manuals for those ip camera processors, making a complete open source distro for those devices will be difficult and time consuming, for something that is a nominalyl not for profit venture requiring greater than workday level effort for all but the intellectually advanced of programmers/embedded systems designers/reverse engineers/laypeople.
I've said it before but it's worth repeating.
IoT vendors will only secure their devices after it starts costing them money or are legally required to do so.
The best option is to high jack the IoT devices to DDoS their makers because it creates a direct feedback loop. The more insecure devices they sell, the more it will cost them to host their company's website(s). For extra points, only target their parent company. ;)
Anons need not reply. Questions end with a question mark.
There should be a legal exception that it is allowed to make your, and other people's, devices phone home to the original manufacturer with Gbit speeds.
The less they patch or the more they produce shitty hardware, the bigger they need to invest in anti DDoS measures.
At some point it will be cheaper to simply patch the stuff.
Atari rules... ermm... ruled.