Slashdot Mirror
Backdoor Accounts Found in 80 Sony IP Security Camera Models (pcworld.com)
Many network security cameras made by Sony could be taken over by hackers and infected with botnet malware if their firmware is not updated to the latest version. Researchers from SEC Consult have found two backdoor accounts that exist in 80 models of professional Sony security cameras, mainly used by companies and government agencies given their high price, PCWorld reports. From the article: One set of hard-coded credentials is in the Web interface and allows a remote attacker to send requests that would enable the Telnet service on the camera, the SEC Consult researchers said in an advisory Tuesday. The second hard-coded password is for the root account that could be used to take full control of the camera over Telnet. The researchers established that the password is static based on its cryptographic hash and, while they haven't actually cracked it, they believe it's only a matter of time until someone does. Sony released a patch to the affected camera models last week.
Could I log in through the backdoor account, hack the camera to display the same image continuously on a loop, and then waltz into the vault and load up my satchel with valuables? Count me in!
Lorex security cameras just as bad max password is 6 characters
of course. Sony is notorious for doing things like that. which is why I won't use their products.
I'd like to buy an IP camera, but I haven't been able to find any that are as open/secure/clearly* supported than a raspberry pi with a camera board (and motion software). I'd rather buy a complete solution than put it together myself though.
Requirements:
* Not require the cloud. (Happy if the feature exists as long as it has an off switch)
* Have an OS that has a stated support period (of at least 3 years)
* Sent a video feed to other device on my network.
* 720p+
* Ideal budge Less than $100
Ideally it would have an Open Source OS that I can replace if I want, but does everything I need so I never want to...
So hard-coded credentials AND MF telnet? Seriously ladies and gentlemen, WTF is slapping the OS stack on these IoT devices? Was someone just that lazy with their firmware we couldn't take that out of busybox/toybox or heaven forbid strip that out of the development pipeline when you're cutting out the production firmware for mass use? I realize it's handy when you're developing it, but this is just lunacy anymore. I thought we all went over this as hardened, grey sys-admins now that telnet had died a long time ago in the 90's...
I don't even think I want to get started about hard-coded credentials, and I'm not going to. All I can say now is: Thanks for making it unbelievably EASY for anyone putting yet another bot network to compromise more low hanging fruit. Even if it's not used in that, I'm sure all the Shodan fans will love it.
I'm just whine-ranting now, but is anyone has F blown away as me that shit like this STILL continues to happen?
Lots of the big name security brands are running the same basic NetSurveillance WEB firmware underneath their skinned interface. I'm thinking particularly of the brand that makes flight data recorders... and cordless doorbells. I wonder if people would pay serious money for a IPTV network if they knew it's just a re-badged Mirai host.
How do I know? They hit me 24/7, I'll be worried about the connectivity of the internet if they ever stop.
WTF does a company need with 80 models of cameras? Isn't 57 enough?
[quote]Sony released a patch to the affected camera models last week.[/quote]
Don't buy it. As far as Sony was concerned, this was a "feature" they agreed to put in the camera to allow access by state actors. The feature only become a security bug once the public found out about the program.
So the company that put Windows rootkits on Redbook audio CDs puts backdoors in other products? Stunning!
The company that sold the PSP 1000 to early adopters at $250+ per unit based on all the things it would be able to do with expansions, then released expansions that only worked with later models doesn't take their customers' needs seriously? Shocking!
The company that advertised Linux on the PlayStation 3 then made it impossible to use Linux if you installed most of the newer PS/3 games stomps on their promises? Inconceivable!
Or... oh, wait... no, that's not it. The surprising part is that anybody trusts these shady jerks at all.
Security has no ROI.
Clearly, the solution to these insecure products is less regulation by the government!
The first result in my Google search for "open ip camera firmware" looked pretty promising, so I'm guessing you have another requirement that none of those cameras meet? Using the open firmware DOES mean upgrading from the factory firmware, is that a major issue?
> Sent a video feed to other device on my network.
If your firewall or vlan restricts it to your local network only, how important is future firmware support? If it works today, with a standard/open protocol such as mpeg, and it's not connected to the internet, what future upgrades can be so important?
>Using the open firmware DOES mean upgrading from the factory firmware, is that a major issue?
I did review openipcam.com before asking, but yes, I would prefer if the camera vendor was actually involved.
>If your firewall or vlan restricts it to your local network only, how important is future firmware support? If it works today, with a standard/open protocol such as mpeg, and it's not connected to the internet, what future upgrades can be so important?
Good point. In the simple case this would just mean it has no "Cloud" functionality - or I get VLAN support in my next router..
So they have an MD5 hash, but don't know what value hashes to it. They have no idea if it's a 10 character '1234567890' password or a 64 character string of random bytes. They also know that it's not a string that Google has already found and cached. The only clue they have to go on is the existing backdoor they found that turns telnet on, which uses 11 random ASCII characters as the secret. But 11 characters are almost out of reach for brute force password testing. If the person who put the backdoor in applied only the same amount of thought to the secret password, that would still be a monster to attack with brute force.
So I disagree that it's a matter of time. I think it's a matter of defeating it in another way, such as having Wireshark running when someone who actually knows the password types it in; or uncovering a wikileaked document that contains the secret backdoor password.
John
Just a guess.
It was likely left there on purpose.
Without VLANs, you list devices are not allowed to access the internet. On Linksys, it's called Access Policy.
http://www.linksys.com/ph/supp...
Netgear probably has the same capability.
It never ceases to amaze me when I read about such exploitable devices only to find out that the exploitable service should not exist in any way shape or form on the device to begin with. Telnet? Telnet? It's like the people designing these things are all proud that they got Linux up and running on it on only their fifth try, and the watched then movie Hackers as a reference for configuring it.
Brought to you by Carl's Junior.
Its Sony, put a few flashy ads on TV and people go buy the next round of products.
Clearly not enough people wanted Linux on their PS3, otherwise Sony would of a) not taken it away or b) put it back on there.
The PlayStations are the only Sony "lock in" type product ? You dont have to buy Sony Tvs, Cameras, and Walkmans etc.
Personally I wasn't going to buy another PlayStation after the PS2, couple months ago I'm walking past the big electronics recycle bin (I'm sure it just gets put on a ship and dumped in some 3rd world country) on the service level at work, I must of been the first to see it, but there was a PlayStation 3 sitting atop the pile, hard drive removed, and a DHS (they're in our building somewhere) evidence sticker with the important details blacked out. So I took it home, bought a controller, put an spare SSD into it, fiddled around with the firmware download to USB stick trick, and it works. So there you are, one deported mans evidence is another's free PS3.
I wish I could say "I'm shocked!", but I can't because I'm not.
Just cruising through this digital world at 33 1/3 rpm...
The default account on most cameras is admin/admin, important to note that it is case sensitive for the username as well since they usually run Linux without properly disclosing such under GPL terms.
Nobody who has at least a passing interest in security buys Sony products anymore, and everyone else very obviously doesn't care about security.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
What always stuns me is the Sony Fanbase, especially with playstation where they will adamantly defend Sony as a champion of the consumer or the only trustworthy company despite PSN hacks, rootkits, security disasters, PS3 Linux and now this. I am sure you will find plenty of defenders for them though.
11 random ASCII characters in the possession of Sony Corp is safe because its 11 characters?
Yet Sony has been hacked many times (e.g. November 2014 Sony Pictures), and certainly state actors would have grabbed that password by intercepting emails. If one has it, say NSA, then all have it either by information sharing or via political control (Think Trump's buddies in the FSB that helped him steal the Presidency by hacking swing states electoral rolls, and DNC emails.... now he's President, they get all the backdoor passwords available to the executive branch).
And given the security in NSA (2 million security cleared people!) where Snowden walked out with their data, it means lots of people will have it, simply because its only as good as their sieve security.
So yeh.... secure.......not!
And no security? If securty takes up only 0 bytes then it'll fit there.