Slashdot Mirror
Flaw In IoT Security Cameras Leaves Millions of Devices Open To Hackers (vice.com)
New submitter Aliciadivo writes: A nasty vulnerability found in Axis security cameras could allow hackers to take full control of several types of Internet of Things devices, and in some cases, software programs, too. The Senrio research team found that devices and software programs using an open source software library called gSOAP to enable their product to communicate to the internet could be affected. Stephen Ridley, founder of Senrio, said: "I bet you all these other manufacturers have the same vulnerability throughout their product lines as well. It's a vulnerability in virtually every IoT device [...] Every kind of device you can possibly think of." A spokesperson for ONVIF, an electronics industry consortium that includes Axis and has includes some members that use gSOAP, said it has notified its members of the flaw, but it's not "up to each member to handle this in the way they best see fit." Also, gSOAP "is not in any way mandated by the ONVIF specifications, but as SOAP is the base for the ONVIF API, it is possible that ONVIF members would be affected." Hundreds of thousands of devices might be affected, as a search for the term "Axis" on Shodan, an engine that scours the internet for vulnerable devices, returns around 14,000 results. You can view Senrio Labs' video on the exploit (which they refer to as the "Devil's Ivy Exploit") here.
it's a feature. approaching a standard
... if it's connected to the internet. Email isn't secure either. Who'd a thought?
LOL. Isn't that spelled J-A-V-A?
"it has notified its members of the flaw, but it's not "up to each member to handle this in the way they best see fit." "
The members have been notified, but it is NOT up to them to handle it?
Then who the hell is it up to?
Oh, wait - is this just another example of poor writing on behalf of the editors?
Overhyped article. It doesnt affect every IoT device. Typical fearmongering from Vice
But - does Rust run on a Mac?
You should post this informative news about Rust in a C++ forum.
Those guys need all the help they can get!
Nobody could have possibly known in advance that hooking *everything* up to the internet was a security risk, right?
more info at Krebs: https://krebsonsecurity.com/20...
“You probably wouldn’t be able to make a universal, Mirai-style exploit for this flaw because it lacks the elements of simplicity and reproduceability,” Karas said, noting that the exploit requires that an attacker be able to upload at least a 2 GB file to the Web interface for a vulnerable device.
it's worth noting that using you can easily send several gigabytes of zeros if you can mark the communication as using gzip compression.
Anons need not reply. Questions end with a question mark.
Your recommendation has merit, but how can we convince millennial programmers to use Rust?
But think of the children! Trackers for everyone! Biometric scanners all around! All hail Facefarm. Big Brother loves you. People I don't want to understand or acknowledge are all "terrorists" because differences and the potential of being wrong is terrifying. IoT vulnerabilities aren't bugs, but features for sheeple that need to feel like guardian angels exist and that the "1984" that millenials joke about is someone else's fault and is inevitable. People in the tech world like to think that their niche is all good and that black hats are something else unrelated to them. So, we "good people" imagine that the only ones watching are intelligence agencies or white hats, deluding ourselves and tolerating IoT vulnerabilities. The companies that make them only care about money and seem to have zero responsibility for them. Most consumers aren't even aware at all. Just wait until quantum cloud computing and AI becomes a normal thing; it's going to be a Theresa May wet dream.
That's easy... offer users a chance to win free gender reassignment surgery!
This has nothing to do with IoT. The bug is in gSOAP which is used everywhere as it's one of the go-to choices when picking a library for communication over SOAP, REST, and/or XML. Basically any company doing something with web services likely used gSOAP at one point. Here's a blurb from their website:
"The gSOAP toolkit is used by most of the top Fortune 500 companies and all of the top 15 technology companies. Speed, reliability and flexibility, coupled with a proven track record and used by some of the largest technology vendors makes it an ideal platform to develop applications using Web services and XML processing. Applications include embedded systems, mobile devices, telecommunications, routers, online games, Web TV, banking systems, auction systems, news outlets, network management systems, grid and cloud computing platforms, and security software."
I used to do this using Google back in 2004 searching for publicly accessible web cams and the strings that their web viewer used. Some even allowed you to control them which was awesome. If you're too stupid to add a password to any iot device, you deserve the pain that comes.
Most of the shit ONVIF cameras wont let you turn that crap off.
I dont care if the username password is "admin admin" My cameras are 100% hackerproof because they are on a private locked down network. The only gateway to the internet is the single recording PC, and even then you have to VPN in to that network to see them.
Basically if you are dumb you put your IOT stuff on the internet. The smart people treat all of it as dangerous and put it on a network that is segmented and protected because you can not know what these damn things do because every company has to hide their own secrets inside them.
Do not look at laser with remaining good eye.
You know what makes mine different??
I will allow full control to the users/owners of the device.. if access is not needed outside the LAN it will jot cross that line.. won't have any openings for incoming connections at the moment just a simple HTML page..
I will provide granular contol options, why??
When I was asked to start this product they said it must be wifi connected, I asked why?? What functions/benefits do you get over a LCD screen. The customer explained what they wanted and I agreed with stipulations that the user gets control..
there are only a few functions that internet accesss provides a benefit to anyone so these will be user configurable and controllable...
Next o will have to implement some way to let users/owners integrate that with third party servers so all IOT things can be monitored for one spot
This problem will always exist while management is held to the standard of cost is more important then security approach to producing items.
Be seeing you...
A small security related deal. Humble Bundle in the book section has plenty of security/hacking/cryptography books for $15. A very good deal.
To be specific, since I also saw the /. thread from a few days ago and I know some people need a little help understanding this: Rust is a solution to some classes of IoT security problems. It's not a solution to all classes of IoT security problems.
Apparently this particular issue is a stack buffer overflow that leads to remote code execution, which seems like exactly the sort of bug that wouldn't have been possible if the library had been written in Rust. So, it would've helped quite a lot here.
Only LUDDITES expect LUDDITE cameras to have LUDDITE security! Modern app appers use appy Appernet of App apps to app other apps!
Apps!
Take Swann DVR's for example, straight out of the box if one was to configure an admin password and connect it to the net using DDNS (swanndvr.net) then ANYONE can use software to connect to the DVR using any username/password that they choose, it literally accepted everyone. Only after creating a guest user account with password was I able to stop this. Nowhere does it state to do that in manuals nor has anyone else noticed this through searching...
You're playing the game wrong, you have to say the name of a problem out loud five times before you rust flakes are allowed to start appearing, not just once. See this reference. Also, I believe a mirror should be involved.
I have, admittedly, only worked with a few microcontrollers like what is going in a lot of IoT devices. But, none of them had segmented memory like x86 and x64 that gives rise to the Segmentation Fault.
Go over to smallnetbuilder forums. Plenty will explain both. There are even tutorials.
IoT; The 'S' is for Security!
I(di)oT
I always thought IoT stood for Internet of Trash. So far that hypothesis holds.
Time to offend someone
...using SOAP already. Gah, a cumbersome framework.