Slashdot Mirror
Flaw In IoT Security Cameras Leaves Millions of Devices Open To Hackers (vice.com)
New submitter Aliciadivo writes: A nasty vulnerability found in Axis security cameras could allow hackers to take full control of several types of Internet of Things devices, and in some cases, software programs, too. The Senrio research team found that devices and software programs using an open source software library called gSOAP to enable their product to communicate to the internet could be affected. Stephen Ridley, founder of Senrio, said: "I bet you all these other manufacturers have the same vulnerability throughout their product lines as well. It's a vulnerability in virtually every IoT device [...] Every kind of device you can possibly think of." A spokesperson for ONVIF, an electronics industry consortium that includes Axis and has includes some members that use gSOAP, said it has notified its members of the flaw, but it's not "up to each member to handle this in the way they best see fit." Also, gSOAP "is not in any way mandated by the ONVIF specifications, but as SOAP is the base for the ONVIF API, it is possible that ONVIF members would be affected." Hundreds of thousands of devices might be affected, as a search for the term "Axis" on Shodan, an engine that scours the internet for vulnerable devices, returns around 14,000 results. You can view Senrio Labs' video on the exploit (which they refer to as the "Devil's Ivy Exploit") here.
it's a feature. approaching a standard
You should post this informative news about Rust in a C++ forum.
Those guys need all the help they can get!
Nobody could have possibly known in advance that hooking *everything* up to the internet was a security risk, right?
more info at Krebs: https://krebsonsecurity.com/20...
“You probably wouldn’t be able to make a universal, Mirai-style exploit for this flaw because it lacks the elements of simplicity and reproduceability,” Karas said, noting that the exploit requires that an attacker be able to upload at least a 2 GB file to the Web interface for a vulnerable device.
it's worth noting that using you can easily send several gigabytes of zeros if you can mark the communication as using gzip compression.
Anons need not reply. Questions end with a question mark.
But think of the children! Trackers for everyone! Biometric scanners all around! All hail Facefarm. Big Brother loves you. People I don't want to understand or acknowledge are all "terrorists" because differences and the potential of being wrong is terrifying. IoT vulnerabilities aren't bugs, but features for sheeple that need to feel like guardian angels exist and that the "1984" that millenials joke about is someone else's fault and is inevitable. People in the tech world like to think that their niche is all good and that black hats are something else unrelated to them. So, we "good people" imagine that the only ones watching are intelligence agencies or white hats, deluding ourselves and tolerating IoT vulnerabilities. The companies that make them only care about money and seem to have zero responsibility for them. Most consumers aren't even aware at all. Just wait until quantum cloud computing and AI becomes a normal thing; it's going to be a Theresa May wet dream.
This has nothing to do with IoT. The bug is in gSOAP which is used everywhere as it's one of the go-to choices when picking a library for communication over SOAP, REST, and/or XML. Basically any company doing something with web services likely used gSOAP at one point. Here's a blurb from their website:
"The gSOAP toolkit is used by most of the top Fortune 500 companies and all of the top 15 technology companies. Speed, reliability and flexibility, coupled with a proven track record and used by some of the largest technology vendors makes it an ideal platform to develop applications using Web services and XML processing. Applications include embedded systems, mobile devices, telecommunications, routers, online games, Web TV, banking systems, auction systems, news outlets, network management systems, grid and cloud computing platforms, and security software."
I used to do this using Google back in 2004 searching for publicly accessible web cams and the strings that their web viewer used. Some even allowed you to control them which was awesome. If you're too stupid to add a password to any iot device, you deserve the pain that comes.
Most of the shit ONVIF cameras wont let you turn that crap off.
I dont care if the username password is "admin admin" My cameras are 100% hackerproof because they are on a private locked down network. The only gateway to the internet is the single recording PC, and even then you have to VPN in to that network to see them.
Basically if you are dumb you put your IOT stuff on the internet. The smart people treat all of it as dangerous and put it on a network that is segmented and protected because you can not know what these damn things do because every company has to hide their own secrets inside them.
Do not look at laser with remaining good eye.
This problem will always exist while management is held to the standard of cost is more important then security approach to producing items.
Be seeing you...
To be specific, since I also saw the /. thread from a few days ago and I know some people need a little help understanding this: Rust is a solution to some classes of IoT security problems. It's not a solution to all classes of IoT security problems.
Apparently this particular issue is a stack buffer overflow that leads to remote code execution, which seems like exactly the sort of bug that wouldn't have been possible if the library had been written in Rust. So, it would've helped quite a lot here.
You're playing the game wrong, you have to say the name of a problem out loud five times before you rust flakes are allowed to start appearing, not just once. See this reference. Also, I believe a mirror should be involved.
I have, admittedly, only worked with a few microcontrollers like what is going in a lot of IoT devices. But, none of them had segmented memory like x86 and x64 that gives rise to the Segmentation Fault.
Go over to smallnetbuilder forums. Plenty will explain both. There are even tutorials.
I always thought IoT stood for Internet of Trash. So far that hypothesis holds.
Time to offend someone