New Hacking Tool Lets Users Access a Bunch of DVRs and Their Video Feeds (bleepingcomputer.com)

An anonymous reader writes: "An Argentinian security researcher named Ezequiel Fernandez has published a powerful new tool yesterday that can easily extract plaintext credentials for various DVR brands and grant attackers access to those systems, and inherently the video feeds they're supposed to record," reports Bleeping Computer. "The tool, named getDVR_Credentials, is a proof-of-concept for CVE-2018-9995, a vulnerability discovered by Fernandez at the start of last month, [affecting TBK DVR systems]. Fernandez discovered that by accessing the control panel of specific DVRs with a cookie header of 'Cookie: uid=admin,' the DVR would respond with the device's admin credentials in cleartext." Tens of thousands of vulnerable devices available online can be hijacked with their video feeds assembled in voyeur sites, like it's been done in the past.

Comments

So Much For "The Internet Of Things"

[dryriver]

If the tech industry was serious about IOT - tens or hundreds of millions of home devices that are internet connected - they should have gotten together, pooled a few Billion dollars of R&D money, and researched ways to make unauthorized access to these IOT products fucking-difficult-to-near-impossible. There are plenty of smart nerds on the market who could actually have pulled this off, given enough funding and other resources. Instead, tens millions of devices with shoddy security were sold in a worldwide rush to make profit, and organized crime, home-dwelling hackers, govt-sponsored cyber armies and others are looking at a fabulous IOT landscape that is full of low hanging fruit - access this device here, hack this device there, grab the private data from that IP camera there, attack a website with this device over here. IOT is a bad failure in this respect. Don't take someone's money and then put something in that person's home that has ***t security. But everybody did it anyway. Tragic.

Re:So Much For "The Internet Of Things"

[Yaztromo]

If the tech industry was serious about IOT - tens or hundreds of millions of home devices that are internet connected - they should have gotten together, pooled a few Billion dollars of R&D money, and researched ways to make unauthorized access to these IOT products fucking-difficult-to-near-impossible.

This has been done. But it doesn't stop some fly-by-night overseas hardware manufacturer from churning out quick and dirty hardware that does the job, but which does the quickest and dirtiest job on the software front that they can get away with.

But for a counter-example, look at the work Apple has done with HomeKit. The entire setup is required to be encrypted back to front, and has to undergo an Apple certification program. The end result is pretty much bulletproof -- but the certification requirements that make the system so secure has meant few companies (and certainly none of the cheap-and-dirty ones) have released certified hardware.

That's hardly the fault of IoT as a concept. As with anything else, there will be expensive, better secured, better quality versions, and cheaper, crappier, less secure, low quality versions.

Yaz