Slashdot Mirror
Passwords For Tens of Thousands of Dahua Devices Cached In IoT Search Engine (bleepingcomputer.com)
An anonymous reader writes: "Login passwords for tens of thousands of Dahua devices have been cached inside search results returned by ZoomEye, a search engine for discovering Internet-connected devices (also called an IoT search engine)," reports Bleeping Computer. A security researcher has recently discovered that instead of just indexing IoT devices, ZoomEye is also sending an exploitation package to devices and caching the results, which also include cleartext DDNS passwords that allow an attacker remote access to these devices. Searching for the devices is trivial and simple queries can unearth tens of thousands of vulnerable Dahua DVRs. According to the security researcher who spotted these devices, the trick has been used in the past year by the author of the BrickerBot IoT malware, the one who was on a crusade last year, bricking unsecured devices in an attempt to have them go offline instead of being added to IoT botnets.
Please stop buying this nonsense.
never ever put a camera directly on the internet. if you can access a camera directly through the camera's web interface then so can anyone!
Insane would be an improvement for our barely-legal traitor POTUS.... I hear the mental health care in Federal Prison is extremely lacking. Sad!
You're just jealous that Mr Musk is smarter, better looking, richer, more successful with women, and an all-around better human being than you.
Either that, or you're another one of David Brock's "nerd virgins" astroturfing Slashdot for pay.
https://www.motherjones.com/politics/2014/09/david-brock-hillary-clinton-correct-the-record/
People were always on his dick like a cult leader. Can't wait to see how his followers spin this. Oh and are these the dirt cheap DVRs like Harbor Freight sells?
Only the State obtains its revenue by coercion. - Murray Rothbard
Funny you should mention women. His ex who is in Westworld is hot as fuck.
Remember, the 'S' in IoT is for 'Security'.
Will someone please invent the Internet of Ta-Tas?
The more the better. Maybe at some point people will stop buying that crap and the whole thing is finally over.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Well the worst thing he did was call a British expat a Pedo for no good reason - actually no, the worst thing he did was give money to US house republican campaign fundraisers. I guess he's secretly nazi scum.
The second link leads to a 2013 blog post for CVE-2013-6117. Somebody botched the summary
Go to the next Linux User Group and have them configure something like an RPI to act as a firewalled Wifi router. Cost: $50 HW plus two beers.
...is a very secure technology. Millions of servers use it.
So in theory, you *can* create secure internet-connected devices. You can even prove the internet-facing code mathematically correct. See L4 or INRIA Compcert.
Of course NSA and their Chinese peers won't like secure devices. Neither will the GRU or GCHQ.