Slashdot Mirror
Passwords For Tens of Thousands of Dahua Devices Cached In IoT Search Engine (bleepingcomputer.com)
An anonymous reader writes: "Login passwords for tens of thousands of Dahua devices have been cached inside search results returned by ZoomEye, a search engine for discovering Internet-connected devices (also called an IoT search engine)," reports Bleeping Computer. A security researcher has recently discovered that instead of just indexing IoT devices, ZoomEye is also sending an exploitation package to devices and caching the results, which also include cleartext DDNS passwords that allow an attacker remote access to these devices. Searching for the devices is trivial and simple queries can unearth tens of thousands of vulnerable Dahua DVRs. According to the security researcher who spotted these devices, the trick has been used in the past year by the author of the BrickerBot IoT malware, the one who was on a crusade last year, bricking unsecured devices in an attempt to have them go offline instead of being added to IoT botnets.
Well, by deer, I mean neighbors. And by eat apples, I mean have sex.
Remember, the 'S' in IoT is for 'Security'.
Dahua actually make pretty top-shelf gear. They also OEM for half the high-end video camera systems out there, so the "Made in USA" system you'll end up buying in place of your "Chinese crap" at five times the price could well be a Dahua under the hood. Or, more likely something far worse than Dahua.
In addition:
The vulnerability has been known since 2013 and has been since patched, but many Dahua device owners have failed to update their equipment, and even to this day have continued to deploy DVRs running the antiquated firmware online.
While technically correct, this is rather misleading. Dahua don't sell to or deal with end users, so the device owners have nothing to do with the problem, it'll either have been set up by a Dahua-approved vendor or be under a completely different name as an OEM, one who lasted update their firmware in 2010.