Slashdot Mirror
Hackers Hijack Surveillance Camera Footage With 'Peekaboo' Zero-Day Vulnerability (zdnet.com)
An anonymous reader quotes a report from ZDNet: A zero-day vulnerability present in security cameras and surveillance equipment using Nuuo software is thought to impact hundreds of thousands of devices worldwide. Researchers from cybersecurity firm Tenable disclosed the bug, which has been assigned as CVE-2018-1149. The vulnerability cannot get much more serious, as it allows attackers to remotely execute code in the software, the researchers said in a security advisory on Monday. Nuuo, describing itself as a provider of "trusted video management" software, offers a range of video solutions for surveillance systems in industries including transport, banking, government, and residential areas.
Dubbed "Peekaboo," the zero-day stack buffer overflow vulnerability, when exploited, allows threat actors to view and tamper with video surveillance recordings and feeds. It is also possible to use the bug to steal data including credentials, IP addresses, port usage, and the make & models of connected surveillance devices. In addition, the bug could be used to fully disable cameras and surveillance products. Peekaboo specifically impacts the NVRMini 2 NAS and network video recorder, which acts as a hub for connected surveillance products. When exploited, the product permitted access to the control management system (CMS) interface, which further exposes credentials of all connected video surveillance cameras connected to the storage system.
Dubbed "Peekaboo," the zero-day stack buffer overflow vulnerability, when exploited, allows threat actors to view and tamper with video surveillance recordings and feeds. It is also possible to use the bug to steal data including credentials, IP addresses, port usage, and the make & models of connected surveillance devices. In addition, the bug could be used to fully disable cameras and surveillance products. Peekaboo specifically impacts the NVRMini 2 NAS and network video recorder, which acts as a hub for connected surveillance products. When exploited, the product permitted access to the control management system (CMS) interface, which further exposes credentials of all connected video surveillance cameras connected to the storage system.
Link is broken for the CVE.
Only the State obtains its revenue by coercion. - Murray Rothbard
Why is your camera exposed to the internet?
With these sorts of devices just assume they will never get updates and *WILL* be rooted.
by shooting it down with 14 people on-board!
MOSCOW, September 18. /TASS/. Russia’s Il-20 military aircraft with 14 servicemen on board disappeared over the Mediterranean Sea, an official with Russia’s Defense Ministry told reporters on Tuesday.
The plane went off the radar while F-16 fighters of the Israeli Air Force attacked targets in the Syrian province of Latakia, the fate of the Russian military is unknown, the official said.
"On September 17, at about 11:00 Moscow time, the connection with the crew of the Russian Il-20 aircraft was lost over the Mediterranean Sea when the plane was returning to the airbase of Khmeimim, 35 kilometers from the coast of Syria," the official said.
The ministry specified that "the mark of IL-20 went off the radars disappeared during the attack of four Israeli F-16 aircraft on Syrian targets in the province of Latakia."
"At the same time, the Russian radars fixed missile launches from the French frigate Auvergne, which was in that area," the Defense Ministry said.
The official also said that there were 14 servicemen on board and their fate is unknown. The command of Russia’s air base at Khmeimim launched a search and rescue operation.
CoMe on bAby...and
where "your" "hacker" reconfigured the video cameras. I remember one, Deux Ex something something. I spent hours being stealthy. Then hit my first boss, who was flat out combat. I did not have any combat skillz, I did not have combat weapons. Gave it maybe an hour over 3-4 days, never got close to defeating that boss.
:(
I was really enjoying that game too
Why would we bother posting something about a webserver vulnerability? The submission lacks anything useful to take action on or inform; you know like what the actual threat vector is. For all I knew we could just walk through security with a barcode on our tshirts and shut down cameras.
What is that you say? The threat vector is in a completely abandoned but always online webserver? You don't say! Who would have known!
Whats that? You say total system takeover and privilege escalation? The ability to run commands? Oh MY!
Next time how about we:
1) identify the actual threat, not some 20 year old journalist's stupid sensationalist bullshit
2) Perhaps identify if this pre-boxed crapware product is using something like an unpatched BSD or Linux inside
3) Note that reputable vendors have had patches out for years because they're not bad
4) Leave out the part about all the amazing things one can do with commandline access and programming skills; slashdot croud should already know how computers work.
Who is this that even the wind and the waves obey Him? Surely this computer must submit also!
This attack is on the remote monitoring system for the cameras. And yes, you do put your camera's on the internet. Most of us are not as rich as some an AC and can't run our own dedicated cable to monitor the cameras.
the on line ver the camera in speed
BeauHD still not K-RAD either. Man, you suck.