Slashdot Mirror
Hackers Hijack Surveillance Camera Footage With 'Peekaboo' Zero-Day Vulnerability (zdnet.com)
An anonymous reader quotes a report from ZDNet: A zero-day vulnerability present in security cameras and surveillance equipment using Nuuo software is thought to impact hundreds of thousands of devices worldwide. Researchers from cybersecurity firm Tenable disclosed the bug, which has been assigned as CVE-2018-1149. The vulnerability cannot get much more serious, as it allows attackers to remotely execute code in the software, the researchers said in a security advisory on Monday. Nuuo, describing itself as a provider of "trusted video management" software, offers a range of video solutions for surveillance systems in industries including transport, banking, government, and residential areas.
Dubbed "Peekaboo," the zero-day stack buffer overflow vulnerability, when exploited, allows threat actors to view and tamper with video surveillance recordings and feeds. It is also possible to use the bug to steal data including credentials, IP addresses, port usage, and the make & models of connected surveillance devices. In addition, the bug could be used to fully disable cameras and surveillance products. Peekaboo specifically impacts the NVRMini 2 NAS and network video recorder, which acts as a hub for connected surveillance products. When exploited, the product permitted access to the control management system (CMS) interface, which further exposes credentials of all connected video surveillance cameras connected to the storage system.
Dubbed "Peekaboo," the zero-day stack buffer overflow vulnerability, when exploited, allows threat actors to view and tamper with video surveillance recordings and feeds. It is also possible to use the bug to steal data including credentials, IP addresses, port usage, and the make & models of connected surveillance devices. In addition, the bug could be used to fully disable cameras and surveillance products. Peekaboo specifically impacts the NVRMini 2 NAS and network video recorder, which acts as a hub for connected surveillance products. When exploited, the product permitted access to the control management system (CMS) interface, which further exposes credentials of all connected video surveillance cameras connected to the storage system.
Link is broken for the CVE.
Only the State obtains its revenue by coercion. - Murray Rothbard
Why is your camera exposed to the internet?
With these sorts of devices just assume they will never get updates and *WILL* be rooted.
where "your" "hacker" reconfigured the video cameras. I remember one, Deux Ex something something. I spent hours being stealthy. Then hit my first boss, who was flat out combat. I did not have any combat skillz, I did not have combat weapons. Gave it maybe an hour over 3-4 days, never got close to defeating that boss.
:(
I was really enjoying that game too
Why would we bother posting something about a webserver vulnerability? The submission lacks anything useful to take action on or inform; you know like what the actual threat vector is. For all I knew we could just walk through security with a barcode on our tshirts and shut down cameras.
What is that you say? The threat vector is in a completely abandoned but always online webserver? You don't say! Who would have known!
Whats that? You say total system takeover and privilege escalation? The ability to run commands? Oh MY!
Next time how about we:
1) identify the actual threat, not some 20 year old journalist's stupid sensationalist bullshit
2) Perhaps identify if this pre-boxed crapware product is using something like an unpatched BSD or Linux inside
3) Note that reputable vendors have had patches out for years because they're not bad
4) Leave out the part about all the amazing things one can do with commandline access and programming skills; slashdot croud should already know how computers work.
Who is this that even the wind and the waves obey Him? Surely this computer must submit also!
This attack is on the remote monitoring system for the cameras. And yes, you do put your camera's on the internet. Most of us are not as rich as some an AC and can't run our own dedicated cable to monitor the cameras.
the on line ver the camera in speed