Slashdot Mirror
Over Nine Million Cameras and DVRs Open To APTs, Botnet Herders, and Voyeurs (zdnet.com)
Millions of security cameras, DVRs, and NVRs contain vulnerabilities that can allow a remote attacker to take over devices with little effort, security researchers have revealed today. From a report: All vulnerable devices have been manufactured by Hangzhou Xiongmai Technology Co., Ltd. (Xiongmai hereinafter), a Chinese company based in the city of Hangzhou. But end users won't be able to tell that they're using a hackable device because the company doesn't sell any products with its name on them, but ships all equipment as white label products on which other companies put their logo on top. Security researchers from EU-based SEC Consult say they've identified over 100 companies that buy and re-brand Xiongmai devices as their own. All of these devices are vulnerable to easy hacks, researchers say. The source of all vulnerabilities is a feature found in all devices named the "XMEye P2P Cloud." The XMEye P2P Cloud works by creating a tunnel between a customer's device and an XMEye cloud account. Device owners can access this account via their browser or via a mobile app to view device video feeds in real time. SEC Consult researchers say that these XMEye cloud accounts have not been sufficiently protected. For starters, an attacker can guess account IDs because they've been based on devices' sequential physical addresses (MACs). Second, all new XMEye accounts use a default admin username of "admin" with no password.
Can't we occasionally be disappointed by another country?
On, the router, any new device has NO internet connectivity.
That is what VPNs are for. Something I can control.
Nothing IoT needs to actually connect to the internet directly.
does ms mash have one of these?
As an exhibitionist I regularly dance naked in front of my internet connected cameras. Unfortunately mine aren't on the list provided by ZDNet.
"That's the way to do it" - Punch
These are going to be illegal to sell in California. Ha!
Unfortunately mine aren't on the list provided by ZDNet.
So if can can summarize what you are saying here, the fundamental flaw revealed is that there's no submission page to get added your own cameras added to the list.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
But where's the content?
and pop some corn!
Because the underlying OSes wouldn't contain Chinese bugs!!!
Links to 9 million streams or it didn't happen!
Is laughable. None of them sound like anything I would want.
By Catalin Cimpanu for Zero Day | October 9, 2018 -- 15:35 GMT (08:35 PDT)
If only the editors had been looking at the webcam in Catalin Cimpanu's office as he was writing this article, Slashdot might've posted this when it was fresh.
Sigh.
I bet at least one is a parent's security camera in their teen's bedroom with the kid [censored]ing his girlfriend for all to see. Feds love busting k1dd13 p0rn makers even if the people aren't aware that they are making it.
I had these cameras before and the easiest fix was to set the "call home" address in the DNS to 127.0.0.1, or set a bad default gateway on the cameras themselves. The issue is with folks being able to break into the camera via the cloud app so stop the camera from talking to the cloudapp and you stop them from getting to the camera. I know it's not an idea situation if you only have one or two and want to be able to remote monitor but if you have dozens installed then you're not accessing the cameras individually anyway, you're going through some DVR interface which has a single entrance point which should be easier to secure. The other reason this was/is rampant was that many admins weren't changing the default userid and the password (if they set one at all) was very simple. It's just like any other device on the network, if it's exposed to the outside or has the capability to be, then it needs to be properly secured.
FTA"there is also a second hidden account with the username and password combo of default/tluafed". That sounds very deliberate.
When they came for the communists, I said "He's next door. Take him away. Goddam commies."
from big ad brands into more rooms.
We can trust the big ad brands.
Domestic spying is now "Benign Information Gathering"
The FTC should ask the largest retailers to remove these devices from their stores as an internet health hazard.
... to test my WiFi connections per the article: ... .bat file to the Desktop:
I run Who's On My Wifi. copied the IP column into Excel.
Where cell A1 is 192.168.000.001 cell B1 is ="start http://"&A1&"/err.htm"
For row 2 & 3:
192.168.000.002 ="start http://"&A2&"/err.htm"
192.168.000.004 ="start http://"&A3&"/err.htm"
etc
Then I copied the contents of column B into Notepad and saved as a
--
start http://192.168.000.019/err.htm
start http://192.168.000.001/err.htm
start http://192.168.000.002/err.htm
exit .bat file and it opened 37 instances of Firefox.
--
I executed the
The only two hits I got were for my R7000 Netgear Router login page (none of the usernames/passwords in TFA worked because I had changed them) and an error page on my Brother printer (did not look like error in TFA).
The other pages found nothing.
It little behooves the best of us to comment on the rest of us.
There are quite a few of these out there, but nobody seems to have used them for a while.
We have 6 jobs with them installed that we're now revisiting and offering to upgrade the DVR.
The other issue is that since everyone rebrands, nobody ever has upgraded firmware for them