Slashdot Mirror
Over Nine Million Cameras and DVRs Open To APTs, Botnet Herders, and Voyeurs (zdnet.com)
Millions of security cameras, DVRs, and NVRs contain vulnerabilities that can allow a remote attacker to take over devices with little effort, security researchers have revealed today. From a report: All vulnerable devices have been manufactured by Hangzhou Xiongmai Technology Co., Ltd. (Xiongmai hereinafter), a Chinese company based in the city of Hangzhou. But end users won't be able to tell that they're using a hackable device because the company doesn't sell any products with its name on them, but ships all equipment as white label products on which other companies put their logo on top. Security researchers from EU-based SEC Consult say they've identified over 100 companies that buy and re-brand Xiongmai devices as their own. All of these devices are vulnerable to easy hacks, researchers say. The source of all vulnerabilities is a feature found in all devices named the "XMEye P2P Cloud." The XMEye P2P Cloud works by creating a tunnel between a customer's device and an XMEye cloud account. Device owners can access this account via their browser or via a mobile app to view device video feeds in real time. SEC Consult researchers say that these XMEye cloud accounts have not been sufficiently protected. For starters, an attacker can guess account IDs because they've been based on devices' sequential physical addresses (MACs). Second, all new XMEye accounts use a default admin username of "admin" with no password.
As an exhibitionist I regularly dance naked in front of my internet connected cameras. Unfortunately mine aren't on the list provided by ZDNet.
"That's the way to do it" - Punch
These are going to be illegal to sell in California. Ha!
Unfortunately mine aren't on the list provided by ZDNet.
So if can can summarize what you are saying here, the fundamental flaw revealed is that there's no submission page to get added your own cameras added to the list.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
But where's the content?
Links to 9 million streams or it didn't happen!
Well done.
I cannot tell if your serious or not.
Bad news. Your router was made in China and rebranded!
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
FTA"there is also a second hidden account with the username and password combo of default/tluafed". That sounds very deliberate.
When they came for the communists, I said "He's next door. Take him away. Goddam commies."
from big ad brands into more rooms.
We can trust the big ad brands.
Domestic spying is now "Benign Information Gathering"
The FTC should ask the largest retailers to remove these devices from their stores as an internet health hazard.
... to test my WiFi connections per the article: ... .bat file to the Desktop:
I run Who's On My Wifi. copied the IP column into Excel.
Where cell A1 is 192.168.000.001 cell B1 is ="start http://"&A1&"/err.htm"
For row 2 & 3:
192.168.000.002 ="start http://"&A2&"/err.htm"
192.168.000.004 ="start http://"&A3&"/err.htm"
etc
Then I copied the contents of column B into Notepad and saved as a
--
start http://192.168.000.019/err.htm
start http://192.168.000.001/err.htm
start http://192.168.000.002/err.htm
exit .bat file and it opened 37 instances of Firefox.
--
I executed the
The only two hits I got were for my R7000 Netgear Router login page (none of the usernames/passwords in TFA worked because I had changed them) and an error page on my Brother printer (did not look like error in TFA).
The other pages found nothing.
It little behooves the best of us to comment on the rest of us.
it's a sino-the-times. =/