Widely used wireless IP cameras open to hijacking over the Internet, researchers say

Wireless IP cameras from Foscam and other vendors have serious security issues, researchers said at Hack in the Box

Thousands of wireless IP cameras connected to the Internet have serious security weaknesses that allow attackers to hijack them and alter their firmware, according to two researchers from security firm Qualys.

The cameras are sold under the Foscam brand in the U.S., but the same devices can be found in Europe and elsewhere with different branding, said Qualys researchers Sergey Shekyan and Artem Harutyunyan, who analyzed the security of the devices and are scheduled to present their findings at the Hack in the Box security conference in Amsterdam on Thursday.

Tutorials provided by the camera vendor contain instructions on how to make the devices accessible from the Internet by setting up port-forwarding rules in routers. Because of this, many such devices are exposed to the Internet and can be attacked remotely, the researchers said.

Finding the cameras is easy and can be done in several ways. One method involves using the Shodan search engine to search for an HTTP header specific to the Web-based user interfaces of the cameras. Such a query will return more than 100,000 devices, the researchers said.

The vendors selling these cameras also have them configured to use their own dynamic DNS services. For example, Foscam cameras get assigned a hostname of the type [two letters and four digits].myfoscam.org. By scanning the entire *.myfoscam.org name space an attacker could identify most Foscam cameras connected to the Internet, the researchers said.

Around two out of every 10 cameras allow users to log in with the default "admin" user name and no password, the researchers said. For the rest that do have user-configured passwords, there are other ways to break in.

One method is to exploit a recently discovered vulnerability in the camera's Web interface that allows remote attackers to obtain a snapshot of the device's memory.

This memory dump will contain the administrator user name and password in clear text along with other sensitive information like Wi-Fi credentials or details about devices on the local network, the researchers said.

Even though the vendor has patched this vulnerability in the latest firmware, 99 percent of Foscam cameras on the Internet are still running older firmware versions and are vulnerable, they said. There is also a way to exploit this vulnerability even with the latest firmware installed if you have operator-level credentials for the camera.

Another method is to exploit a cross-site request forgery (CSRF) flaw in the interface by tricking the camera administrator to open a specifically crafted link. This can be used to add a secondary administrator account to the camera.

A third method is to perform a brute-force attack in order to guess the password, because the camera has no protection against this and the passwords are limited to 12 characters, the researchers said.

Once an attacker gains access to a camera he can determine its firmware version, download a copy from the Internet, unpack it, add rogue code to it and write it back to the device.

The firmware is based on uClinux, a Linux-based operating system for embedded devices, so technically these cameras are Linux machines connected to the Internet. This means they can run arbitrary software like a botnet client, a proxy or a scanner, the researchers said.

Since the cameras are also connected to the local network, they can be used to identify and remotely attack local devices that wouldn't otherwise be accessible from the Internet, they said.

There are some limitations to what can be run on these devices since they only have 16MB of RAM and a slow CPU and most of the resources are already used by its default processes. However, the researchers described several practical attacks. One of them involves creating a hidden backdoor administrator account that's not listed on the Web interface.

A second attack involves modifying the firmware to run a proxy server on port 80 instead of the Web interface. This proxy would be set up to behave differently depending on who's connecting to it.

For example, if the administrator accesses the camera over port 80 the proxy would display the regular Web interface because the administrator wouldn't have his browser configured to use the camera's IP address as a proxy. However, an attacker who configures their browser in this manner would have their connection tunneled through the proxy.

A third attack scenario involves poisoning the Web interface to load a remotely hosted piece of JavaScript code. This would allow the attacker to compromise the camera administrator's browser when he visits the interface.

The researchers released an open-source tool called "getmecamtool" that can be used to automate most of these attacks, including injecting executable files into the firmware or patching the Web interface.

The only thing that the tool doesn't automate is the authentication bypass attacks, the researchers said. The tool requires valid log-in credentials to be used for the targeted camera, a measure the researchers took to limit its abuse.

The cameras are also susceptible to denial-of-service attacks because they can only handle around 80 concurrent HTTP connections. Such an attack could be used, for example, in order to disable the camera while performing a robbery, the researchers said.

The best thing is for these cameras not to be exposed to the Internet, the researchers said. However, if this is needed, then the cameras should be deployed behind firewalls or intrusion prevention systems with strict rules.

Access to them should only be allowed from a limited number of trusted IP addresses and the maximum number of concurrent connections should be throttled, they said. Isolating the cameras from the local network is also a good idea, in order to prevent them from being abused to attack local devices.

Join the CSO newsletter!

Error: Please check your email address.

Tags consumer electronicsNetworkingsecuritywirelessHITBAccess control and authenticationspywareExploits / vulnerabilitiesqualys

More about LinuxQualys

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place