Authentication bypass bug exposes Foscam webcams to unauthorized access

Remote users can access the video stream without a username and password

The software used by many wireless IP cameras manufactured by Foscam Digital Technologies have a vulnerability that allows remote users to access their video streams and take snapshots without proper authentication.

The issue was reported on the Foscam technical support forum this week by the owner of a Foscam FI8905W Wireless IP Camera that's built for outdoor environments.

"I discovered fairly early in my testing, that the user could just press OK in the dialogue window without filling in a user or password and they would be taken to the image," a user with the nickname SENWiEco said Monday. The camera was running the latest firmware version at the time --, he said.

A regular forum user and software developer named Don Kennedy who uses the nickname TheUberOverLord subsequently investigated the issue and concluded that other indoor and outdoor camera models from Foscam's MJPEG series have the same issue. Kennedy tracked down the problem to the software's user management system.

Foscam MJPEG cameras support as many as eight separate user accounts with different privileges: Administrator, Operator and Visitor. The user administration interface has eight user ID fields, but only one of them is configured by default with user name "admin" and privilege Administrator. The rest are blanked out and have the Visitor privilege assigned by default.

According to Kennedy, if any of the eight user slots is left empty -- with no username and password configured -- it's possible to access the camera by simply hitting OK on the authentication prompt. This will give the remote user Visitor privileges and allow them to access video streams with or without audio, take snapshots and execute any CGI commands available to the Visitor access level.

A workaround is to manually configure user names and passwords for all eight user ID fields, Kennedy said. However, this has the downside of exposing the camera to denial-of-service attacks.

According to Kennedy, there's a second bug that causes the camera to freeze after a certain number of failed attempts to access the camera without a user name and password. In this happens, the camera owner might need to restart the camera by powering it down and back up, he said.

This could be inconvenient, especially since many of these cameras are set up so they can be monitored remotely, so their owners might not immediately have physical access to them.

The issue appears to be restricted to system firmware version .54 for the MJPEG Indoor and Outdoor camera models, Kennedy said Monday on the forum. "The following MJPEG based camera models have a system firmware version of .54 currently released: FI8904W, FI8905E, FI8905W, FI8906W, FI8907W, FI8909W, FI8910E, FI8910W, FI8916W, FI8918W and FI8919W," he said at the time.

However, it appears that Foscam released firmware version .55 for some of those camera models Thursday. The firmware update is available for download from the company's website and its changelog file specifies that it fixes a bug allowing the execution of CGI commands without authentication. The update also prevents using blank spaces in the user name field and adds support for special characters in passwords.

In an update on the Foscam forum, Kennedy confirmed that version .55 of the firmware fixes the unauthorized access vulnerability. However it does not resolve the camera freeze issue, he said.

This means an attacker who repeatedly tries to access Internet-facing cameras running the new .55 firmware version with a blank user name and password might end up temporarily disabling those cameras.

Foscam did not immediately respond to an inquiry seeking clarifications about which affected models haven't received the .55 firmware update and the denial-of-service issue.

A security notice on the company's U.S. website that appears to be updated periodically currently reads: "Foscam is fully committed to maintaining the safety and integrity of our user experience and will take all action reasonably necessary to ensure the privacy and security of our cameras. As soon as a security vulnerability is revealed Foscam endeavors to immediately release a firmware update to fix the issue. As of January 19, 2014, there are no known vulnerabilities with any of our cameras once updated with the latest firmware as outlined below. All cameras currently sold by are upgraded with the latest firmware."

In the same message the company recommends changing the default user name and password of the camera, changing the default port for remote access and regularly checking the camera's logs, which can reveal unauthorized access attempts.

In April, security researchers from Qualys reported several security weaknesses in Foscam cameras and said that using the Shodan search engine they were able to find more than 100,000 cameras connected to the Internet. They estimated at the time that two out of every 10 of those cameras allow users to log in with the default "admin" user and no password.

Join the CSO newsletter!

Error: Please check your email address.

Tags patchesintrusionFoscam Digital TechnologiessecurityAccess control and authenticationExploits / vulnerabilitiesprivacyqualys

More about CGIQualys

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place