IZON IP Cameras Riddled With Security Flaws 55
An anonymous reader writes "With recent action by the FTC against TRENDnet, the 'Internet of Things' has taken a sharp turn in the eyes of the public and government with regard to security. This week, Duo Security employee Mark Stanislav presented security research he did on the IZON IP camera from Stem Innovation. Through his testing, Mark found hardcoded credentials for Linux accounts (accessible by Telnet; Yes, — really), an undocumented web interface allowing for viewing a camera's stream (also with hardcoded credentials, user/user), and a variety of other failings including a lack of cryptography in most of the camera's functionality, including when uploading videos to Amazon Web Services's S3 storage." According to the above-linked article, "Contacted by The Security Ledger, Stem Innovation CTO Matt McBeth said that the IZON firmware, server system and iOS applications tested by Stanislav have since been updated, and that the research contains “inaccurate and misleading information.” Stem did not provide specific information about any inaccuracies."
Izon (Score:2)
Who cares about izon?
You really need to worry more about dogs named Skippy.
Re: (Score:1)
This camera is also only for Apple pad/pod/phone users and these people don't really worry about security. They are happy with security by obscurity.
Re: (Score:2)
No cookie for you.
You completely missed my reference to Cube 2.
Re: (Score:2)
I am sorry. I don't play games so I'm not familiar with Cube 2 (I assume now that Skippy is a character in that game).
So yes, I completely missed it... no cookies.
Re: (Score:2)
I'm pretty sure he's referring to the movie: http://en.wikipedia.org/wiki/Cube_2:_Hypercube [wikipedia.org]
A person worked at a company called Izon Research Affiliates, and had a dog named Skippy.
Re: (Score:3)
...so do a lot of things - who gives a shit!
People that like to be able to watch what goes on inside their homes when they're gone, but don't want every spook and perv on the planet to be able to as well?
Do we really need a new story for each one of these?
How else would you know about it?
Man, it seems the trolls are running out of material these days.
Re: (Score:3)
This is just a consumer-grade device, I'm more worried about actual supposedly "professional grade" security cameras. For example the IQInvison cameras all have the hard-coded username/password of root/system and YOU CAN'T CHANGE IT. Several cameras can only take 6-8 character lower case alpha-numeric passwords. Many of them have root or system as their only user. Only Axis and Pelco seem to have a clue that a security device should actually be secure.
Re: (Score:1)
Well if they actually did have security then you couldn't troll google looking for active webcams like this one http://susandennis.axiscam.net/view/viewer_index.shtml?id=1304 [axiscam.net]
Re: (Score:2)
That's an Axis camera, they could have required a login to view the image, it's just a check box. At least the Setup password appears to be something not-default, which is not surprising because Axis cameras require the user to create a password on first login (unlike a **LOT** of other cameras.) Considering the domain listed it's likely that it's actually intended to be viewable by anyone.
Damn that's ugly furniture.
Re: (Score:2)
To boot, it isn't hard to make decent security. I was using NetBotz over ten years ago and never have heard of any security problems with their design.
Re: (Score:2)
People that like to be able to watch what goes on inside their homes when they're gone
Hard to believe that for thousands of years people went out without having the ability to watch what was going on inside their homes when they were gone. How ever did they manage?
Re: (Score:2)
I won't bother pointing out loads of nice things we didn't have before that, having now, has made us a lot happier,safer, more productive or just plain given us new experiences. Even so, I wouldn't mind having something like this so that when the motion alert popped on my phone I could eyeball the screen to see if it was the cat, the kids coming home or that spree burglar who's been making short work of the neig
Re: (Score:2)
People that like to be able to watch what goes on inside their homes when they're gone
Hard to believe that for thousands of years people went out without having the ability to watch what was going on inside their homes when they were gone. How ever did they manage?
Dogs.
Re: (Score:2)
People should know about these backdoors, no question.
On the other hand, the first linked story about the FTC crackdown on TrendNet makes no sense what so ever, when another branch of the government makes it their business to crack every possible privacy protection of anyone in the world.
Re: (Score:2)
"I would argue that this is an especially egregious flaw in something likely to be used in a security context, and perhaps by people unaware of these backdoors. So, in this instance, yes, I think it's a public service."
In TV shows and movies the local 'hacker' can get to these cameras in about 3.2 seconds and now we know why.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:Product X has security flaw... (Score:4, Interesting)
A back door is not a security flaw. It's there by design not by accident.
A backdoor is a security flaw if
a) the owners are not told that it is there (or)
b) the owners can not turn it off (or)
c) if the FTC says it is.
There are (deliberately vague) promises about security made on the IZON site.
IZON lets you watch & listen from anywhere, with secure access to the IZON video stream.
To not reveal a backdoor account has already been found by the FTC (see first link) as a violation which
gets you 20 years worth of monitoring: Per the FTC in the TrendNet case:
The company also is required to obtain third-party assessments of its security programs every two years for the next 20 years.
Farmed Out Too Much Code? (Score:5, Interesting)
I'll be generous and guess that IZON farmed out too much of their software development to ... wherever. Perhaps the company's principals are more hardware oriented, but it's interesting that they're now advertising for an iOS team lead.
Re: (Score:2)
IZON... Stem Innovation, whoever.
Re: (Score:3)
Obvious, and products are always like this. (Score:5, Interesting)
Re: (Score:2)
Re:Obvious, and products are always like this. (Score:5, Funny)
It's readable. Post it!
Re: (Score:3)
Re: (Score:3)
To this, you have to add the distinct possibility that the intent was to leave a back door on purpose so that the tech support staff did not have to issue an RMA for users that simply forgot their password.
(Yes, a simple hardware reset switch would do, but that can actually be harder to do as you have to support a wipe-able storage for that).
Re: (Score:2)
You're overthinking this. The reset switch in any bit of modern consumer goods just signals the software (usually with a GPIO pin or similar) that it has been pushed. The software then behaves however it is programmed to behave based on this condition.
Simple hardware reset switches went away when battery-backed CMOS RAM got replaced with flash EEPROM for storage of conf
Re: (Score:2)
They are always like this - especially if the vendors can keep the source secret. I've taken to running VLAN's at home - mostly WNDR3800 refurbs ($50 w/ Prime) [amazon.com] running OpenWRT and GS-108T switches [amazon.com] (poor GUI, but linux inside), feeding to a pfSense instance. Anything that's not all open source goes on an isolated VLAN that can't get traffic to or from anywhere without an explicit rule. pfSense makes it pretty easy to set up a VPN to get to data on the inside, so outside ports don't need to be open.
I set i
BINGO! (Score:2)
Oh, how many of this story fills out spots on the Public Relations Security Bingo [crypto.com] game? I counted four. You have to refresh to get all of the possible options; there are more than fit on any one card :)
Got one... (Score:2)
Anybody that would think these systems offer any level of security is only kidding themselves. They are a simple convenience to avoid needing to set up a VPN for trivial data. I wish I could find a better solution, but for a camera that sits in the window looking at the street not especially worried.
Re: (Score:1)
Because people routinely do dumb things.
I worked at Stem Innovation on IZON (Score:5, Insightful)
Until the really awfully managed company decided to outsource all of the software development to contractors. This was after wiping out the team in place before I joined. They are a very unstable company, which really favors knee-jerk decision making. I'm not surprised by any of this, the company is run by the idiot kid of a rich guy who doesn't know the first thing about tech. The hardware was well designed by the CTO, who apparently isn't able to steer the technology decisions of the company. Unfortunate. He's a good guy. But the company is ultimately helmed by the CEO, and he's a fat fucking moron.
iDevices only? (Score:1)