CCTV DVR Vulnerabilities Traced To Chinese OEM Which Spurned Researchers' Advice (softpedia.com) 51
An anonymous reader writes: RSA security researcher Rotem Kerner has identified a common vulnerability in the firmware of 70 different CCTV DVR vendors, which allows crooks to execute code and gain root privileges on the affected devices. The problem was actually in the firmware of just one DVR sold by Chinese firm TVT. The practice of "white-labeling" products helped propagate this issue to other "manufacturers" who did nothing more than to buy a non-branded DVR, tweaked its firmware, slapped their logo on top, and sold it a their own, vulnerability included.
This isn't a vulnerability (Score:2)
Re: (Score:3)
Clearly the FBI is happy about this one. They like vulnerable devices.
Of all the devices to gain root on I'm fairly certain a DVR is one of the lamest. Wake me up when someone does something interesting with it.
Re: (Score:2)
Aside from the benefits of owning a basic embedded linux box that is probably inside whatever pitiful perimeter security their network has, you get access to the video feeds from the security cameras and can both case the target from the
Re:This isn't a vulnerability (Score:4, Insightful)
A DVR which is backing the CCTV feed of surveillance cameras. Yup, totally boring.
Why, nobody would want to have access to the take from a bunch of surveillance cameras, right?
Or, this is the full on movie-scenario where the shadowy organization hacks into the video feeds of various places that every complains isn't realistic.
The endless stream of shitty security we keep hearing about has a lot of potential ways to be misused, and apparently very little stopping it.
Re: (Score:2)
This is all well and good but has this *ever* resulted in something bad happening? Anything bad? Has anyone ever cased a joint (I think that's the correct lingo) through these things and then erased the recording of their nefarious deeds after the act?
Don't read that wrong - the shit should be secure. I'm just not able to recall a point where this was actually a factor any crime. I imagine high-tech thieves may have spliced into stuff but that's entirely different than hacking it by remote. I did some of th
Re: (Score:3)
If these things are so trivially hacked, how would you know?
Everything from knowing if someone is away from home to actually erasing footage is entirely possible with this exploit. As much as we laugh at movies which show this, why would you assume it can't happen once you realize there's tons of these things with little or no security?
If it can be exploited it probably will. And if cameras have GPS, or you can somehow determine whose PVR you've hacked (which likely isn't that tough since you know the IP
Re: (Score:2)
I'd not make those assumptions - not that they *were* in use.
I'd take precautions against them but I'd not assume they were being used. I'm not sure how to articulate it better. Basically, I keep my video feeds behind hardware and require very specific means to access it. I literally, without changing things, can not give you a link to watch the feeds of my home in Maine. Well, I could give you a link and a port, specifically an IP address being pushed through a server, but even if you knew the password you
Re: (Score:2)
Sure, but you're smart and know about security and take precautions.
But all of the regular consumers out there, running this stuff without additional knowledge about security, behind routers which themselves are probably compromised (assuming they even have a firewall) ... I assume there are people out there who are potentially actively being exploited already.
I don't need to assume every single one is being exploited. But, really, a widely known exploit against commodity DVRs used to back CCTV? Yeah, tha
Re: (Score:2)
Of all the devices to gain root on I'm fairly certain a DVR is one of the lamest.
I take you haven't been watching Person of Interest. What the NSA could do with this and facial recognition is scary without AI.
Re: (Score:2)
I don't watch real television or movies, as a general rule, but I've seen that meme and/or demotivational. Sure they can. I believe they just use an enhance button.
You can see it for yourself. Just click anywhere on the page that isn't a link or a text field and then press and hold CTRL and then press the + button.
Re: (Score:1)
Re: (Score:2)
Up to your eyeballs in free labor, cotton, grandfathers, or black people?
Re: (Score:2)
CCTV, aka China Central Television, traced to the Chinese.
Realty?
I would stay away from Chinese realty. Costa Rica might be better.
Are Chinese CCTV Products To Be Trusted? (Score:4, Interesting)
Recent Foscam security cameras: http://krebsonsecurity.com/201... [krebsonsecurity.com]
IoT concerns: http://thenewstack.io/snooping... [thenewstack.io]
Re: (Score:3)
Short answer: No.
Long answer: Even Panasonic is building their CCTV products in China these days.
Different answer: These days, buying anything and hanging it on a network is inviting problems. Everything is sloppier than it used to be.
Re:Are Chinese CCTV Products To Be Trusted? (Score:4, Interesting)
You have to realize how things are done.
TVT makes a surveillance system setup - cameras, DVR, etc. They make it a turnkey system they can sell to people to build and sell. This is known as an "Original Design Manufacturer", or ODM.
A company comes and buys the design, builds the circuit boards and gets the firmware source code and builds that and ships it. These guys are the Original Equipment Manufacturer or OEM. Some people may take the design and build it as is with minimal changes, others may put in better lenses and redo the UI, etc.
Then there are companies like Panasonic who do their own designs and build them, who don't typically buy other people's designs.
The problem here is that Swann, Lorex and other cheap surveillance system companies bought the system from TVT, did their branding and that's it.
Companies like TVT don't deal with customers other than whoever buys their design. Their goal is to sell designs, so software is but a minor part of it, and when you're asked to kick out of a firmware you do it as quick as possible, security warts and all.
Re: (Score:1)
This is still better than the US Government (Score:3)
Which wants all device and operating system vendors to standardize on vulnerabilities on the assumption that only the "good guys" will know how to exploit them.
Re: (Score:3)
Nah, they're pretty good at starting wars or setting the situations up to be volatile enough to where war is the likely outcome.
Weak? Not at all. They've been warring since the dawn of recorded history in that area.
Which leads me to this... Going to war against China is going to be bad. Not just typical-bad 'cause it's war but a badness on a scale not seen in a very long time. Look at the percentage of casualties, displaced persons, and economic negative impacts of the larger wars. Now imagine that with a p
Not surprised, really (Score:5, Insightful)
The Chinese OEMs don't care about security or anything else. They are remarkably dense and will reject changes coming from anywhere. It's hard enough to get them to change anything when you're a paying customer, and if you do get them to change, the moment you are satisfied and think things are under control, they'll change it right back to the old way.
This is because the smart people want to be thought of as creative. When someone else is telling them what to do, they're not being creative and think they're being forced into being mindless slaves. Follow an established security vetting process? That's not what creatives do. That's following procedure, only factory assembly workers do that, and even then only because they are forced to do so. Also, being predictable violates the maxim that one should conceal one's true goals. They're not at war but the Sun Tzu thinking will tell.
Second, details are boring. If you're creative, you think of the effects you want the product to have, not the stupid security protocols it has to follow. And if the product is selling, who cares?
The Western customers who buy the OEM products are clueless about everything, that's why they're buying whitebox in the first place. We shouldn't blame them for security, although perhaps it's tempting. It's not like they can complain and get it fixed. If they make too much of a fuss the OEM will just point out that none of their other 70 customers has any problem and fire them as a customer.
Chinese software - what do you expect? (Score:1)
Is anyone at all surprised that the manufacturers don't care? - Chinese companies seem to place little value on software quality - once it's just good enough to be useable, out the door it goes and they have no interest in improving it.
This attitude is so widespread that I can only assume it must be some sort of cultural thing
Re: (Score:1)
So you're saying we've been successful at Americanizing the Chinese?
I got the T shirt. (Score:5, Interesting)
On my common cheapo 'H960 DVR' I used Nessus for discovery. /etc/password file.
Nessus navigated my directory structure via the web interface.
Nessus showed me the contents of the
It only took me a minute to google "rainbow table" and find JTR.
It took JTR less than 1/4 hour to crack the SIX CHARACTER password WITHOUT any rainbow tables.
It took me many many many emails to convince the distributor's cust. serv. that I was talking about an actual vulnerability.
I never expected it to be secure at the price I paid.
I'm glad I can root my box.
Now I can, if I choose, fix the shitty user interface.
I doubt the typical user would think it is a 'feature' as I do.
The fact that it BY DESIGN interfaces with an external server not under my control convinced me never to use the web features.
I knew that before the purchase, I wanted an offline recorder.
Oddly, the typical user DOES consider the remote server a feature. Most people hand a stranger the keys on day #1.
I have an inexpensive 'H.264 tribred' DVR that is slightly more secure. Provided I don't hand the keys to an unknown 3rd party.
Are there any secure alternatives? (Score:4, Insightful)
Is there anywhere you can buy IP cameras, DVRs, and NVRs that aren't made in China and full of vulnerabilities? Does any company offer secure security camera systems?
If anyone knows of any I'd love to hear about your experience with them. I've looked and even the "high-end" (aka expensive) name-brand devices like Sony and Panasonic have major security flaws like TVT firmware, HTTP only access, passwords stored on the device in plain text, etc.
We had to separate the camera systems at my company onto their own VLAN that can only be accessed from a few computers on our internal network or over our VPN. It is a pain but much better than letting anyone in the world onto our camera system. I want to replace all of them with something better, but it seems like OEM or branded its all the same insecure, never patched, never updated Chinese garbage.
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Yeah but VLAN support in switches these days is virtually ubiquitous even in SOHO switches. I got 16 ports of 1GbE goodness with VLAN, and link aggregation support for 75GBP the other week in the form of a Netgear GS116Ev2.
Re: (Score:3)
Re: (Score:1)
> Is there anywhere you can buy IP cameras, DVRs, and NVRs that aren't made in China and full of vulnerabilities? Does any company offer secure security camera systems?
Why yes! Exacq Technologies [exacq.com] (a Tyco Security Products company) makes DVR software (server, desktop client, web client, mobile client, enterprise management) and sells pre-built and configured servers, and American Dynamics, another Tyco company, makes IP cameras (the DVR of course works with many kinds of IP camera [exacq.com] besides AD).
Disclaimer:
Zoneminder is full-featured, -more- secure, open s (Score:5, Informative)
For the DVR and management interface, Zone Minder is THE open source solution and has been for a long time. It can do all kinds of things like run motion detection on the feeds and when motion is detected it turns on the light and pans your high-quality camera to view the area where the motion was.
It's -more- secure than the stuff made by Happy Fun Camera Ltd, in China, with instructions that read "button the press longly is record of picture motions", which also happens to be the exact same system sold under many brand names. I don't know that it's had a complete security audit, but it's better than Chinese "button the press longly ".
https://zoneminder.com/ [zoneminder.com]
As others have mentioned, configuring a separate video vlan (or ssid) which isn't connected to the internet will get you most of the way there for camera security. Your cheap consumer wifi router can do a no-internet ssid by using the parental control feature.
Re: (Score:2)
No first hand experience, but based on other products I expect good things from Ubiquity's NVR and cameras. The NVR is $300 and supports external USB drives, cameras are pretty much market rate.
Re: (Score:2)
I have video feeds running from and being recorded at my house (and pushing the stream off-site. All of it is indirect. The only way in, or to watch the live feeds, is through specific hardware, through a hardware firewall, and using a certain address. I did have it set to need a USB key at the same time (to login to the server that let me then tunnel into the video feeds) but I dropped that off. I would like to do timed authentication with a cell phone or email code. I've not yet figured that one out.
Comment removed (Score:3)