Florida Tech Students Reveal Security Flaws in 16 Popular Internet-Based Security and Doorbell Camer

guest · May 29, 2020

Florida Tech Students Reveal Security Flaws in 16 Popular Internet-Based Security and Doorbell Cameras
May 28, 2020
https://www.bitdefender.com/box/blo...lar-internet-based-security-doorbell-cameras/

A team of computer science students from Florida Tech has discovered privacy flaws in popular IoT devices, including Internet-enabled doorbells and security cameras.

In their paper, “Never Ending Story: Authentication and Access Control Design Flaws in Shared IoT Devices”, the researchers evaluated the “challenges of credential revocation and access control list modifications in a shared IoT ecosystem,” revealing vulnerabilities in 16 popular security cameras and doorbells that allow unauthorized access even after a shared account suffers credential modification or revocation.

During their tests, the team observed that the mechanism for removing user accounts on shared devices does not remove active user accounts. This security flaw would allow an attacker to preserve access to a system, secretly recording audio and video.
Additionally “4 of the 19 devices permitted access to IoT API servers after a password change,” researchers said.
Click to expand...

The ability to retain device access after a password change was reproduced on 16 out of 19 popular IoT cameras and doorbells, including: Blink Camera, Canary Camera, D-Link Camera, Geeni Mini Camera, Doorbell and Pan/Tilt Camera, Merkury Camera, Momentum Axel Camera, Nest Camera Current and Doorbell Current, NightOwl Doorbell, Ring Pro Doorbell Current and Standard Doorbell Current, SimpliSafe Camera and Doorbell and TP-Link Kasa Camera.
Click to expand...

The high demand and rapid expansion of IoT has its drawbacks. Widely known for poor authentication and access control designs, many IoT developers are struggling to patch and mitigate any security risks that sneak past initial testing. Vendors were also informed about the vulnerabilities, and strategies to mitigate the flaws have been provided.
Click to expand...

Paper: "Never Ending Story: Authentication and Access Control Design Flaws in Shared IoT Devices"
(PDF): https://9f2435ec-cf04-4cff-9ab6-6d1f72c292f8.filesusr.com/ugd/3dcd51_a0127b0928e9440694afcb734541abaa.pdf

Log in or Sign up

Florida Tech Students Reveal Security Flaws in 16 Popular Internet-Based Security and Doorbell Camer

guest Guest

Log in or Sign up

Florida Tech Students Reveal Security Flaws in 16 Popular Internet-Based Security and Doorbell Camer

guest Guest

Useful Searches