Over nine million cameras and DVRs open to APTs, botnet herders, and voyeurs

guest · Oct 9, 2018

Over nine million cameras and DVRs open to APTs, botnet herders, and voyeurs
October 9, 2018
https://www.zdnet.com/article/over-...dvrs-open-to-apts-botnet-herders-and-voyeurs/

Millions of security cameras, DVRs, and NVRs contain vulnerabilities that can allow a remote attacker to take over devices with little effort, security researchers have revealed today.

All vulnerable devices have been manufactured by Hangzhou Xiongmai Technology Co., Ltd.(Xiongmai hereinafter), a Chinese company based in the city of Hangzhou.

All of these devices are vulnerable to easy hacks, researchers say. The source of all vulnerabilities is a feature found in all devices named the "XMEye P2P Cloud."

Xiongmai devices have been abused in the past by IoT botnets, [...] SEC Consult claim in a report published today that the Chinese company hasn't invested in security since patching the vulnerabilities exploited by the Mirai malware in late 2016.
Click to expand...

ronjor · Oct 9, 2018

What do we do with a company that regularly pumps metric tons of virtual toxic sludge onto the Internet and yet refuses to clean up their act? If ever there were a technology giant that deserved to be named and shamed for polluting the Web, it is Xiongmai — a Chinese maker of electronic parts that power a huge percentage of cheap digital video recorders (DVRs) and Internet-connected security cameras.
Click to expand...

https://krebsonsecurity.com/2018/10/naming-shaming-web-polluters-xiongmai/

https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06

guest · Feb 6, 2020

Researcher: Backdoor mechanism still active in many IoT products
Researcher says a backdoor mechanism in devices running Xiongmai firmware is still active years after first being discovered
February 4. 2020
https://www.zdnet.com/article/researcher-backdoor-mechanism-still-active-in-many-iot-products/

Russian security researcher Vladislav Yarmak has published today details about a backdoor mechanism he discovered in Xiongmai firmware, used by millions of smart devices across the globe, such as security cameras, DVRs, NVRs, and others.
A firmware fix is not currently available as Yarmak did not report the issue to the company, citing a lack of trust in the vendor to properly fix the issue.

In a detailed technical rundown that Yarmak published on Habr earlier today, the security researcher says the backdoor mechanism is a mash-up of four older security bugs/backdoors that were initially discovered and made public in March 2013, March 2017, July 2017, and September 2017 -- and which the vendor failed to adequately fix.

In the case that device owners can't afford the price of new equipment, Yarmak recommends that users "should completely restrict network access to these devices to trusted users," especially on device ports 23/tcp, 9530/tcp, 9527/tcp -- the ports that can be exploited in attacks.
Click to expand...

Log in or Sign up

Over nine million cameras and DVRs open to APTs, botnet herders, and voyeurs

guest Guest

ronjor Global Moderator

guest Guest

Log in or Sign up

Over nine million cameras and DVRs open to APTs, botnet herders, and voyeurs

guest Guest

ronjor Global Moderator

guest Guest

Useful Searches