Passwords for Tens of Thousands of Dahua Devices Cached in IoT Search Engine

guest · Jul 15, 2018

Passwords for Tens of Thousands of Dahua Devices Cached in IoT Search Engine
July 15, 2018
https://www.bleepingcomputer.com/ne...of-dahua-devices-cached-in-iot-search-engine/

Discovered by Ankit Anubhav, Principal Researcher at NewSky Security, a cyber-security company specialized in IoT security, these passwords are for Dahua DVRs running very old firmware that is vulnerable to a five-year-old vulnerability.

The vulnerability has been known since 2013 and has been since patched, but many Dahua device owners have failed to update their equipment, and even to this day have continued to deploy DVRs running the antiquated firmware online.
Dahua passwords indexed in ZoomEye
But while this sounds pretty bad, things are actually worse. Earlier this week, Anubhav discovered that IoT search engine ZoomEye has been indexing these Dahua devices in a peculliar manner.

"The matter of fact is that a hacker doesn't need to exploit this vulnerability because as ZoomEye scans port 37777, it passes these special bytes and cache the output in plaintext, so a hacker just needs to go to ZoomEye, create a free account, and scrap results to get the credentials," Anubhav told Bleeping Computer in a private conversation.
Click to expand...

Log in or Sign up

Passwords for Tens of Thousands of Dahua Devices Cached in IoT Search Engine

guest Guest

Log in or Sign up

Passwords for Tens of Thousands of Dahua Devices Cached in IoT Search Engine

guest Guest

Useful Searches