Trivial backdoor found in HiSilicon's firmware for net-connected cams, recorders

guest · Feb 4, 2020

Trivial backdoor found in HiSilicon's firmware for net-connected cams, recorders
February 4, 2020
https://www.theregister.co.uk/2020/02/04/hisilicon_camera_backdoor/

This security blunder could be exploited over the local network to inject commands into vulnerable devices.

A hardware probester going by the name of Vladislav Yarmak explained on Monday how the tech giant left a remote access tool in firmware used in network-connected video recorders and security cameras. Of equal concern is the fact that HiSilicon seems uninterested in closing the hole, since it still hasn't addressed a similar vulnerable discovered and reported in 2017.

The firmware opens a service on TCP port 9530. You connect to this port, and exchange some data to agree upon a randomly generated session key that's used to encrypt the rest of your communications with the software.
[...] You then connect to that remote service with the username root and password 123456 – [...] and you're in as the superuser [...]
Click to expand...

Here's how Yarmak put it:

"It is not practical to expect security fixes for the firmware from the vendor. Owners of such devices should consider switching to alternatives.
[...] earlier researches indicate there is no confidence other services implementation is solid and doesn't contain RCE [remote code execution] vulnerabilities.
Click to expand...

Log in or Sign up

Trivial backdoor found in HiSilicon's firmware for net-connected cams, recorders

guest Guest

Log in or Sign up

Trivial backdoor found in HiSilicon's firmware for net-connected cams, recorders

guest Guest

Useful Searches