Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Software Technology

Hackers Hijack Surveillance Camera Footage With 'Peekaboo' Zero-Day Vulnerability (zdnet.com) 25

Posted by BeauHD from the hide-and-seek dept.
An anonymous reader quotes a report from ZDNet: A zero-day vulnerability present in security cameras and surveillance equipment using Nuuo software is thought to impact hundreds of thousands of devices worldwide. Researchers from cybersecurity firm Tenable disclosed the bug, which has been assigned as CVE-2018-1149. The vulnerability cannot get much more serious, as it allows attackers to remotely execute code in the software, the researchers said in a security advisory on Monday. Nuuo, describing itself as a provider of "trusted video management" software, offers a range of video solutions for surveillance systems in industries including transport, banking, government, and residential areas.

Dubbed "Peekaboo," the zero-day stack buffer overflow vulnerability, when exploited, allows threat actors to view and tamper with video surveillance recordings and feeds. It is also possible to use the bug to steal data including credentials, IP addresses, port usage, and the make & models of connected surveillance devices. In addition, the bug could be used to fully disable cameras and surveillance products. Peekaboo specifically impacts the NVRMini 2 NAS and network video recorder, which acts as a hub for connected surveillance products. When exploited, the product permitted access to the control management system (CMS) interface, which further exposes credentials of all connected video surveillance cameras connected to the storage system.
This discussion has been archived. No new comments can be posted.

Hackers Hijack Surveillance Camera Footage With 'Peekaboo' Zero-Day Vulnerability More

Hackers Hijack Surveillance Camera Footage With 'Peekaboo' Zero-Day Vulnerability

Comments Filter:

  • Link is broken for the CVE.

  • why? (Score:1)

    by Anonymous Coward

    Why is your camera exposed to the internet?

    With these sorts of devices just assume they will never get updates and *WILL* be rooted.

    • The Internet (that's the place we are at right now and stuff) provides us with remote access to video footage.

      • But why?

        No, seriously, the majority of cameras are not online.

        It's like asking "why are your curtains open". It's a choice.

        • You can't think of a single reason to look at a remote camera on your phone?

        • Re: (Score:1)

          by Anonymous Coward

          I work in retail so I'll use a few examples from the industry.

          1.) Long term archive - these systems have a limited capacity so they will overwrite the oldest footage as needed. Depending on the setup, this may be weeks or even days. With an internet connection it is possible to upload to a longer term, higher capacity storage system.
          2.) Employee investigation - if an employee is suspected of theft, the last thing you want is for said employee to potentially see someone viewing footage. If done off site,

        • Parents checking up on children while they are at work. Keeping track of contractors working on your property. Motion detector that starts recording notifies you that there is someone on your property while you are at work. You go live to verify.

    • I think the official answer is something along the lines of "Fuck you, Nerd! We didn't buy your shit to learn stuff!"

    • This attack is on the remote monitoring system for the cameras. And yes, you do put your camera's on the internet. Most of us are not as rich as some an AC and can't run our own dedicated cable to monitor the cameras.

    • Re: why? (Score:1)

      by Anonymous Coward

      Yeah I'm not sure why there isn't better setups being used.

      I have 4 security cameras monitoring my elderly parents house (they had some break ins to their garage and yard), managed by a small server running FreeBSD. It's very hardened and allows no connections to the server (camera system), it only allows outbound connections to port 22 and it uploads to my server via ssh (scp). So it's never allowed to be controlled remotely.

      I can't see anything real-time but the camera system is designed to take photos an

  • where "your" "hacker" reconfigured the video cameras. I remember one, Deux Ex something something. I spent hours being stealthy. Then hit my first boss, who was flat out combat. I did not have any combat skillz, I did not have combat weapons. Gave it maybe an hour over 3-4 days, never got close to defeating that boss.

    I was really enjoying that game too :(

  • Why would we bother posting something about a webserver vulnerability? The submission lacks anything useful to take action on or inform; you know like what the actual threat vector is. For all I knew we could just walk through security with a barcode on our tshirts and shut down cameras.

    What is that you say? The threat vector is in a completely abandoned but always online webserver? You don't say! Who would have known!

    Whats that? You say total system takeover and privilege escalation? The ability to r

  • the on line ver the camera in speed

Slashdot Top Deals

What is research but a blind date with knowledge? -- Will Harvey

Close