The researchers at Kaspersky Lab ICS CERT decided to check the popular Hanwha SmartCams and discovered 13 vulnerabilities.
Wikipedia describes
Attack Surface, as “[the] sum of the different points (the “attack vectors”) where an unauthorized user (the “attacker”) can try to enter data to or extract data from an environment.”
Basically, the more points there are to compromise a system, the more likely the system will be compromised. In the Internet of Things (IoT) development, the potentially vulnerable points correlate to features — and the
Hanwha SNH-V6410PN/PNW SmartCam has a lot of them.
A few of the features listed on the manufacturer’s website: remote control from your smartphone via wifi, two-way communication via built-in microphone, record video or still images to your smart device, event notification.
All of these present a potential vulnerability point to be exploited. In the case of this Samsung-branded SmartCam, it looks like all of them are vulnerable as security researcher Kaspersky documented 13 separate vulnerabilities:
- Use of insecure HTTP protocol during firmware update
- Use of insecure HTTP protocol during camera interaction via HTTP API
- An undocumented (hidden) capability for switching the web interface using the file ‘dnpqtjqltm’
- Buffer overflow in file ‘dnpqtjqltm’ for switching the web interface
- A feature for the remote execution of commands with root privileges
- A capability to remotely change the administrator password
- Denial of service for SmartCam
- No protection from brute force attacks for the camera’s admin account password
- A weak password policy when registering the camera on the server samsungsmartcam.com. Attacks against users of SmartCam applications are possible
- Communication with other cameras is possible via the cloud server
- Blocking of new camera registration on the cloud server
- Authentication bypass on SmartCam. Change of administrator password and remote execution of commands.
- Restoration of camera password for the SmartCam cloud account
This looks like a lot of vulnerabilities but is not surprising when you have an IoT device that offers a wide range of features like the SmartCam. Combining hardware that acts like a web server, with a cloud server, streaming video and audio and support mobile application creates a lot of places to make mistakes.
..
..
..
..
