Bitdefender researchers have found a “massive” vulnerability in over 175,000 internet connected cameras from the Shenzhen Neo Electronics company in China. Once exploited, the vulnerability allows them to be accessed for anything from remote viewing, recruited into a malicious botnet, or even used as a hub to attack other connected devices, internet connected or not, within that network.
The hack itself is trivial and it’s type has been found on many “secure” websites and internet connected devices for years. A large portion of the cameras can even be discovered via a site called Shodan, a search engine specifically for finding Internet of Things (IoT) devices, making the vulnerability of significant note. With some of the Shenzhen products being low cost, it’s no surprise to learn that they exist all over world and not just limited to China.
Two specific products from Shenzhen Neo have been examined in depth, the iDoorbell and the NIP-22, both found to contain several buffer overflow vulnerabilities; some even before the authentication process. They can allow remote execution of arbitrary code, which in effect means just about anything can be done and the attacker doesn’t even need to be logged into the internet connected device. By simply attempting the login process, the flaw can be exploited. You may never even know if someone had managed to hack it.
The vulnerability is being put down to poor quality control, which is not uncommon for off-brand products coming out of China. So how does one ensure the internet connected device they have purchased and installed is secure? With so many of these devices on the market, the answer is unclear. It’s almost impossible to stay on top of every manufacturer and there is every chance more vulnerabilities will be discovered in the future.
The best way is to secure your network to begin with and avoid exposing IoT devices, especially cameras or cheap off-brand products, to the internet at all.
Need help with securing your network? Let us know!
