Menu
Firmware bug in CCTV software may have given POS hackers a foothold

Firmware bug in CCTV software may have given POS hackers a foothold

Surveillance cameras could provide hackers with a foothold into networks

A researcher with RSA says faulty firmware found in security cameras sold by at least 70 vendors may be a contributor to many of the credit card breaches that have proved costly to retailers.

Rotem Kerner based his research on a paper RSA published in December 2014 into a malware nicknamed Backoff, which steals payment card details processed by point-of-sale systems.

The U.S. Secret Service and Department of Homeland Security warned in August 2014 that upwards of 1,000 U.S. businesses may have been infected with Backoff.

The advisory came after a hard year in which many major retailers became victims of large payment card breaches, including Target, Neiman Marcus, Michaels and UPS Store.

Kerner looked at the technical data RSA had collected from computers that were infected with Backoff. Strangely, many were running small Web servers with open ports on 81, 82 and 8000.

The software, named "Cross Web Server," proved to be for CCTV DVR (digital video recorder) equipment, which is widely used by retailers for physical monitoring. But the server software was left running and open to the Internet, which is a potential security risk.

Shodan, a search engine for finding networked devices open to the Internet, turned up 30,000 machines running the same software, according to Kerner's writeup.

Kerner figured out the Web server software was made by a Chinese company called TVT. He downloaded a version of the firmware for the CCTV DVR devices from the company's website.

Probing the firmware, he found a weakness in the code that would allow him to get remote access to the device through a malicious URI.

The big security problem is that this kind of software shouldn't be accessible from the public Internet. The mere presence of camera software left open to the Internet can help attackers identify a particular network and figure out if one belongs to a retailer.

Access to the device itself could help in gaining entry to the broader network, which could eventually lead to payment processing systems.

"When the old fashion thieves used to physically break into stores, on their way to the cashier they had to try and avoid or neutralize any surveillance equipment," Kerner wrote. "The digital thieves are entering the store through them. Truly Hollywood material."

His investigation turned up at least 70 manufacturers that use the same firmware, which he listed in a writeup. Kerner tried but failed to reach officials at TVT to warn them of the vulnerability, so he decided to publicly disclose the problem.

TVT officials could not be immediately contacted via email on Thursday.

It's not uncommon for firmware -- which is low-level code -- to be licensed and used by many vendors for products such as routers, IP cameras and some consumer electronics.

But it's well-known that vendors are notoriously lax about creating patches. As Werner put it: it's hard to rely on a vendor's patch "to arrive at your doorstep." Adding to the complexity is that each vendor may use the firmware in many different models.

Werner's recommended defense for those running these types of cameras is to "deny any connection from an unknown IP address to the DVR services."


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

Hundreds of leaders from the New Zealand IT industry gathered at the Hilton in Auckland on 17 November to celebrate the finest female talent in the Kiwi channel and recognise the winners of the Reseller News Women in ICT Awards (WIICTA) 2020.

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards
Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

The leading female front runners of the New Zealand ICT industry joined together for the annual Reseller News Women in ICT Awards event at the Hilton in Auckland, during which hundreds of guests celebrated 13 outstanding individuals who won awards, chosen from more than 50 finalists representing over 30 organisations.

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards
Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

More than 500 channel leaders gathered in Auckland on 21 October at the ​Reseller News Innovation Awards ​2020 to celebrate the achievements of the New Zealand technology industry's top partners, start-ups, vendors, distributors and individuals.

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners
Show Comments