I suppose there are many people out there who want to achieve a greater good, fight evil corp and “show those guys”. So why not set a statement and become part of a botnet? #Irony!!! Of course I suppose (hope) that none of you actually want to be part of something like an IoT botnet, but joining could in theory be dead easy. So quite a while back I bought a dead cheap WiFi camera for use at home. It was kind of just as insecure as I had expected, so it got it’s own VLAN and stuff and here is why….
Recently KrebsOnSecurity.com was DDOSed by an apparent IoT botnet and although there does not seem to be any actual evidence, that the attack sourced from IoT devices it is by far not unrealistic. Many IoT devices offer certain Plug’n’Play functionality, like automatically making sure that the user is able to access them via phone. While the more expensive ones use some kind of backend service as a broker for the connections, the cheap ones use direct port forwarding. Most routers nowadays support UPnP – Universal Plug and Play – which enables a network client to automatically request a port forwarding. Although this might sound strange, there are valid use cases (for non-tekkies): Ensure, that friends can join a game instance on my box or a chat program can use direct file transfer or a file sharing tool can also allow other peers to connect (i.e. for sharing OpenSource software!). As such these programs are able to contact the router on the network, send a few requests and make the router expose port X towards the Internet and then forward all this traffic towards the user’s box. This of course comes with all pros and cons, as everybody on the Internet is able to fiddle with the exposed service and protection relies on either transport or application security (or both).
The same features come in a lot of “modern” IP webcams: Hook it up to the network, hit the cam’s web interface click a few buttons and there you go! It’s easy enough so that everybody who manages to attach the cam to the network can also enable the port forwarding. Of course the router has to support UPnP and it has to be enabled, but from what I’ve seen so far this is often the default configuration.
My Camera(s)
For this blog post neither model nor manufacturer are relevant. Not because I do not want to disclose any information, but because I have seen the same firmware on a lot of different webcams with different brandings. It is also the exact same firmware for both cameras with motors (pointing the camera) and ones without. For the latter there simply are controls in the web interface which don’t do anything. The only thing they have in common is the hardware on the inside and a price range of between 20€ and 60€. And they run on an RALink SoC with a MIPS architecture. (There also are other cameras with very similar issues.)
My cameras support both WiFi and Ethernet and run a web interface on port 81 and a Telnet server on port 23.
A Note on Using UPnP
When running UPnP I’ve so far seen two different results: (1) Only the web interface is exposed, (2) telnet is also exposed. One of my cameras had this feature enable by default, so the moment you attach it to your network it will rip a hole into your defense lines.
Also when activating UPnP the camera does not enforce the activation of authentication, so if its exposed to the Internet it will be owned.
Web Interface
When going through the settings menu you can change IP settings, usernames and passwords (max 8 characters or it will kind of break), set alarms but there is no sign of Telnet settings. Also quite a few settings aren’t necessarily functional: When you set something, store it and go back to menu the setting will be reset. This is the fact for a random variety of settings (but it seems static for each one). As such the web interface seems very very broken. I have to admit, I’ve never had the heart to actually break the web interface even further especially as its very unstable.
Telnet
I’m not planning on starting a discussion on Telnet now but it’s insecure and simply not made to be exposed to the public Internet. Especially if the user himself has no way of actually configuring telnet and does not even know the password. Luckily, using some secret sophisticated Hacker magic and some advanced tools I was able to crack a valid account on the device: root:123456 .
I myself actually used this account to add a few extra tools to the camera to attach it to my network.
Playing Botnet
As the camera’s platform is generally open it would be trivial to put together a small binary for running on the webcam and, well, making it your slave. Above this there also seem to be quite a few of these online (they can be found easily with all well-known search engines). As mentioned before, the Telnet credentials are not generally documented for the camera so this interface can probably be misused on every available camera. On the other hand the telnet port is not always exposed to the Internet. From my experience with the camera, even though I have not analyzed the web interface, I do expect there to be a few critical vulnerabilities available which might be exploited. (Otherwise one might just use the firmware updating mechanism.)
Some Thoughts
This blogpost only covered one small range of IoT devices and I do expect that there are very many more devices with similar issues. Still I have not, yet, been able to make up my mind if the potential flaws in the web interface and the open telnet port actually are the big problem. Yes, they suck, they must not be there in a commercial product – but: No password -> No Security! Even if the cameras them selves were secure, users would still expose unconfigured cameras to the Internet. As such I’d love to see IoT devices which will not connected to the Internet before being properly configured (only allow the use of UPnP if a secure password has been set on the device). Most surely this sounds easier than it is, but it will probably be the only way of protecting users from themselves.
Brian
For those interested in IoT security: I will discuss hardware security of IoT devices at the IoT Insight Summit 2016 in a few weeks, and my colleagues will host some other cool sessions, too 🙂
A Quick Addition
Looking at Trend Micro’s documentation on “ELF_BASHLITE.SMB” from November 2014 you can actually see that my camera would already have been a target back then. ELF_BASHLITE.SMB has a scanner functionality which will generate random IP addresses, test for telnet and try to login using “root”:”123456″ (among other credentials). As such it could have been close to it’s second botnet birthday while I was writing this post.