Hi everybody,
This is the second entry in our research diary on IP cameras. If you haven’t
done so yet, you should read the first entry in advance. This time we focused
more on analysis and exploitation.
Another entry vector
After running a vulnerability scan on both devices, it was revealed that the
M1033 has multiple buffer overflow vulnerabilities (CVE-2012-5958 to
CVE-2012-5965), which are readily exploitable via Metasploit. This gave us
another shell (in addition to the root shell mentioned in the last post), though
this time it was not a root shell. By using the find command, we searched for
executables having the setuid or setgid bit set. We hoped to use one of
those to escalate privileges. To do so yourself add the parameter -perm -4000
to find and it will search for files having the setuid bit set. If you try
that on your own unix-like device, for example it should yield /bin/passwd
which is perfectly reasonable as you’re able to change your password without
being root.
As you probably know we perform research on a regular basis at ERNW. This post
is the first entry on our – Benjamin’s and Pascal’s – research diary. You might
already have seen
Oliver’s post on setting up an research environment
or Brian’s posts on IoT botnets
(here and
here).
With that in mind we want to take a look at one of the market leaders for
network camera equipment: AXIS.
At first we’d like to give a quick overview of our research objects. We bought
two cameras, an AXIS M1033-W and an AXIS M3005-V. The M1033’s description states
that it is for “small business, hotels, residences and more”. The M3005 has a
typical dome design and was actually seen in some customer environments during
projects this year.
just recently i bought a wireless plug on
Amazon with
the main use of controlling my coffee machine with an app. The installation of
the wireless plug was quite easy and only requires me to set my Wifi SSID and my
passphrase – that’s it. But what happened behind the scenes? I visited the
control interface of my router and saw that along with the other devices there
was a new one with the network name HF-LPB100 and a local IP address in my case
192.168.0.235. First of all i wondered about the name itself, but ignored that
and kept on looking for open ports.
Sorry about the larger delay between the previous post and this one, but I was
very busy the last weeks.
(And the technology I wanted to show wasn’t completely implemented in radare2,
which means that I had to implement it on my own 😉 ). In case you’re new to
this series, you’ll find the previous posts
here.
As you may already know, we’ll deal with the third challenge today. The purpose
for this one is to introduce
some constructs which are often used in real programs.
As you might have read,
I recently had a closer look at how easy it actually is to become part of an IoT Botnet.
To start a further discussion and share some of my findings I gave a quick
overview at the recent Dayton Security Summit. The Mirai
Botnet was supposed to be one of the case studies here. But the way things go if
one starts diving into code…I eventually gave an overview of how the Mirai Bot
actually works and what it does. As such: Here a quick summary of the Mirai
Botnet bot.
As described in my previous post,
KrebsonSecurity.com was attacked by a major DDoS attack.
Reaching between 620Gbps and 660Gbps it was the largest documented DDoS attack
so far. The attack seemingly resulted from a Botnet called Mirai. Shortly after
the attack, a
post on hackforums
claimed to contain the actual source code of just this botnet.
The source code consists of
three projects: The bot itself with its CnC server and a loader component.
Some of you (especially the .Net guys) might have heard of the query language
Linq (Language Integrated Query) used by Microsoft .Net applications and web
sites. It’s used to access data from various sources like databases, files and
internal lists. It can internally transform the accessed data in application
objects and provides filter mechanisms similar to SQL. As it is used directly
inside the application source code, it will be processed at compile time and not
interpreted at runtime. While this provides a great type safety and almost no
attack surface for injection attacks (except from possible handling problems in
the different backends), it is extremely difficult to implement a dynamic filter
system (e.g. for datatables which should allow users to select the column to
filter on). That’s probably the reason why Scott Guthrie (Executive Vice
President of the Cloud and Enterprise group in Microsoft, also one of the
founders of the .Net project)
presented the
System.Linq.Dynamic package as part of the VS-2008 samples in 2008. This library
allows to build Linq queries at runtime and therefore simplify dynamic filters.
But as you may know, dynamic interpretation of languages based on user input is
most of the time not the best option….
Embedded devices often serve as an entry point for an attack on a private or
corporate network. The infamous attack on HackingTeam, for example, followed
exactly this path as was revealed here.
Although the attack may have been for the greater good (refer also to this great
keynote), such
incidents demonstrate that it is important to properly secure your embedded
devices. In a recent
blog post,
Niklaus presented how he analyzed the security posture of a MAX! Cube LAN
Gateway. Moreover, Brian reported a few weeks ago on the
security posture of IoT devices
(and in particular on one of his cameras). With this post I would like to share
my experiences with analyzing another embedded device: the
IC-3116W
IP camera by Edimax.
In course of a recent research project, I had a look at SolarWinds DameWare,
which is a commercial Remote Access Software product running on Windows Server.
I identified a remote file download vulnerability in the download function for
the client software that can be exploited remotely and unauthenticated and that
allows to download arbitrary files from the server that is running the software.
A very simple proof of concept HTTP request to download the C:\Windows\win.ini
file of the target machine is the following:
I suppose there are many people out there who want to achieve a greater good,
fight evil corp and “show those guys”. So why not set a statement and become
part of a botnet? #Irony!!! Of course I suppose (hope) that none of you
actually want to be part of something like an IoT botnet, but joining could in
theory be dead easy. So quite a while back I bought a dead cheap WiFi camera for
use at home. It was kind of just as insecure as I had expected, so it got it’s
own VLAN and stuff and here is why….
Hello Guys,
back from my vacation I’d like to give you some impressions about Defcon 24 and
our talk “Attacking BaseStations”. Defcon itself had a couple of great talks but
was a very crowded location. Anyhow, we had a couple of great discussions with
the people before and after our talk.
The talk “Attacking BaseStations” focussed on attack vectors we simulated in
our lab.
Besides attacking a BaseStation via Radio interface, in this talk we focussed on
local and remote interfaces as introduced in
“LTE vs. Darwin”.
As target of evaluation one of our eNodeB’s came into play, which we purchased
on the Internet. Anyhow, the talk covered the following attack scenarios: