To understand what smart cameras are, it’s important to have a basic knowledge of how they work. Cameras connected to the Internet need Web servers that process camera streams with images and videos. A Web server can be thought of as an advanced computer with several key components, including storage, processors, memory, etc. The processor is the most important component since most calculations are performed there. It’s also where applications are stored in order for them to run. So if an application is affected by an issue that allows remote code execution or information disclosure on the device hosting it, then that appliance could also be remotely compromised.
What are some examples of Smart cameras?
Here’s a list of popular devices vulnerable to remote exploitation:
The list is not exhaustive and can be added to. The security advisories for each product contain additional information on the affected products, including device models and firmware versions that are affected. Please note that not all issues affect all devices or model numbers, which is why it’s important to refer to advisory documents for more details.
Are smart cameras a concern?
Many of these devices require a Web server component in order to deliver video over the Internet via a web interface. Whether this feature is activated or not, they open up an attack vector which can lead to attacks against other internal components of the device such as its built-in microphone and camera(s). These features could then be used in further attacks such as eavesdropping, surveillance, etc.
Of course, the primary attack vector is when administrative capabilities are enabled in the camera itself. This can be done when remote administration is enabled or when authentication credentials are known to an attacker. The latter can happen via social engineering methods, remote code execution by exploiting vulnerabilities on other internal services running in the device (e.g., FTP), or brute-forcing access if weak authentication has been configured/enabled on the Web server component.
What should I do if my device is affected?
The easiest way to protect yourself from these vulnerabilities is to close any open ports that are not necessary for your use of the device. For example, if you don’t plan to remotely connect to your camera, then you can close the port that is listening for connections like port 81 (used in these examples). This will only prevent access to the Web server, but then again, if you don’t need it, then why leave it exposed?
If your device’s Web server component is exposed and remote administration/remote viewing capabilities are enabled, updating the device(s) to a firmware version with the fix is recommended. If this isn’t possible or too cumbersome, using network segmentation or virtual network computing (VNC) would be an alternative option until patches can be applied. VNC provides better protection than just closing ports since credentials and encryption keys aren’t exchanged in plaintext over the wire in this type of setup. Please note that there are some workarounds for these issues that prevent remote code execution, but they do require the attacker to have authentication credentials on the device.
Newer smart cameras can use a 3rd party application for viewing and configuration. In this case, closing ports will not be enough if authentication or weak authentication is enabled within the device itself. As an example, when configuring Axis Communication’s P14 Series Network Cameras via their built-in Web server, it’s possible to configure “guest” access. If guest access with no password is configured in such devices, then any would-be attackers could remotely log in and control the Web server component of the camera without requiring credentials! As we’ve seen time and time again in other product vulnerabilities that we review each day across, it’s important to consider all threat vectors and not just one vulnerability.