1 min read

Cracking the Victure PC420 Camera and IPC360 Platform - RCE, Unauthorized Streaming and More

Bitdefender

August 30, 2021

Cracking the Victure PC420 Camera and IPC360 Platform - RCE, Unauthorized Streaming and More

Baby monitors have become essential tools for keeping an eye on kids and nannies when away. Most cameras on the market are packed with features, ranging from real-time or motion-detection recording to two-way communication and anything in between. As households get increasingly interconnected and crammed with video and audio sensors, privacy becomes more important than ever.

While looking into the Victure IPC360 Camera, we have identified several vulnerabilities that allow an outside attacker to access the camera feed or disable encryption of streams stored on the cloud. Additionally, an attacker sharing a network with the camera can enable the RTSP and ONVIF protocols or exploit a stack-based buffer overflow to completely hijack the device.

Key findings

  • AWS bucket missing access control
  • Camera information disclosure
  • Remote control of cameras
  • Local stack-based buffer overflow leading to remote code execution, described in CVE-2020-15744
  • Hardcoded RTSP credentials

One platform, several vulnerabilities

The Victure IPC360 cloud platform allows querying arbitrary user accounts without authentication.

The identifiers for the user accounts are simple numbers between 1.000.000 and 60.000.000 and are assigned incrementally (thus easy to predict) for each user. The numbers are split in ranges for each geographical region. Querying a user ID (again, no authentication needed) returns a reply from the platform with full details of that account, including the identifiers for devices associated. With that information, an attacker can access the devices of all users. Based on the user IDs we received while testing, we estimate the number of potentially affected victims at roughly 4.000.000

The IPC360 cloud platform serves several other camera models, such as the Mibao Wireless IP Outdoor Camera, the Akaso P50 and the Robicam Waterproof 360. We estimate that these vulnerabilities are affecting more than 4 million devices worldwide.

Our researchers are regularly inspecting IoT devices and platforms to identify vulnerabilities and develop new mitigations in the Bitdefender IoT Security Platform.

Download the whitepaper here

tags


Author



Right now

Top posts

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

July 21, 2021

9 min read
How We Tracked a Threat Group Running an Active Cryptojacking Campaign

How We Tracked a Threat Group Running an Active Cryptojacking Campaign

July 14, 2021

10 min read
A Note from the Bitdefender Labs Team on Ransomware and Decryptors

A Note from the Bitdefender Labs Team on Ransomware and Decryptors

May 26, 2021

2 min read
New Nebulae Backdoor Linked with the NAIKON Group

New Nebulae Backdoor Linked with the NAIKON Group

April 28, 2021

1 min read
Good riddance, GandCrab! We’re still fixing the mess you left behind.

Good riddance, GandCrab! We’re still fixing the mess you left behind.

June 17, 2019

5 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

Cracking the Victure PC420 Camera and IPC360 Platform - RCE, Unauthorized Streaming and More Cracking the Victure PC420 Camera and IPC360 Platform - RCE, Unauthorized Streaming and More
Bitdefender

August 30, 2021

1 min read