Cracking the Victure PC420 Camera and IPC360 Platform - RCE, Unauthorized Streaming and More
Baby monitors have become essential tools for keeping an eye on kids and nannies when away. Most cameras on the market are packed with features, ranging from real-time or motion-detection recording to two-way communication and anything in between. As households get increasingly interconnected and crammed with video and audio sensors, privacy becomes more important than ever.
While looking into the Victure IPC360 Camera, we have identified several vulnerabilities that allow an outside attacker to access the camera feed or disable encryption of streams stored on the cloud. Additionally, an attacker sharing a network with the camera can enable the RTSP and ONVIF protocols or exploit a stack-based buffer overflow to completely hijack the device.
- AWS bucket missing access control
- Camera information disclosure
- Remote control of cameras
- Local stack-based buffer overflow leading to remote code execution, described in CVE-2020-15744
- Hardcoded RTSP credentials
One platform, several vulnerabilities
The Victure IPC360 cloud platform allows querying arbitrary user accounts without authentication.
The identifiers for the user accounts are simple numbers between 1.000.000 and 60.000.000 and are assigned incrementally (thus easy to predict) for each user. The numbers are split in ranges for each geographical region. Querying a user ID (again, no authentication needed) returns a reply from the platform with full details of that account, including the identifiers for devices associated. With that information, an attacker can access the devices of all users. Based on the user IDs we received while testing, we estimate the number of potentially affected victims at roughly 4.000.000
The IPC360 cloud platform serves several other camera models, such as the Mibao Wireless IP Outdoor Camera, the Akaso P50 and the Robicam Waterproof 360. We estimate that these vulnerabilities are affecting more than 4 million devices worldwide.
Our researchers are regularly inspecting IoT devices and platforms to identify vulnerabilities and develop new mitigations in the Bitdefender IoT Security Platform.
A Red Team Perspective on the Device42 Asset Management Appliance
August 10, 2022
Vulnerabilities Identified in Wyze Cam IoT Device
March 29, 2022
New FluBot and TeaBot Global Malware Campaigns Discovered
January 26, 2022
Bitdefender Honeypots Signal Active Log4Shell 0-Day Attacks Underway; Patch Immediately
December 10, 2021
Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand
November 08, 2021
Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware
September 16, 2021