Cracking the Victure PC420 Camera and IPC360 Platform - RCE, Unauthorized Streaming and More
Baby monitors have become essential tools for keeping an eye on kids and nannies when away. Most cameras on the market are packed with features, ranging from real-time or motion-detection recording to two-way communication and anything in between. As households get increasingly interconnected and crammed with video and audio sensors, privacy becomes more important than ever.
While looking into the Victure IPC360 Camera, we have identified several vulnerabilities that allow an outside attacker to access the camera feed or disable encryption of streams stored on the cloud. Additionally, an attacker sharing a network with the camera can enable the RTSP and ONVIF protocols or exploit a stack-based buffer overflow to completely hijack the device.
- AWS bucket missing access control
- Camera information disclosure
- Remote control of cameras
- Local stack-based buffer overflow leading to remote code execution, described in CVE-2020-15744
- Hardcoded RTSP credentials
One platform, several vulnerabilities
The Victure IPC360 cloud platform allows querying arbitrary user accounts without authentication.
The identifiers for the user accounts are simple numbers between 1.000.000 and 60.000.000 and are assigned incrementally (thus easy to predict) for each user. The numbers are split in ranges for each geographical region. Querying a user ID (again, no authentication needed) returns a reply from the platform with full details of that account, including the identifiers for devices associated. With that information, an attacker can access the devices of all users. Based on the user IDs we received while testing, we estimate the number of potentially affected victims at roughly 4.000.000
The IPC360 cloud platform serves several other camera models, such as the Mibao Wireless IP Outdoor Camera, the Akaso P50 and the Robicam Waterproof 360. We estimate that these vulnerabilities are affecting more than 4 million devices worldwide.
Our researchers are regularly inspecting IoT devices and platforms to identify vulnerabilities and develop new mitigations in the Bitdefender IoT Security Platform.
LuminousMoth – PlugX, File Exfiltration and Persistence Revisited
July 21, 2021
How We Tracked a Threat Group Running an Active Cryptojacking Campaign
July 14, 2021
A Note from the Bitdefender Labs Team on Ransomware and Decryptors
May 26, 2021
New Nebulae Backdoor Linked with the NAIKON Group
April 28, 2021
Good riddance, GandCrab! We’re still fixing the mess you left behind.
June 17, 2019