IOT Security: Pentesting on IP Cameras - Revision history

NKirnbauer: expired link changed with link from wayback machine

2024-10-14T14:22:55Z

expired link changed with link from wayback machine

← Older revision		Revision as of 14:22, 14 October 2024
Line 390:		Line 390:
	* https://github.com/laramies/theHarvester		* https://github.com/laramies/theHarvester
	* https://github.com/abdulr7mann/hackerEnv		* https://github.com/abdulr7mann/hackerEnv
	* https://govanguard.com/legion/		* http://web.archive.org/web/20220815094559/https://govanguard.com/legion/
	* https://www.tenable.com/downloads/nessus?loginAttempted=true		* https://www.tenable.com/downloads/nessus?loginAttempted=true
	* https://www.kali.org/tools/wireshark/		* https://www.kali.org/tools/wireshark/

NKirnbauer: expired link changed with link from wayback machine

2024-10-14T14:20:46Z

expired link changed with link from wayback machine

← Older revision		Revision as of 14:20, 14 October 2024
Line 379:		Line 379:
	* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]		* [https://www.tp-link.com/de/home-networking/cloud-camera/kc120/ TP-Link Kasa Smart Home Camera KC120]
	* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]		* [https://www.ezviz.com/product/c1c/1425 Ezviz CS-C1C]
	* [https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]		* [http://web.archive.org/web/20210929005300/https://www.abus.com/eng/Home-Security/Video-Surveillance/Surveillance-cameras/WLAN-network-cameras/WLAN-pan-tilt-cameras/ABUS-Smart-Security-World-Wi-Fi-Pan-Tilt-Indoor-Camera Abus PPIC32020]

	== References ==		== References ==

RCox: /* Description */

2022-06-22T09:09:23Z

Description

← Older revision		Revision as of 09:09, 22 June 2022
Line 38:		Line 38:
	*<b>Threat Modeling</b>		*<b>Threat Modeling</b>
	<i>Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats. A threat is a set of situations that might purpose harm, which means a hypothetical action where the attacker exploits a vulnerability.		<i>Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats. A threat is a set of situations that might purpose harm, which means a hypothetical action where the attacker exploits a vulnerability.
	3 main types of threats in the IoT are taking control, stealing information, and disrupting service. <br>		3 main types of threats in the IoT are <b>taking control, stealing information, and disrupting service.</b> <br>
	The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications.		The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications.
	This includes the following top 10 IOT vulnerabilities: weak passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, use of insecure or outdated components, insufficient privacy protection, insecure data transfer and storage, lack of device management, insecure default settings and lack of physical hardening. <br>		This includes the following top 10 IOT vulnerabilities: weak passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, use of insecure or outdated components, insufficient privacy protection, insecure data transfer and storage, lack of device management, insecure default settings and lack of physical hardening. <br>
	These elements should be considered: IoT device, cloud, mobile application, network interfaces, software, use of encryption, use of authentication, physical security, and USB ports.		These elements should be considered: IoT device, cloud, mobile application, network interfaces, software, use of encryption, use of authentication, physical security, and USB ports.
	Suppose you have an IP camera installed and you want to log in remotely to monitor your home situation. Such a simple implementation poses many risk factors and creates a huge attack surface in the environment. An attacker could remotely scan for a vulnerability in an IP camera, brute force, connect (if you have a ~~blackdoor~~ or the same hard-coded SSH key), and exploit it.		Suppose you have an IP camera installed and you want to log in remotely to monitor your home situation. Such a simple implementation poses many risk factors and creates a huge attack surface in the environment. An attacker could remotely scan for a vulnerability in an IP camera, brute force, connect (if you have a backdoor or the same hard-coded SSH key), and exploit it.
	</i>		</i>

Line 49:		Line 49:

	*<b>Exploitation</b>		*<b>Exploitation</b>
	<i>The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase. Exploitation can be software, shellcode, certain ~~command~~, code injection, remote ~~exploit~~ without any prior access, and local ~~exploit~~ with prior access to the system. </i>		<i>The pentester tries to establish a connection with the target and exploit the vulnerabilities found in the previous phase. Exploitation can be software, shellcode, certain commands, code injection, remote exploits without any prior access, and local exploits with prior access to the system. </i>

	*<b>Post Exploitation</b>		*<b>Post Exploitation</b>
Line 55:		Line 55:

	*<b>Reporting</b>		*<b>Reporting</b>
	<i>Providing a complete report with deep evaluation and suggestions on the way to mitigate the found vulnerabilities. It consists of two parts: An executive summary and a technical report. The executive summary provides a background overview, test overview, risk profile, general findings, an overview of the tasks required to mitigate the problem, and short-term and long-term goals to improve security increase.		<i>Providing a complete report with deep evaluation and suggestions on the way to mitigate the found vulnerabilities. It consists of two parts: <b>An executive summary and a technical report.</b> The executive summary provides a background overview, test overview, risk profile, general findings, an overview of the tasks required to mitigate the problem, and short-term and long-term goals to improve security increase.
	It is important to document how easy it was to find this vulnerability and what the countermeasures are. The risk analysis is the most important part because the pentester needs to consider how high the ~~risk~~ of the detected vulnerabilities is and how these vulnerabilities could affect the company.		It is important to document how easy it was to find this vulnerability and what the countermeasures are. The risk analysis is the most important part because the pentester needs to consider how high the risks of the detected vulnerabilities are and how these vulnerabilities could affect the company.
	These results are used to make company decisions that ~~can~~ have a significant impact on the company.		These results are used to make company decisions that could have a significant impact on the company.
	The technical report details the intelligence collection and vulnerability testing results, and the client's internet footprint.		The technical report details the intelligence collection and vulnerability testing results, and the client's internet footprint.
	</i>		</i>

RCox: /* Description */

2022-06-22T09:01:16Z

Description

← Older revision		Revision as of 09:01, 22 June 2022
Line 32:		Line 32:

	*<b>Gathering Information</b>		*<b>Gathering Information</b>
	<i>Collecting and examing key data ~~approximately~~ the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram).		<i>Collecting and examing key data regarding the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram).
	The camera software itself may not be threateningly modelable, but you need to identify the protocol for all the surrounding systems that the camera needs to communicate with. After that, you should identify who uses the protocol and who accesses them.		The camera software itself may not be threateningly modelable, but you need to identify the protocol for all the surrounding systems that the camera needs to communicate with. After that, you should identify who uses the protocol and who accesses them.
	</i>		</i>

JJashari: /* Report */

2022-06-21T16:42:32Z

Report

← Older revision		Revision as of 16:42, 21 June 2022
Line 370:		Line 370:
	The Abus camera had no open ports, only the MAC address was displayed.		The Abus camera had no open ports, only the MAC address was displayed.
	TP-Link uses TCP as traceroute, Evziz uses ICMP and Abus uses broadcast.		TP-Link uses TCP as traceroute, Evziz uses ICMP and Abus uses broadcast.
			<br>
			The final Nmap scan on Kasa Cam showed that the device type is a webcam. Nmap is guessing that the Garmin Embedded is running on the camera. The OS CPE is cpe:/h:/garmin:virb_elite and it has to be a Garmin Virb Elite action camera. Using Evziz Cam, Nmap thinks that the operating system Linux is probably running on the camera.

	The exploit tools did not detect abyss and cirrossp exploits. The RTSP protocol on the Evziz camera had several exploits, but none of them has led to remote access. The login crackers could not infer login data. Based on these results, we would advise our client not to take new security measures.		The exploit tools did not detect abyss and cirrossp exploits. The RTSP protocol on the Evziz camera had several exploits, but none of them has led to remote access. The login crackers could not infer login data. Based on these results, we would advise our client not to take new security measures.

JJashari: /* Description */

2022-06-21T12:51:44Z

Description

← Older revision		Revision as of 12:51, 21 June 2022
Line 41:		Line 41:
	The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications.		The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications.
	This includes the following top 10 IOT vulnerabilities: weak passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, use of insecure or outdated components, insufficient privacy protection, insecure data transfer and storage, lack of device management, insecure default settings and lack of physical hardening. <br>		This includes the following top 10 IOT vulnerabilities: weak passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, use of insecure or outdated components, insufficient privacy protection, insecure data transfer and storage, lack of device management, insecure default settings and lack of physical hardening. <br>
	These elements should be considered: IoT device, cloud, mobile application, network interfaces, software, use of ~~Encryption~~, use of ~~Authentication~~, physical security, and USB ports.		These elements should be considered: IoT device, cloud, mobile application, network interfaces, software, use of encryption, use of authentication, physical security, and USB ports.
	Suppose you have an IP camera installed and you want to log in remotely to monitor your home situation. Such a simple implementation poses many risk factors and creates a huge attack surface in the environment. An attacker could remotely scan for a vulnerability in an IP camera, brute force, connect (if you have a blackdoor or the same hard-coded SSH key), and exploit it.		Suppose you have an IP camera installed and you want to log in remotely to monitor your home situation. Such a simple implementation poses many risk factors and creates a huge attack surface in the environment. An attacker could remotely scan for a vulnerability in an IP camera, brute force, connect (if you have a blackdoor or the same hard-coded SSH key), and exploit it.
	</i>		</i>

JJashari: /* Description */

2022-06-21T12:51:22Z

Description

← Older revision		Revision as of 12:51, 21 June 2022
Line 40:		Line 40:
	3 main types of threats in the IoT are taking control, stealing information, and disrupting service. <br>		3 main types of threats in the IoT are taking control, stealing information, and disrupting service. <br>
	The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications.		The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications.
	This includes the following top 10 IOT vulnerabilities: weak passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, use of insecure or outdated components, insufficient privacy protection, insecure data transfer and storage, lack of device management, insecure default settings and lack of physical hardening.		This includes the following top 10 IOT vulnerabilities: weak passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, use of insecure or outdated components, insufficient privacy protection, insecure data transfer and storage, lack of device management, insecure default settings and lack of physical hardening. <br>
	These elements should be considered: IoT device, cloud, mobile application, network interfaces, software, use of Encryption, use of Authentication, physical security, and USB ports.		These elements should be considered: IoT device, cloud, mobile application, network interfaces, software, use of Encryption, use of Authentication, physical security, and USB ports.
	Suppose you have an IP camera installed and you want to log in remotely to monitor your home situation. Such a simple implementation poses many risk factors and creates a huge attack surface in the environment. An attacker could remotely scan for a vulnerability in an IP camera, brute force, connect (if you have a blackdoor or the same hard-coded SSH key), and exploit it.		Suppose you have an IP camera installed and you want to log in remotely to monitor your home situation. Such a simple implementation poses many risk factors and creates a huge attack surface in the environment. An attacker could remotely scan for a vulnerability in an IP camera, brute force, connect (if you have a blackdoor or the same hard-coded SSH key), and exploit it.

JJashari: /* Description */

2022-06-21T12:50:40Z

Description

← Older revision		Revision as of 12:50, 21 June 2022
Line 38:		Line 38:
	*<b>Threat Modeling</b>		*<b>Threat Modeling</b>
	<i>Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats. A threat is a set of situations that might purpose harm, which means a hypothetical action where the attacker exploits a vulnerability.		<i>Threat modeling is an established technique of figuring out and prioritizing ability threats to a system and figuring out the value that ability mitigations might have in decreasing or neutralizing one's threats. A threat is a set of situations that might purpose harm, which means a hypothetical action where the attacker exploits a vulnerability.
	3 main types of threats in the IoT are taking control, stealing information, and disrupting service.		3 main types of threats in the IoT are taking control, stealing information, and disrupting service. <br>
	The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications.		The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications.
	This includes the following top 10 IOT vulnerabilities: weak passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, use of insecure or outdated components, insufficient privacy protection, insecure data transfer and storage, lack of device management, insecure default settings and lack of physical hardening.		This includes the following top 10 IOT vulnerabilities: weak passwords, insecure network services, insecure ecosystem interfaces, lack of secure update mechanism, use of insecure or outdated components, insufficient privacy protection, insecure data transfer and storage, lack of device management, insecure default settings and lack of physical hardening.

JJashari: /* Description */

2022-06-21T12:49:46Z

Description

← Older revision		Revision as of 12:49, 21 June 2022
Line 33:		Line 33:
	*<b>Gathering Information</b>		*<b>Gathering Information</b>
	<i>Collecting and examing key data approximately the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram).		<i>Collecting and examing key data approximately the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram).
	The camera software itself may not be threateningly modelable, but you need to identify the protocol for all the surrounding systems that the camera needs to communicate with. ~~For example~~ who uses it and who accesses them.		The camera software itself may not be threateningly modelable, but you need to identify the protocol for all the surrounding systems that the camera needs to communicate with. After that, you should identify who uses the protocol and who accesses them.
	</i>		</i>

JJashari: /* Description */

2022-06-21T12:48:28Z

Description

← Older revision		Revision as of 12:48, 21 June 2022
Line 32:		Line 32:

	*<b>Gathering Information</b>		*<b>Gathering Information</b>
	<i>Collecting and examing key data approximately the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram). ~~It should include at least~~ the ~~subnets, firewalls, gateways, services/servers, and, above~~ all, the ~~system's communication relationships~~.		<i>Collecting and examing key data approximately the software and its infrastructure. We recommend creating an architectural sketch (deployment diagram).
			The camera software itself may not be threateningly modelable, but you need to identify the protocol for all the surrounding systems that the camera needs to communicate with. For example who uses it and who accesses them.
	</i>		</i>