ATENTION‼ New - CVE-2017-8229
📖 Read
via "National Vulnerability Database".
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function sub_436D6 in IDA pro is identified to be setting up the configuration for the device. If one scrolls to the address 0x000437C2 then one can see that /current_config is being set as an ALIAS for /mnt/mtd/Config folder on the device. If one TELNETs into the device and navigates to /mnt/mtd/Config folder, one can observe that it contains various files such as Account1, Account2, SHAACcount1, etc. This means that if one navigates to http://[IPofcamera]/current_config/Sha1Account1 then one should be able to view the content of the files. The security researchers assumed that this was only possible only after authentication to the device. However, when unauthenticated access tests were performed for the same URL as provided above, it was observed that the device file could be downloaded without any authentication.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-8228
📖 Read
via "National Vulnerability Database".
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a thorough verification when allowing the user to add a new camera to the user's account to ensure that the user actually owns the camera other than knowing the serial number of the camera. This can allow an attacker who knows the serial number to easily add another user's camera to an attacker's cloud account and control it completely. This is possible in case of any camera that is currently not a part of an Amcrest cloud account or has been removed from the user's cloud account. Also, another requirement for a successful attack is that the user should have rebooted the camera in the last two hours. However, both of these conditions are very likely for new cameras that are sold over the Internet at many ecommerce websites or vendors that sell the Amcrest products. The successful attack results in an attacker being able to completely control the camera which includes being able to view and listen on what the camera can see, being able to change the motion detection settings and also be able to turn the camera off without the user being aware of it. Note: The same attack can be executed using the Amcrest Cloud mobile application.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-8227
📖 Read
via "National Vulnerability Database".
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are detected using the Web and HTTP API interface provided by the device. However, if the same brute force attempt is performed using the ONVIF specification (which is supported by the same binary) then there is no account lockout or timeout executed. This can allow an attacker to circumvent the account protection mechanism and brute force the credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that performs the credential check in the binary for the ONVIF specification. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function at address 00671618 in IDA pro is parses the WSSE security token header. The sub_ 603D8 then performs the authentication check and if it is incorrect passes to the function sub_59F4C which prints the value "Sender not authorized."📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-8226
📖 Read
via "National Vulnerability Database".
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub_3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub_5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-13719
📖 Read
via "National Vulnerability Database".
The Amcrest IPM-721S Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 allows HTTP requests that permit enabling various functionalities of the camera by using HTTP APIs, instead of the web management interface that is provided by the application. This HTTP API receives the credentials as base64 encoded in the Authorization HTTP header. However, a missing length check in the code allows an attacker to send a string of 1024 characters in the password field, and allows an attacker to exploit a memory corruption issue. This can allow an attacker to circumvent the account protection mechanism and brute force the credentials. If the firmware version Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 is dissected using the binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that has many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that performs the credential check in the binary for the HTTP API specification. If we open this binary in IDA Pro we will notice that this follows an ARM little-endian format. The function at address 00415364 in IDA Pro starts the HTTP authentication process. This function calls another function at sub_ 0042CCA0 at address 0041549C. This function performs a strchr operation after base64 decoding the credentials, and stores the result on the stack, which results in a stack-based buffer overflow.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-3907
📖 Read
via "National Vulnerability Database".
CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.📖 Read
via "National Vulnerability Database".
🕴 D-Link Agrees to Strengthen Device Security 🕴
📖 Read
via "Dark Reading: ".
A settlement with the FTC should mean comprehensive security upgrades for D-Link routers and IP camera.📖 Read
via "Dark Reading: ".
Dark Reading
D-Link Agrees to Strengthen Device Security
A settlement with the FTC should mean comprehensive security upgrades for D-Link routers and IP camera.
⚠ TikTok investigated (again) over how it handles children’s data and safety ⚠
📖 Read
via "Naked Security".
It's already gotten hit with the biggest-ever US child privacy fine, and now it might be facing a fine for GDPR violations.📖 Read
via "Naked Security".
Naked Security
TikTok investigated (again) over how it handles children’s data and safety
It’s already gotten hit with the biggest-ever US child privacy fine, and now it might be facing a fine for GDPR violations.
⚠ Facebook should put a stop to Libra for now, says Congress ⚠
📖 Read
via "Naked Security".
Could Facebook's Libra cryptocurrency undermine the security of the global financial ecosystem?📖 Read
via "Naked Security".
Naked Security
Facebook should put a stop to Libra for now, says Congress
Could Facebook’s Libra cryptocurrency undermine the security of the global financial ecosystem?
⚠ Facebook’s down-ranking those ‘miracle cure’ health posts we all hate ⚠
📖 Read
via "Naked Security".
Clickbait health/nutrition posts will sink in page rankings due to two ranking updates, Facebook announced.📖 Read
via "Naked Security".
Naked Security
Facebook’s down-ranking those ‘miracle cure’ health posts we all hate
Clickbait health/nutrition posts will sink in page rankings due to two ranking updates, Facebook announced.
⚠ Open Sesame! Zipato’s smart hub hacked to open front doors ⚠
📖 Read
via "Naked Security".
The Zipato controller has three critical security flaws which could be used together by hackers to open your home’s doors for you, according to researchers.📖 Read
via "Naked Security".
Naked Security
Open Sesame! Zipato’s smart hub hacked to open front doors
The Zipato controller has three critical security flaws which could be used together by hackers to open your home’s doors for you, according to researchers.
⚠ Why are they “smart” locks if more money buys you less security? ⚠
📖 Read
via "Naked Security".
Smart locks are cool and useful - but they are also a great reminder that cybersecurity is all about value, not cost.📖 Read
via "Naked Security".
Naked Security
Why are they “smart” locks if more money buys you less security?
Smart locks are cool and useful – but they are also a great reminder that cybersecurity is all about value, not cost.
⚠ Deepfake revenge porn now a crime in Virginia ⚠
📖 Read
via "Naked Security".
It's the first state to enact a deepfakes ban, but it's not going to be the last: laws are being considered in many other states.📖 Read
via "Naked Security".
Naked Security
Deepfake revenge porn now a crime in Virginia
It’s the first state to enact a deepfakes ban, but it’s not going to be the last: laws are being considered in many other states.
⚠ Mannequin Challenge videos teach computers to see ⚠
📖 Read
via "Naked Security".
An internet craze could change the way computers see, thanks to research published by Google.📖 Read
via "Naked Security".
Naked Security
Mannequin Challenge videos teach computers to see
An internet craze could change the way computers see, thanks to research published by Google.
⚠ Bitcoin eats as much energy as Switzerland ⚠
📖 Read
via "Naked Security".
That's around seven gigawatts, equal to 0.21% of the world's supply: as much power as generated by seven Dungeness nuclear power plants.📖 Read
via "Naked Security".
Naked Security
Bitcoin eats as much energy as Switzerland
That’s around seven gigawatts, equal to 0.21% of the world’s supply: as much power as generated by seven Dungeness nuclear power plants.
⚠ OpenPGP experts targeted by long-feared ‘poisoning’ attack ⚠
📖 Read
via "Naked Security".
Somebody out there has taken a big dislike to Robert J. Hansen (‘rjh’) and Daniel Kahn Gillmor (‘dkg’), two well-regarded experts in the specialised world of OpenPGP email encryption.📖 Read
via "Naked Security".
Naked Security
OpenPGP experts targeted by long-feared ‘poisoning’ attack
Somebody out there has taken a big dislike to Robert J. Hansen (‘rjh’) and Daniel Kahn Gillmor (‘dkg’), two well-regarded experts in the specialised world of OpenPGP email encryption.
🔏 Friday Five: 7/5 Edition 🔏
📖 Read
via "Subscriber Blog RSS Feed ".
Cracking a five year Facebook malware campaign, this week's CDN outage, and an app fined for leaking users' photos - catch up on the week's news with this recap!📖 Read
via "Subscriber Blog RSS Feed ".
Digital Guardian
Friday Five: 7/5 Edition
Cracking a five year Facebook malware campaign, this week's CDN outage, and an app fined for leaking users' photos - catch up on the week's news with this recap!
🕴 Why Your GDPR Implementation Plan Needs CISOs & 'Legal Engineers' to Work Together 🕴
📖 Read
via "Dark Reading: ".
Lawyers must step into the shoes of technical roles and craft legal guidance that can be easily put into use.📖 Read
via "Dark Reading: ".
Dark Reading
Dark Reading | Security | Protect The Business - Enable Access
Cyber security's comprehensive news site is now an online community for security professionals, outlining cyber threats and the technologies for defending against them.
⚠ 5 tips to stay secure on social media ⚠
📖 Read
via "Naked Security".
Social media isn't for everyone, but lots of us love it - so here's how to be in it and win it.📖 Read
via "Naked Security".
Naked Security
5 tips to stay secure on social media
Social media isn’t for everyone, but lots of us love it – so here’s how to be in it and win it.
❌ PGP Ecosystem Targeted in ‘Poisoning’ Attacks ❌
📖 Read
via "Threatpost".
Two researchers are being singled out in what are called PGP poisoning or flood attacks that render the authentication tool unusable for victims.📖 Read
via "Threatpost".
Threat Post
PGP Ecosystem Targeted in ‘Poisoning’ Attacks
Two researchers are being singled out in what are called PGP poising or flood attacks that render the authentication tool unusable for victims.
🕴 Intelligent Authentication Market Grows to Meet Demand 🕴
📖 Read
via "Dark Reading: ".
Confidence in user identity is critical to prevent fraud and theft, and companies are looking for new ways to get the necessary assurance.📖 Read
via "Dark Reading: ".
Darkreading
Intelligent Authentication Market Grows to Meet Demand
Confidence in user identity is critical to prevent fraud and theft, and companies are looking for new ways to get the necessary assurance.