Firmware bug in CCTV software may have given POS hackers a foothold

Surveillance cameras could provide hackers with a foothold into networks

A researcher with RSA says faulty firmware found in security cameras sold by at least 70 vendors may be a contributor to many of the credit card breaches that have proved costly to retailers.

Rotem Kerner based his research on a paper RSA published in December 2014 into a malware nicknamed Backoff, which steals payment card details processed by point-of-sale systems.

The U.S. Secret Service and Department of Homeland Security warned in August 2014 that upwards of 1,000 U.S. businesses may have been infected with Backoff.

The advisory came after a hard year in which many major retailers became victims of large payment card breaches, including Target, Neiman Marcus, Michaels and UPS Store.

Kerner looked at the technical data RSA had collected from computers that were infected with Backoff. Strangely, many were running small Web servers with open ports on 81, 82 and 8000.

The software, named "Cross Web Server," proved to be for CCTV DVR (digital video recorder) equipment, which is widely used by retailers for physical monitoring. But the server software was left running and open to the Internet, which is a potential security risk.

Shodan, a search engine for finding networked devices open to the Internet, turned up 30,000 machines running the same software, according to Kerner's writeup.

Kerner figured out the Web server software was made by a Chinese company called TVT. He downloaded a version of the firmware for the CCTV DVR devices from the company's website.

Probing the firmware, he found a weakness in the code that would allow him to get remote access to the device through a malicious URI.

The big security problem is that this kind of software shouldn't be accessible from the public Internet. The mere presence of camera software left open to the Internet can help attackers identify a particular network and figure out if one belongs to a retailer.

Access to the device itself could help in gaining entry to the broader network, which could eventually lead to payment processing systems.

"When the old fashion thieves used to physically break into stores, on their way to the cashier they had to try and avoid or neutralize any surveillance equipment," Kerner wrote. "The digital thieves are entering the store through them. Truly Hollywood material."

His investigation turned up at least 70 manufacturers that use the same firmware, which he listed in a writeup. Kerner tried but failed to reach officials at TVT to warn them of the vulnerability, so he decided to publicly disclose the problem.

TVT officials could not be immediately contacted via email on Thursday.

It's not uncommon for firmware -- which is low-level code -- to be licensed and used by many vendors for products such as routers, IP cameras and some consumer electronics.

But it's well-known that vendors are notoriously lax about creating patches. As Werner put it: it's hard to rely on a vendor's patch "to arrive at your doorstep." Adding to the complexity is that each vendor may use the firmware in many different models.

Werner's recommended defense for those running these types of cameras is to "deny any connection from an unknown IP address to the DVR services."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?