Home Tags CCTV


IT threat evolution Q1 2017

Wersquo;ve become accustomed to seeing a steady stream of security breaches month after month; and this quarter has been no exception, including attacks on Barts Health Trust, Sports Direct, Intercontinental Hotels Group and ABTA.

The cost of launching a DDoS attack

Almost anyone can fall victim to a DDoS attack.

They are relatively cheap and easy to organize, and can be highly effective if reliable protection is not in place.

Based on analysis of the data obtained from open sources, we managed to find out the current cost of a DDoS attack on the black market. We also established what exactly the cybercriminals behind DDoS attacks offer their customers.

Nest CCTV cameras can be easily blacked out by Bluetooth burglars

So far, no patch available to the public Nest's Dropcam and Dropcam Pro security cameras can be wirelessly attacked via Bluetooth to crash and stop recording footage.

This is perfect for burglars and other crooks who want to knock out the cams moments before robbing a joint.…

New(ish) Mirai Spreader Poses New Risks

A cross-platform win32-based Mirai spreader and botnet is in the wild and previously discussed publicly. However, there is much information confused together, as if an entirely new IoT bot is spreading to and from Windows devices.

This is not the case.
Instead, an accurate assessment is that a previously active Windows botnet is spreading a Mirai bot variant.

Scottish court issues damages to couple over distress caused by neighbour’s...

Personal data gathering ruled 'intrusive, excessive and unjustified' A Scottish couple have been awarded damages of more than £17,000 in total for the "extreme stress" they suffered as a result of the "highly intrusive" use of CCTV systems by the owner of a neighbouring property.…

Two Arrested For CCTV Camera Hack On Washington, DC

A British man and Swedish woman have reportedly been arrested in the UK for the cyberattack ahead of Trump's inauguration.

Ransomware Attack On CCTV Cameras In Washington DC Ahead Of Trump...

Around 70% of public surveillance cameras were found non-functional due to attack by two ransomware variants.

DC police surveillance cameras were infected with ransomware before inauguration

Malware seized 70 percent of DC police DVRs a week before Trump’s inauguration.

Ransomware disrupts Washington DC’s CCTV system

About 70 percent of the cameras hooked up to the police’s closed-circuit TV (CCTV) system in Washington, D.C., were reportedly unable to record footage for several days before President Trump’s inauguration due to a ransomware attack.The attack affected 123 of the 187 network video recorders that form the city’s CCTV system, the Washington Post reported Saturday.

Each of these devices is used to store video footage captured by up to four cameras installed in public spaces.To read this article in full or to leave a comment, please click here

Ransomware killed 70% of Washington DC CCTV ahead of inauguration

Huge ransomware.

The best ransomware. Ransomware fixed with a wipe-and-restore Criminals infected 70 percent of storage devices tied to closed-circuit TVs in Washington DC eight days before the inauguration of President Donald Trump.…

Digital video recorder installers master password list ‘leaked’ – claims

If true, we're talking remote viewing of people's CCTV cams Xiongmai, the vendor behind many Mirai-vulnerable DVRs, has earned the consternation of security watchers once again. The vendor's 2017 list of superuser passwords for certain DVRs – designed only for CCTV installers to access customer installations – appears to have leaked online. "If the creds are what we think they are, they may be enough to remotely take over certain CCTV systems," Ken Munro, a director at UK security consultancy Pen Test Partners (PTP), told El Reg. "[It's] a bit like Mirai, but the consequence is remote viewing of people's CCTV cameras." PTP found the leaked list on the LinkedIn page for a CCTV installer in Nigeria.

This list, which covers login credentials for the rest of 2017, is essentially a one-time pad or per-day superuser password for a DVR service. One-time pads are only effective if they are shared in complete confidence and not reused. Mikko Hyponnen, CRO of security software firm F-Secure, has since noted the same documents elsewhere on the internet. The document references XMEye, a cloud service offered by ZY Security for remotely accessing DVR video streams. "The service only appears available to certain DVR types, which we can't find on sale outside of China," according to Munro. "[We] still haven't successfully attributed the creds, but this is yet another massive Xiongmai DVR fail." Some private forums and the vendor suggest that they're local, but the document suggests it's for a web service.

The vendor involved has acknowledged the bug in private support channels without publicly confirming the problem. PTP would have to ship in a DVR from China to access the scope of the problem, but it's already clear that mistakes have been made. "Sharing superuser account credentials with installers and expecting them not to leak is asking for trouble," Munro said. PTP came across the leaked list during its ongoing research into the security of DVRs for CCTV systems. Munro said PTP has seen undocumented hidden superuser accounts on some other similar DVRs. El Reg invited Xiongmai to comment on the credential leak on Monday. We're yet to hear back but we'll update this story as and when we hear more.
In the meantime – and despite notification by El Reg and others – the leaked credentials remain online. PTP went public on the issue with a blog post late on Tuesday. Xiongmai makes components (motherboards, network modules and more) for security surveillance systems, CCTVs and associated video recorders. ® Sponsored: Customer Identity and Access Management

Another Massive DDoS Closes Out 2016, But Mirai Not To Blame

Using a new malware variant called Leet, the 650 Gbps DDoS attack matched Mirai's floods of traffic. This past year has been one for the record books when it comes to distributed denial of service (DDoS) attacks, so it is only proper that 2016 closes out with news of another massive DDoS attack, reported by Imperva researchers.

According to them, the Imperva Incapsula network was forced to mitigate a 650 Gbps DDoS attack just a few days before Christmas. One of the largest DDoS attacks on record, this particular assault is notable because it strayed from the bad guys' recent DDoS playbook.

For much of the year, attackers have been testing the bounds of DDoS traffic-pushing capabilities using the advanced Mirai botnet, which consists of hijacked IoT devices.

This time around, Imperva researchers say the holiday attack came at the hands of a new malicious network it calls Leet Botnet. Earlier this fall, Mirai was behind the 620 Gbps attack against KrebsOnSecurity.com, a 990 Gbps attack against French hosting provider OVH that reportedly utilized a network that could have been capable of pushing up to 1.5 Tbps in malicious traffic, and the massive DDoS in October against DNS provider Dyn that reached an estimated 1.2 Tbps in malicious traffic.

To pull off these attacks, Mirai primarily relied on tens of thousands of IoT devices, most of which were compromised CCTV cameras and DVR machines. Imperva researchers report that spoofed IPs make it impossible to figure out what kind of devices carried out the Christmas attack.

Their analysis of the payload does at least lead them to conclusively determine it was another botnet wreaking havoc. "So far, all of the huge DDoS attacks of 2016 were associated with the Mirai malware," wrote Avishay Zawoznik and Dima Bekerman of Imperva. "However, the payload characteristics clearly show that neither Mirai nor one of its more recent variants was used for this assault." Like many recent DDoS attacks, the Leet Botnet used a combination of both large and small SYN packet sizes "to both clog network pipes and bring down network switches," the pair wrote.

The smaller packets were used to push up packet rates up past 150 million packets per second (Mpps), while the larger ones were used to increase the overall attack capacity.
Imperva dubbed the botnet Leet because of a 'signature' left in some of the TCP Options headers of the smaller packets that spelled out "1337." What really interested researchers, though, was Leet's larger payloads, which were populated by shredded lists of IP addresses that indicated Leet was accessing local files of compromised devices and scrambling them up to generate its payloads. "Basically, the entire attack was just a mishmash of pulverized system files from thousands upon thousands of compromised devices," Zawoznik and Bekerman wrote. "It makes for an effective obfuscation technique that can be used to produce an unlimited number of extremely randomized payloads. Using these payloads, an offender can circumvent signature-based security systems that mitigate attacks by identifying similarities in the content of network packets."  This year we saw DDoS attacks escalate to record heights and these high-powered botnets are a symptom of the times. So far, all of the huge DDoS attacks of 2016 were associated with the Mirai malware. However, the payload characteristics clearly show that neither Mirai nor one of its more recent variants was used for this assault. Related content: Ericka Chickowski specializes in coverage of information technology and business innovation.
She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio More Insights