Security risks from web cams; Hikvision cameras and NVR with security risk

[German]Security cameras with vulnerabilities pose a risk to their owners. The same applies to webcams, which can often be taken over by attackers. Cameras and NVRs (Network Video Recorder) from the manufacturer Hikvision have vulnerabilities that can be exploited by attackers. Wyze webcams have also recently attracted attention because third parties were able to retrieve video streams. I will summarize some points in a summary article.

Open security cameras as a risk

Video cameras that are not properly secured pose a risk to their operators. I have had a report from the Cybernews team since mid-September 2023, according to which thousands of IP cameras operated by their owners unprotected on the web worldwide can simply be taken over by third parties. Most of these vulnerable cameras were found in Taiwan, Vietnam, South Korea, Russia and Iran.

According to the search engine Shodan, at least 8,373 RTSP (Real-Time Streaming Protocol) cameras are openly accessible worldwide. Anyone could even find the latest saved screenshots of what the cameras see, according to Cybernews researchers. Some cameras could even be found via Google by searching parts of standard URLs commonly used by camera manufacturers.

• Poorly protected RTSP cameras can be accessed by anyone with the appropriate URL or software.
• Unprotected cameras may record sensitive or private information that can be viewed by third parties.
• Access to RTSP streams from security cameras could be used for malicious purposes, such as tracking people's movements, monitoring routines, planning break-ins or other criminal activities.
• Exploiting an unprotected camera could give attackers a foothold in the network to launch further attacks or gain access to other devices connected to the same network.
• The uncontrolled disclosure of RTSP camera feeds can lead to legal and ethical dilemmas.
• Unprotected RTSP cameras can compromise public safety initiatives by allowing unauthorized access to video feeds.

"The significance of openly accessible RTSP cameras goes beyond technical vulnerabilities and touches on fundamental principles of privacy, security, ethics and trust. Addressing this issue is essential not only for the protection of digital assets, but also for safeguarding the rights and values that form the foundation of modern society," the researchers said. The report can be accessed here in a version updated in November 2023 – and shows that Germany also appears "red" on the map with open cameras.

Wyze webcams as a security risk

I remember Wyze as a provider of webcams, as their products always attract attention due to security flaws. In 2019, I still remember my article IoT provider Wyze admits data leak here in the blog and in 2022, the article Vulnerabilities in Wyze Cam IoT camera firmware (March 2022) dealt with another vulnerability.

The Verge already mentioned in this article in September 2019 that some Wyze camera models were unsafe. The Wyze Cam v3 is also sold on the German Amazon pages for around 100 euros (as an Amazon tip) as "Wyze Cam v3 1080p HD IndWyze Cam v3 1080p HD indoor/outdoor video camera with color night vision, 2-way audio, works with Alexa & the Google Assistant and IFTTT". In the German blog post RCE-Exploit für Wyze Cam v3 veröffentlicht (Nov. 2023), I pointed out that an exploit for exploiting the vulnerabilities of Wyze cameras has since gone public. Anyone using such a camera should therefore ensure that it is secured by firmware or cannot be accessed via the internet.

Hikvision cameras and NVRs with security vulnerabilities

The Chinese manufacturer Hikvision also occasionally comes up with vulnerabilities or problems (see More than 80,000 HikVision surveillance cameras exploitable). There is currently another vulnerability, CVE-2023-48121, which the manufacturer has addressed in this security notice. A vulnerability in the authentication bypass of the Hik-Connect module threatens some Hikvision products. The vulnerability, which has a CVSSv3 score of 8.2 (max. is 10), allows attackers to exploit services by sending crafted messages to the affected devices.

A list of affected products can be found in the Hikvision security notice. A firmware update is available. German site heise points out in this German article (thanks to the reader for the tip) that Hikvision cameras and NVRs (video recorders) are also sold by other manufacturers under their own label. heise has also linked this English article by the vulnerability discoverer, which refers to Ezviz CS-C6N cameras.