Subscriber Discussion

Russian Hacking And The ONVIF Device Manager

UI
Undisclosed Integrator #1
•Sep 28, 2017

Given the concerns about Kaspersky (Eugene Kaspersky a Russian and the owner is a known GRU agent), and the fact that many agencies in the federal government have banned Kaspersky Anti-Virus because of hacking concerns, has anyone been concerned about the use of the ONVIF Device Manager, which a lot of people use to test ONVIF devices, is written and distributed by Russians?  Does anyone have the inside scoop on this piece of free software?  Is it a potential Russian hack?

JH
John Honovich
•Sep 28, 2017
IPVM

I believe the ONVIF Device Manager is open source (see their GitHub repository) which would allow for reviewing the source code for any issues.

U
Undisclosed #2
•Sep 28, 2017
IPVMU Certified
In reply to John Honovich

This is certainly a help, and would allow easier searching for obvious door mechanisms, and fast comprehension.  Though with reverse compilers, although far more tedious, the same critical elements can be discovered.  

IMHO, a greater threat comes from a door that is "hidden in plain sight", right in the source, by using either deceptive code, that misdirects, or by surreptitiously allowing known attack vectors.

This is what bashis was referring to when he wrote (about his Axis hack)

# This made me start thinking how brilliant and clever it would be to make an sophisticated door that's using format string as backdoor,
# which generates no FMS output whatsoever to attacker and unlocked by a 'FMS key', instead of using hardcoded login/password.
#
# - No hardcoded login/password that could easily be found in firmware/software files.
# - Extremely hard to find without local access (and find out what to trigger for opening the door)
# - Nobody can not actually prove it is a sophisticated door for sure. "It's just another bug.. sorry! - here is the fixed version."
# (Only to close this door, and open another door, somewhere else, in any binary - and try make it harder to find)

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions