Geovision Unprecedented Security Vulnerabilities And Backdoor

Any Geovision partners out there get a heads up about these exploits? Just curious of how well they took advantages of those 14 days.

Reactions:

(3)

bashis mcw

GeoVision prompts you to check for firmware updates

I'm bit interested into what you get 14 days from, Geovision got 90 days to fix the vulnerabilities and inform their customers. The DRAFT Full Disclosure was initially provided at the same time as the first contact was made (with one update some days after), due to I asked around and got reliable contact suggestion. 14 days before FD I sent both revised FD and Python PoC for any objections or comments.

What I know, when Google some I found at least following links, that shows Geovision was not so passive.

Periodic Updates Required For Cybersecurity

Reactions:

(2)

(1)

Undisclosed Integrator #1

In reply to bashis mcw

The 14 days between January 17th and February 1st. I am curious if GeoVision reached out to it's higher level partners about these exploits when they had a correction before the full disclosure.

Reactions:

bashis mcw

Seems they did;

GeoVision have recently sent a mass email prompting all customers to check that their GeoVision devices are using the latest available firmware:

no?

Reactions:

Undisclosed Integrator #1

In reply to bashis mcw

I personally didn't catch the email, but I don't use/have very many GeoVision cameras (less than 50). Wondering if other integrators who are more deeply involved with GeoVision got a heads up before the full disclosure.

Reactions:

bashis mcw

Interesting.

I could find that as actual very good practise to get customers/integrators heads up before full disclosure, as the manufacture knows very well it will happen and when it will happen. (kicks a bit on Axis's narrow leg here too)

Reactions:

(1)

Undisclosed Integrator #1

In reply to bashis mcw

Yup. Hence why I am asking others if their experience differed from mine.

Reactions:

(1)

bashis mcw

I've joined you in same question.

Reactions:

Phil Stewkesbury

I received an email from GeoVision on January 24th, which prompted the Post at our Forum linked to above.

I've appended an image of the actual email FYI at that Post now.

(NB - only 48 views to date since Jan 24th)

Reactions:

(3)

Phil Stewkesbury

GeoVision have sent out an email to Partners this morning with an update, and links to firmware updates.

I have added the pdf of the notice provided to our Forum Thread.

NB Their notice cites IPVM:

"In the wake of the security vulnerabilities that have been reported of late, GeoVision has actively responded, as noted by a section within the IPVM disclosure report illustrated below, by releasing a series of firmware upgrades to resolve the issue."

Reactions:

(2)

John Honovich

In reply to Phil Stewkesbury

IPVM

Phil, thanks for sharing. I am quite unhappy about Geovision referencing us. We absolutely did not give them permission and their excerpt clearly misrepresents our overall position, specifically about how bad their security / coding was.

As a response, I am going to include a section in our next newsletter to 50,000 recipients criticizing Geovision both for their cybersecurity problems and misuse of IPVM.

Reactions:

Brandon Taylor

In reply to John Honovich

"John recognized the difficulty in getting unbiased, high quality information on what really worked and, especially, what did not."

That doesn't seem very "unbiased" there John... Fair-Use dictates they did not need your permission.

Reactions:

John Honovich

IPVM

Brandon, Geovision misrepresented our analysis of their vulnerabilities. We were clearly critical of the serious problems. However they framed it as if we were endorsing or supporting them.

Secondly, where is that quote from and how is that related to this topic?

Reactions:

Brandon Taylor

The quote is from your own profile page (John Honovich) and it's related because you said you were going to put them on blast because they didn't get your permission to cite your article (which they didn't need).

Reactions:

John Honovich

IPVM

Brandon, The issue is not about permission. We don’t give permission for companies to use us in promotions. Secondly, it is a violation of our terms of service.

I see that you are new to IPVM so I’m happy to explain our policies. Any other questions, let us know.

Reactions:

(1)

Brandon Taylor

In reply to John Honovich

Got it, but your terms do state "Finally, within the bounds of fair use, you may publicly copy excerpts of our research for criticism, news reporting, teaching, etc."

One could make the argument that a newsletter email containing a PDF "article" complies with your terms.

Not trying to stir the pot here on my first day and I see your point of them citing you in a fashion that makes them look better however they didn't alter your words. You did actually praise them for that 1 aspect even though there were many criticisms they omitted.

Just my 2 cents.

Liking the site so far!

Reactions:

John Honovich

•Feb 10, 2018

IPVM

Brandon, thanks!

Our terms definitely allow for fair use. That's fundamental American law. However, so too is the right of publicity.

What Geovision did there was not news reporting, teaching nor criticism. It was a message to their customers. By contrast, if Krebs on Security wrote about it and cited us, that certainly would be fair use.

Ultimately, though, that issue is secondary. My main concern is that, for our reputation, I cannot allow manufacturers to misuse your brand to promote themselves, even worse when they are distorting our analysis.

I aim to accomplish 2 things be emailing this in the newsletter: (1) inform people that Geovision misrepresented our analysis and (2) to signal to other manufacturers that doing so comes with the penalty of further criticism.

Reactions:

(1)

John Honovich

IPVM

Brandon, let’s say I ran a lemonade stand. You wrote a review saying John’s lemonade is very inexpensive but it’s terrible. Then I sent out a promotion saying that Brandon praised our lemonade for being inexpensive but I left out the part about you saying the lemonade was terrible. That is analogous to what happened here.

Reactions:

(1)

Brandon Taylor

In reply to John Honovich

Got it, you posted this in the middle of my response but in short, I do agree that they picked what made them look better :)

Reactions:

Undisclosed Manufacturer #2