Subscriber Discussion

Botnet Of 900 IP Cameras Launch DDOS Attack

U
Undisclosed #1
Nov 08, 2015
IPVMU Certified

Nearly one thousand geographically disparate ip cameras have been launching coordinated distributed denial of service attacks against an unidentified targets, reported Incapsula

The attack was run of the mill, peaking at 20,000 requests per second (RPS). The surprise came later when, upon combing through the list of attacking IPs, we discovered that some of the botnet devices were located right in our own back yard. Further investigation of the offending IPs showed that they belonged to CCTV cameras, all accessible via their default login credentials.

Further research showed that these cameras had been used in previous attacks possibly by unrelated hackers.

JH
John Honovich
Nov 08, 2015
IPVM

At the bottom of that post, we asked them what cameras were involved. Their response:

"In this case it wasn't any particular manufacturer or camera model, just a seemingly random cluster of cameras that were configured to allow remote access, while also being accessible via default/easy-to-guess credentials. (e.g., amdin/admin, admin/12345, etc) You can find those is the strings dump above."

(1)
U
Undisclosed #1
Nov 09, 2015
IPVMU Certified

I think this is going to turn out to be the real use to hackers of these compromised cameras, being surrogate computing devices used for various untraceable evil.

It makes headlines when somebody yells thru a baby cam, but there's no money in it. And bit coin mining proved to CPU intensive for DVR's so I'm not sure cameras are going to be any better.

What needs to be done is a 'white hat' hacker needs to write something to log into these cameras and change the camera name to "change your root password, you can be hacked".

UE
Undisclosed End User #2
Nov 09, 2015

Where on the scale of white hat/black hat would you place a bot that helpfully changes the admin password to something random and unguessable? The technology seems trivial: from zombies to doorstops, maybe even permanently if there's no hardware reset button.

U
Undisclosed #1
Nov 09, 2015
IPVMU Certified

Where on the scale of white hat/black hat would you place a bot that helpfully changes the admin password to something random and unguessable?

Dark grey.

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions