Axis 5 Vulnerabilities Examined

Nelly's Security

Now even Axis has locked and loaded cyber warfare weapons in their arsenal? What did we do to all these camera manufacturers to deserve this.

Joking aside, im curious to see the response to this article in comparison to similar articles from Hik/Dahua.

Bashis, Nice work, you are a gem to the surveillance industry.

Reactions:

(3)

(1)

(2)

Rich Moore

I think it will be telling to see the response from all manufacturers that have been hacked/vulnerable.

Reactions:

(3)

Undisclosed End User #1

The difference? When it happens to Axis we are still surprised.

Reactions:

(3)

(2)

Brian Karas

IPVM

Joking aside, im curious to see the response to this article in comparison to similar articles from Hik/Dahua.

Responses will likely be less critical, since as pointed out in the report this is not an easy to execute backdoor like Hikvision.

Also, Axis has released clear documents outlining the actual vulnerabilities, and potential for exploit without trying to place blame on others for having these vulnerabilities in their cameras, which generally has the effect of creating less overall controversy around the issues.

Reactions:

(13)

(1)

Undisclosed #2

IPVMU Certified

Now even Axis has locked and loaded cyber warfare weapons in their arsenal?

Joking aside, what are you even talking about?

This not a ‘backdoor’. It’s not even an open door, at least not yet.

Reactions:

(7)

(1)

Undisclosed Integrator #4

Bashis, Nice work, you are a gem to the surveillance industry.

Bashis has risen to almost mythical status. IPVM should bring Bashis aboard :)

Reactions:

(2)

(1)

Undisclosed Integrator #3

Maybe I am misunderstanding the threat level on this, but the UPnP Exploit looks pretty bad from an Insider Threat/Compromised Network POV. Why is it only considered a low risk?

Reactions:

Brian Karas

In reply to Undisclosed Integrator #3

IPVM

The UPnP exploit would have the primary impact of just affecting UPnP. There is a small chance it could be turned into a more complex remote code exploit, but so far no such exploits have been developed.

Because this exploit is related to a linux library used by many systems/vendors (meaning millions of devices, making a potentially attractive target base), and there have been no known exploits developed that turn it into a remote code execution or backdoor-style risk, it is unlikely that any new exploits will come just because Axis is also affected.

All things considered, an insider threat would probably prefer to use bashis' vulnerabilities over this one to try and attack an Axis camera.

Reactions:

(3)

Undisclosed Integrator #3

In reply to Brian Karas

Thanks for the explanation Brian. That makes a lot more sense in my head. I am also assuming the real threat is combining Bashis's vulnerability with something like a KRACK vulnerable radio to compromise the camera, but that is a different discussion.

Reactions:

Undisclosed #2

IPVMU Certified

To assess how likely this overflow bug can be turned into a real remote root weapon, some fuller disclosure from bashis is needed, namely:

How much time have you spent so far looking in the output for something that you can use to get root?

Reactions:

bashis mcw

Someone that exceed my newbie knowledge, that can beat Axis non-executable and ASLR on both stack and heap, which means researching ROP chains for ARM and MIPS.

Reactions:

(1)

Undisclosed #2

IPVMU Certified

In reply to bashis mcw

No GOT?

Reactions:

bashis mcw

Take the challenge to develop reliable exploit.

Reactions:

Undisclosed #5

I see Axis cameras are not listed on the BusyBox Products/Projects page: https://www.busybox.net/products.html. I would not be surprised if this would be updated after this article :-)

Reactions:

Undisclosed #6

"If you distribute BusyBox without making the source code to the version you distribute available, you violate the license terms, and thus infringe on the copyrights of BusyBox"... does Axis make the source available?

Reactions:

John Honovich

In reply to Undisclosed #6

IPVM

#6, I've asked Axis for a response and will post back when received.

For others, the quote above is from BusyBox's license page.

Reactions:

Undisclosed #2

In reply to John Honovich

IPVMU Certified

From the third party license file for a P3367 camera

To request source code for all open source software included in this
product, send a letter to the address below. In the letter, please
state the following:

* Product name and firmware version
* Name and postal delivery address
* Billing address

The requested code will be sent to you on a CD at a charge of 20 USD,
to cover distribution costs.

Axis IPR Department Contact Information:

IPR Department
Axis Communications AB
Emdalav�gen 14
SE-223 69 Lund
Sweden

Reactions:

Undisclosed #6

Thanks U#2... a good open source corporate citizen... nice to see.

Reactions:

bashis mcw

I have not seen anyone so far that don't run BusyBox.

Reactions:

(1)

Undisclosed #2

IPVMU Certified

In reply to bashis mcw

I have not seen anyone so far that don't run BusyBox

Here you go:

Take the challenge and be the first to develop an exploit.

Reactions:

Undisclosed #8

•Dec 05, 2017