Claimed Security Vulnerability in Axis, Aimetis and Milestone VMSes

Author: John Honovich, Published on Nov 09, 2015

A Swedish research firm has claimed to discover a 'critical vulnerability' in major VMS software platforms including Axis (ACS), Aimetis and Milestone.

* ******* ******** **** *** ******* ** ******** * '******** vulnerability' ** ***** *** ******** ********* ********* **** (***), ******* and *********.

[***************]

*** ****,***** ********, ****** * ******, ********* ** **** *** ******** ** ********** *****.

*** ******* ** *** ***** **** ******* ** ******* ** HTTPS, ***** ** ******* ** **** ************ ****. ***** **** do *** *** ***** ***** ** ******* ** **** **** regardless.

**** ***** *******, * ***** ************ **** ***** ********** ****** that ****** *********** ***** *** ** ******** / ***********. *******, Total ******** ****** **** ***** ***** *** *********** ** *******,******:

"**** *** ************ ** ********* *** ******* ******* *** ******* and *** *** ***** ***** ** ******* ** **** ************** downgrade ****** ** *** *** *** ** ******* *********** *** HTTP ***** ************** ******* ** **** ****** **************.

**** *** ******** ******* *** *** ****** ** ** ********* the ************** ******** *** **** *** ******** **** * *********** is ** *** **** ***** *****."

***** ******** **** **** ******* ***** *** ******* ***** ** susceptible ** **** *** **** *** ******* ** ****** ****.

[******: ******* ******* * *** *** **** *******, ***** ** detail ** *** ******** *****.]

******* ** *** **** ** ********, ***** ************* **** *** use ***** **** ***** ******, **** **** ** *** * widespread ******* (****** *** ***** ***** *** **** **** ** a ******* ** ******). 

*** ** *** ******* ******** *** * **** ******* **** one ***** ******* ***** ** ********* ****/*** ****** ***** ***** ** ******** ***** ****** ******* ****. *******, ***** ******** checked, ********** **** ********* "**** *** ******** **** *** ****** ** ** ********** ** is * ****** ****** ****** ** ************."

******* **** ** ***** ** ****** *** ********* ************ ** assess.

Comments (18)

Comes down to design, You shouldn't be designing it in such a way you aren't using A VPN over the internet, A vlan internally or your own security lan.

This exploit assumes there is access to the (V)LAN.

That's one of the issues with these issues, to be exploited there is a narrow avenue to do so. Even if it could be done, since it needs to be done physically in a very specific spot, the probability of it being used is quite low.

IMHO, these are the perfect type of vulnerabilities to be found. Bad enough sounding to force the vendors into hopefully fixing them, but infeasible to use by most.

And since none of the platforms likely support certificate pinning, they are essentially susceptible to a MITM attack as well ( if you can get physical access to the VLAN and/or network there are lots of ways to intercept encrypted traffic that is not fully secured).

The predicated assumption with that statement is that:

- They have access to your encrypted tunnel

- The tunnel is generally accessible over the internet

Both statements being false ensures that no access can occur if this is a closed network (even over VPN). If an airgap is used in design - premise network is isolated from access via a physical (not virtual or software based) firewall on different (non-routed) networks, then there is no potential for exposure unless from within.

Good design precedes secure networks - without it you shouldn't expect that any system you have in operation that operates over HTTPS will be secure.

...without it you shouldn't expect that any system you have in operation that operates over HTTPS will be secure.

Though even if someone is directly on your LAN, as is predicated in this exploit, an HTTPS connection should be secure, no?

Some cameras allow you to require digest authentication, as opposed to allowing digest/basic to both be available. I think the trick, is that the VMS needs to have a setting to require SSL or digest authentication, and to fail the connectin otherwise - so it couldn't then back down to basic authentication.

Using 802.1x and IP filtering can require a certificate for the device to allow it on to the network and then who it talks to. This could then ensure a 3rd party isn't inserted into the conversation...

I think the trick, is that the VMS needs to have a setting to require SSL or digest authentication, and to fail the connectin otherwise - so it couldn't then back down to basic authentication.

Maybe even once successfully connected via digest, always insist on digest. Not all cameras support digest (even now!), but there is no good reason I'm aware of that once you know it's capable, to downgrade it.

There are a couple different favors of digest auth out there, so even if a camera supports it, it's not guaranteed the VMS can use it. But once they have, for a given MAC, why go back?

I’m the Product Manager for Aimetis Symphony VMS.

While the security vulnerability described is primarily a network issue and requires access to the LAN on which the VMS and cameras are operating, Aimetis’ latest Device Pack (DP-35), released last week, addresses this issue. Aimetis DP-35 and the accompanying Release Notes are available free for download for all of our distributors and resellers. This free update prevents potential attacks described above by disallowing the HTTP authentication downgrade.

Aimetis takes all potential security issues seriously and deals with these matters in a proactive and transparent nature. In addition to providing free software fixes, Aimetis issues Security Advisories on its website that provide instructions for issue resolution along with technical support details. We also immediately notify all Aimetis certified distributors and resellers globally about the Security Advisory regardless of how remote the risk may be.

Justin, thanks. I've updated the post noting that.

This is a good oppurtunity for ONSSI Occularis 5.0 to shine over Milestone!

Did SeeTec do security right?

Genetec released 2 knowledge base articles related to this topic:

  • KBA01403 - Deactivating Basic authentication for the HTTP and RTSP protocol
    This article explains how to deactivate basic authentication for the HTTP and RTSP protocols to prevent Address Resolution Protocol (ARP) spoofing attacks between the Archiver and a camera.
  • KBA01404 - Reactivating Basic authentication for HTTPS communication
    This article explains how to reactivate basic authentication when an HTTPS connection type is being used for a camera.

Easy to read breakdown on these types of attacks: https://www.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack

I actually want play the devil's advocate for basic authentication as I see it getting some bad press.

TL;DR: if you have an encrypted connection (including HTTPS) or otherwise can prevent interception of your HTTP streams, basic authentication can be a good thing. If you are using only HTTP and are sending data through hostile territory, then digest authentication may be the way to go.

This is as far as HTTP server security is concerned (and every IP camera is basically a little HTTP server) and may not be applicable in all contexts:

Digest authentication has a minor problem. Due to how digest authentication works, it typically requires the server to store your password on disk in order to authenticate you. Basic authentication, however, allows the server to keep only a hash (a "fingerprint") of the password. Storing only the hash makes it more difficult for anyone accessing the server (or camera) to discover your password. But servers that store the whole password (like any time digest auth is used) make this data available to anyone who gains access to the server. Since passwords get reused a lot, this kind of breach can have a bigger impact.

Yes, basic auth sends your password over the wire. Any kind of connection can involve sensitive information, and technologies like HTTPS and TLS are designed to protect this information when used properly, and when kept up to date with known vulnerabilities.

I cannot find an easily digestible reference to support this right now (no pun intended), but anyone interested should be able to confirm this with a little research.

But servers that store the whole password (like any time digest auth is used) make this data available to anyone who gains access to the server. Since passwords get reused a lot, this kind of breach can have a bigger impact.

Servers don't need to store the whole password by itself. The user, realm, password hash, HA1, can stored instead. That way it won't be useful outside of the realm.

I was writing based on some old memories, but a quick read of the RFC shows that you are correct for some cases. My goal in posting previously was not to argue against digest authentication only to raise awareness that basic authentication is not always to be shunned.

I would not argue this point further, except to mention that digest auth depends specifically on the MD5 algorithm. I do not believe storing a password based on its MD5 digest is considered safe in recent years, due to advances in collision attacks against MD5 specifically. Not depending on HTTP digest authentication, a server could store passwords with any hash algorithm (such as bcrypt) and be able to use basic auth.

I would not argue this point further, except to mention that digest auth depends specifically on the MD5 algorithm. I do not believe storing a password based on its MD5 digest is considered safe in recent years, due to advances in collision attacks against MD5 specifically.

I would not defend this point further except to mention that RTSP digest authentication does not depend on collision resistance:

In 2011 an informational RFC 6151[11] was approved to update the security considerations in MD5 and HMAC-MD5. For HMAC-MD5 the RFC summarizes that - although the security of the MD5 hash function itself is severely compromised - the currently known " attacks on HMAC-MD5 do not seem to indicate a practical vulnerability when used as a message authentication code." -Wiki

Note: Milestone confirms they are aware of this issue, we are awaiting a response. One would hope they would respond sooner to such concerns.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports on VMS

ReconaSense - The AI / Access Control / Analytics / IoT / Video Company Profile on Jun 12, 2018
One company's ISC West booth stood out for displaying a light-up tower of buzzwords. The company, ReconaSense, pledged to be 'making sense of it...
H.265 / HEVC Codec Tutorial on Jun 07, 2018
H.265 support has improved significantly in 2018, with H.265 camera/VMS compatibility increased compared to only a year ago, and more manufacturers...
Bosch IVA Video Analytics And Motion+ VMD Tested on Jun 06, 2018
Bosch's video analytics now ship on nearly every model, from indoor domes to high-end 5MP starlight cameras.  In this test, we evaluate Bosch's...
Hikvision PanoVu 20MP Flexible Camera Tested on Jun 01, 2018
Hikvision has released their first repositionable multi imager cameras with integrated IR included, atypical in competitors. We bought and tested...
Oncam 12MP Fisheye Camera Tested on May 29, 2018
Oncam has made their name since the early 2000s as a fisheye specialist, focusing only on panoramic cameras. To see how this specialist stacks up...
VMS Server Sizing on May 25, 2018
Specifying the right sized PC/server for VMS software is one of the most important yet difficult decisions in IP video surveillance. In the past...
Hanwha Wisenet X Analytics and VMD Test on May 24, 2018
Continuing our updated testing of camera analytics, we tested Hanwha's Wisenet X analytics for over two weeks in multiple scenes, indoors and out,...
Software Only VMS vs NVR Appliances on May 23, 2018
Should you buy your own PC/server and load VMS software on it or get a turnkey appliance (both hardware and software, e.g., NVR, Hybrid DVR) from a...
Dahua Intrusion Analytics And VMD Tested (Poorly) on May 21, 2018
Dahua ships basic analytics on practically all their cameras, ranging from low cost to high end. To see how these analytics work in real world...
Best Manufacturer Technical Support 2018 on May 21, 2018
While 5 manufacturers made the worst technical support 2018 list, only 3 stood out as providing the best technical support to 190+ integrators in...

Most Recent Industry Reports

July 2018 IP Networking Course on Jun 16, 2018
The last chance to save $50 on registration is this Thursday, June 21st. Register now and save. This is the only networking course designed...
The Dumb Ones: PSA's Bozeman On Cybersecurity on Jun 15, 2018
The smart ones are the hundred people who flew to Denver and spent $500+ on a 1.5-day conference featuring Dahua as a 'cyber responsible partner',...
Amazon Ring Launches $10 Monthly Professional Alarm Monitoring on Jun 15, 2018
Amazon's Ring has announced an alarm system with 24/7 professional alarm monitoring for $10 per month, a fraction of the $30+ per month traditional...
Axis Releases First New Access Controller In 5 Years (A1601) on Jun 15, 2018
It has been 5 years since Axis 2013 entry in the physical access control market, with the A1001 (IPVM test). Now, Axis has released its second...
Hikvision 12MP Fisheye Camera Tested (DS-2CD63C2F-IV) on Jun 14, 2018
Hikvision's DS-2CD63C2F-IV is their flagship panoramic camera, with a 12MP imager, 15m integrated IR, smart codec, and more. We tested the 63C2 in...
Four Major Outdoor Camera Install Problems on Jun 14, 2018
Over 140 integrators told us the top four camera installation mistakes that lead to unexpected problems and failures. Their comments often...
Security Sales Course Summer 2018 on Jun 14, 2018
Based on member's interest, IPVM is offering a security sales course this summer. Register Now - IPVM Security Sales Course Summer...
China Public Video Surveillance Guide: From Skynet to Sharp Eyes on Jun 14, 2018
China is expanding its video surveillance network to achieve “100%” nationwide coverage by 2020, including facial recognition capabilities and a...
IPVM For PR / Marketing People on Jun 13, 2018
This post helps PR and Marketing people understand and productively work with IPVM (as much as possible given our independent, often critical,...
Avigilon H4 Multi-Sensor Adds 32MP, H.265, Analytics on Jun 13, 2018
Avigilon has announced the H4 Multisensor, the successor to their repositionable multi imager line, adding features like H.265, integrated IR,...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact