ONVIF Exposure To "Devastating DDoS Attacks" Examined

By: Ethan Ace and John Scanlan, Published on Sep 06, 2019

ZDnet reported "Protocol used by 630,000 devices can be abused for devastating DDoS attacks", citing exposure of ONVIF devices.

soap ONVIF issue_2

And after an IPVM discussion asking about ONVIF being 'dangerous', Verkada launched a Facebook ad declaring that:

IPVM investigated the vulnerability, speaking with the researcher, examining:

What the risks are and how severe it is for ONVIF devices
How the vulnerability works and what conditions must be met
ONVIF response to vulnerability
Input from the researcher
Potential for abuse
Mitigation steps

Executive *******

*** **** ** ********** ONVIF ***** ** ********* low ** ** ******** a *********** ** ******** errors: (*) * ******, non-standard, **-********* ************** **** (2) ******* * ***-********, uncommon **** ** *** public ********.

** *** ***** ****, devices **** **** **** conditions ** ********* * threat ** ***** *********** used ** **** *******.

No ******* ** ****** ** ******

** ******** ***** ***** not ** **** ** take ******* ** *** device, **** *****, ****** to *****, ***., **** if * ****** ***** both **********.

Faulty **-********* ******** *** *******

** ***** ** ** vulnerable ** **** *******, cameras **** *** * faulty **-********* ************** ***** allows ********* ** ** sent **** *** ********.********* ** **-*********'* **************, ** **** ********* and ************* ** ******** **** the ********:

************, ***** ** ***** disabled ** ******* ** current *******, ********* ****, Dahua, *** *********, ** it **** ** ******** enabled ** ***** *** WS-Discovery ** *** **** locally.

Uncommon **** **** ** **** (***/****)

******, ******* **** ********-****-********** (**** ********, *** not ***********, **** ** ONVIF) *** *** **** 3702 **** ** *** internet (** ******** ****).

*** **** **** **** allow ******** ******* **** the ******** ** **** attackers *** **** **-********* requests. **** ***** **** port **** **** ** forwarded ********, ********* ****, ** ** ******** connected ** *** ******** without * ******** ******** ports (*.*., ******** ********* to * *****).

**** **** ** ********,*** * ****** ****, *** ******** ** be ******** ********* ** anyone ***** **** ****** users. ****** ***** ** or *** ***** *** commonly ******** *** ****** access ** ******* *** open ** *******/*********, **** is ************* ****** ******** to ** ****.

UPnP ********* ******** ** *******

************,***** ** *** *******, **** ************* ******* UPnP ** *******. *******, it ** ******** **** older ********* *** **** enabled **** *** ****** port ****.

Low **** / *********** ** **** ******* ********

***** **** ***** ******* are ************ **** ***********, all ** **** ***** true ** ****** ******** in *** **** ******** of *************.

ONVIF ********

**** ******* ***** *** more *********** ** **** exploit. ***** ******** *****, in *****, **** ** contact ************* *** ********* guides:

***** ******** ********** *** selects ********* **** ******* integration *** ********** ** physical ******** *******. **** manufacturer **** **** ******** hardening *** ******* ********** to ***** ***** ******** to ** **** ** a ****** ****** ** various ******* ************. ** a ******* **** ***** profiles **** ******** *** use ** ******** ******** where ********** ******** ******** were ** ***** ** help ***** (******* ****’* and *********) ** ******* eliminate (******* *******) ****** to *** ********* **** an ******* ******. ** users ******* ********** ********** ******* **** *********** about *** ** ******** harden ***** ******** *** deployment, **** ****** ******* the ****** ************.

Axis ********

**** ********* **** **** were ********** ***** *** analysis *** ******:

** *********** **** ** is ******** ** **** the ********* **** ****** using ******* **-********* *******. This ** ******** ** the **-********* ******. ***** did *** ****** **, ONVIF **** ********* ** use **-********* ** ******** deployment.
*** ****** ** ******* devices *** *** ********** of **** ****** *** always ** **********. ** the ****** *** ******* it ** ********** - not **** *** ****. We *** ******* ******** to ****** *** ****** of ********-****** ******* ********* hardening ***** *** ****** Remote ***** ****** (**** Companion). ** ******** ********** customers *** ******** ******** devices ** ********.

Manufacturers ********

********* ** ****** *******, the ********** ****** ** the ***** *******, **** percentages ** *** ******** exposed ******* ** *** found *** **** **** and *****. *** *** searches ******* **** ****** 100,000 ***** ******* ******* to ******** *** **** UDP **** ****. *******, we ***** *** **** such ******* ** **** devices *******. ** **** not ********* ***** ******* are ********** ** ********** to ****** **-********* ********, but ******* *** ****** multiple ******* ***** ** these ******** *** *********.

*******, ** *** *******, current ***** ****** ** not **** *** ******* by *******, *** ** they **** **** ***** enabled.

Exploit ********

****** ***** ******** ** this ******* **** ********* ~350 ****, *** **** recently, ******* ** ***+ Gbps **** ****. *** reference, *** **** ** approaching *** ********* ** the **** ********* **** ***** ** Security (*** ****)*** ***** ** **** that ***** **** ********** ** **** (*.* Tbps), *** ******* **** ever ********.

** *** **** ** writing, ***** **** ***,*** public ****** ******* **** UDP **** **** **** responding ** "*****" *******, shown *****:

*** **********, *******, **** us **** **** ** these ****** ********* ********* to **-********* ******* ****. He **** **** **** sending * ***** ******* often ****** * **** larger ********, **** ************* of **** ********.

Potential ******

****** ******* ************* *** unlikely ** ** ********* using **** *************, ~***,*** rogue ******* **** *********** potential *** ******. *** example, *** ***** ******, which ********** ******** ~***,*** devices ** *******, *** used ****** **** * *******'* internet,******* ******, *** ****.

**********

*** ********** *****, ***** are *** ***** ***** which *** ** ***** to ****** **** *** not ********** ** **** exploit:

******* ****:******** **** ************* ******* UPnP ** *******, ** may **** **** ******* by ******* ** *** older ********.
****** **** **** ** closed:***** ****** **** **** sure **** *** **** 3702 ** ****** ** their ****** ** ******** and *** ***** ******** traffic ** **** **** to *** ********.

*** ***** *** *** unaware ** *** ******* enough ** **** ***** changes, ********** *** ********* impact ** ***** ******* will ****** **** ** ISPs, ** **** *** choose ** ***** ** rate ***** ***** ********.

Comments (24)

Undisclosed Manufacturer #1

09/06/19 02:05pm

* ***** **** "*** risk" ******* *** **** that **** **** ***** 627 ******** ******* ** the ******** ***** ****, over *** ******** **** report ********** ** ***** device.

* ****** *** ******** to ** ******* ******** exposed ** *** ********, but **** ****** ** simple ** *****. ** the ****** **** ******** to ******** ** *** multicast *******, **** **** makes ** **** ****** for *** ******** ** send *** *******.

John Honovich

IPVM | In reply to Undisclosed Manufacturer #1 | 09/06/19 02:07pm

* ***** **** "*** risk" ******* *** ****

*** **** ** ****** who **** ***** *******. The ********** **** ***'* ONVIF ****** ** **** of **** **** ** extremely *** ******* ** this ****** ******** ************.

**'* ********* * ****** risk ** ******* **** might ** *** ***** these *******.

Undisclosed Integrator #2

In reply to John Honovich | 09/06/19 02:55pm

* ***** *** ***** not **** ** *** it ** *** **** because ** ******* ********** requirements *** ****** ** the ****** ******; *** vulnerability ** ***** *** exploitable. **** ********** ****** having ***** ***** ****, and **** *** ******* networking ********* ** *****, the ****** **** ** a ****** ****** ***** discoverable ****** ***** **** in * ****** ** extremely ****.

********* *** **** ** a ************* ***** ** an ********** ******-**** ** experiencing ** ** ***** sighted. ** ***** ** akin ** *** ******** about * ******* ************* update ******* *** **** have * * ** 10000 ****** ** *** specific ******* ***** **** to ****** **** ********. You ***** **** ** take ** ********* *** update.

**** ** **** ******* version ** *** *** amplification ******. *** ***** everyone ****** ** *** a ****** ********, ***** people ********** **** *** could ***** *** *** server ** ****** * target.

John Honovich

IPVM | In reply to Undisclosed Integrator #2 | 09/06/19 03:03pm

“*** ****** **** ** a ****** ****** ***** discoverable ******”

*** *** *** ********** of * ******** ****** ONVIF ****** ** *** specific **** ******, **** no ************ ********** ** use, ** **** ***.

John Honovich

IPVM | In reply to Undisclosed Integrator #2 | 09/06/19 03:08pm

********* *** **** ** a ************* ***** ** an ********** ******-**** ** experiencing ** ** ***** sighted.

**, **’* **** ***** human ***** **** ***** day. ***** *** * vast ***** ** ***** every **** *** **** out *** **** *** most *** *** *** you *** ****** ******.

** **** ****, ** is ***** ** *** what *** *** ******** to *** ******** *** in *** *************** **** case **** ** ****, close **.

Undisclosed Integrator #2

In reply to John Honovich | 09/06/19 03:27pm

********** ** **** ********** risk ** ****, ** is ***** * ****** concern, *** ******* **** a ******** ******* ** their ******* ***** ** make **** *** **** is *****. *** ****** surface ** ***** ****** with ****** ************* ** warrant * ****** **** assessment.

Undisclosed #3

09/06/19 04:11pm

******** * *** *** the ***** ** ***** this ***, ***** ** was ********* ** * previous ******, * ******** this ******** ** ****** ***** *********?******:

Why **** ******* (** *** ******) **** ~**% ** *** ******* *******?

*** *** *****'* ****** but ** (*** *** original ******) ***** **** is ******* ****** ** try *** **** *** why **** **?

Undisclosed Integrator #5

In reply to Undisclosed #3 | 09/06/19 04:51pm

*** *** *** ******** that **% ******? ********* to ******, *** ***** results *** ***** (******** for **** ****) ** 181,542. *** ***** *** Vietnam ** **,***. ****'* 17%.

*** *** ***** ******* from ********* ****?

**** ** ** ** 17%, ******, * ** still **** ** *** that ******* *** *** largest **********.

Undisclosed #3

In reply to Undisclosed Integrator #5 | 09/06/19 05:00pm

* **** *** ******* from *** ******* ****** towards *** *** ** the **:

*** * **** * calculator ** *** *** figure ** **.************** ([***,*** x ***] /***,***) - and *********** **** ** ~80%.

John Scanlan

IPVM | IPVMU Certified | In reply to Undisclosed Integrator #5 | 09/06/19 05:08pm

*** ******* **** ******** from**********.

John Scanlan

IPVM | IPVMU Certified | In reply to Undisclosed #3 | 09/06/19 05:05pm

*** ****** ** *** left ** *** ******* is *** *** ****** of ******* ** **** country, ** ** *** column ** *** *****:

Undisclosed #3

In reply to John Scanlan | 09/06/19 05:27pm

***.

**** **** *** ******* column **** ** ******** represent ** *** ******* column ***** ********* ********** exposed ******* ** **** country?

Undisclosed #4

IPVMU Certified | In reply to Undisclosed #3 | 09/06/19 06:06pm

******* ******** **** **** open **** *** *********.

** ***,*** ** *** devices **** **** **** open **** ***** *******, based ** *** ****** returned.

Undisclosed #3

In reply to Undisclosed #4 | 09/06/19 06:15pm

**** *** *** *** of *** ***** ***** categories **** ****** '*********'-***** numbers **** ******* '********'-***** numbers?

Undisclosed #4

IPVMU Certified | In reply to Undisclosed #3 | 09/06/19 09:34pm

**** *** *** *** of *** ***** ***** categories **** ****** '*********'-***** numbers **** ******* '********'-***** numbers?

******* *** *** ********* are *** *****, *** most, ** *** ***, products ***, **** *** in ********** *****.

****, *** *** **** the **** ** *** graphic, ******** **** *** line *** *****?

John Scanlan

IPVM | IPVMU Certified | In reply to Undisclosed #4 | 09/06/19 07:11pm

**** *** *** ***** devices. * ** *** sure **** ********** ** query/response ** *** *********** to ******** **** **** different ******** *** **** are *** ***** ******* with **** **** ****.

**** ** ** ******* of ** ***** ****** when * ** ** the *** *********:

"******* **** ******" **** I ****** ** *** interface:

*** **** ** **** of *** ***** ******* categories. * ** ******** they ****** ** ***** identifier *********** ******* *** product ********** *** **** emailed **** *** **** detailed *******.

Undisclosed #4

IPVMU Certified | 09/06/19 04:16pm

***** **** ***** ******* are ************ **** ***********, all ** **** ***** true ** ****** ******** in *** **** ******** of *************.

*** **** *** *** true ** ** ***** 600,000 *****, *****?

Undisclosed #4

IPVMU Certified | 09/06/19 04:29pm

*** ******** ******** ******* figured *** *** *** largest ********** ** ***** at **** ******* *** in *******?

********, ******* *** **** than * ********* ** the ******* ** *** U.S. *** ***** ******* 3702, *** **** ** has******** *** *.*.?

***, **’* *** ******** to ** ******. ******** this *** **** *** in ********* *** *** an ******* ****** **** is.

Undisclosed Integrator #5

In reply to Undisclosed #4 | 09/06/19 04:58pm

***** *****'* *** ********* popular ********** *** *****'* know **** ****'** *****? Maybe **** *** * shortage ** ******* *** ended ** ********** * lot ** ******* ******** to *** ********?

* ****** ** *** can ********* ****** *** effects ** * **** by ******** *******.

Undisclosed Manufacturer #6

09/06/19 06:50pm

******* ***** ********* **** cameras, *** *******, ***. Maybe ***** *** *** devices **** *** ***** that ****. ***** ** has ******* ** ** with *****, ****** ** uses **** **** *** reports ****. ***** ***** are ***** **** ******* all **** *** ***** that *** *** ******* in ***** ******* ** the **, ***... *** knows....

Undisclosed #3

In reply to Undisclosed Manufacturer #6 | 09/06/19 07:02pm

"*** *****...."

***, *** **** ** a ****** ******** **********, no?

*** *** *** ********* data **** ******** ** all ** *** **** itself ** ************ ***** on *********** *********?

Slava H

09/06/19 07:17pm

****'* **** *** ******* to **** ***** ***** dangerous ******* ** *********** to *** *** ****** feature *** ****.

***, *** *** **** IP(ping ** ***** ******!) is ********* ** ****. DNS *** **** *** can ***** *** ** used *** ****. ** here ** **, ***'* stop ***** *** *** use *********** *** **********.

Undisclosed #7

09/06/19 07:19pm

** ******* ****** **** their *******, *** ***** servers, *** *** ********** to *** **** ** DDoS ******?

** **, *** **** if **** **** ** I ****** ****.

John Honovich

IPVM | 09/21/19 02:30pm

******:**** ****** * ******** advisory ** ****, ******* ********* *****:

***** **** **** *** impact ** *******, **** acknowledged **** **** *** susceptible:

*** **** ******* **** supports ***** *** *********** to *** ********* ******. WS ********* ** ******* by ******* ********** ** ONVIF *** ** **** or ***.

*** **** **** *** evaluating ****** ******** ******* for ****:

**** ** ************* ********* WS ********* ******** ** reduce **** ** **** 3702 ** *******. ** adjustments **** ** ****, they **** ** ********* in * ****** ********* firmware *******.

** **** ****** ** they ** ****.

Read this IPVM report for free.

This article is part of IPVM's 6,533 reports, 880 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.