Pelco Fixes Hard Coded Credential Vulnerability

Author: Brian Karas, Published on Jul 19, 2016

One dirty secret in the industry is that many devices have unpublished manufacturer admin accounts.  While useful to support techs, these accounts can pose huge security risks, and open systems up to abuse.

Pelco recently disclosed that their Digital Sentry product line had a hard-coded secret admin account, which they removed in their latest firmware.

We received information from Pelco about this vulnerability, what other platforms are affected, and provide details in this report.

*** ***** ****** ** *** ******** ** **** **** ******* **** unpublished ************ ***** ********.  ***** ****** ** ******* *****, ***** accounts *** **** **** ******** *****, *** **** ******* ** to *****.

***** ******** ********* **** ***** ******* ****** ******* **** *** a ****-***** ****** ***** *******, ***** **** ******* ** ***** latest ********.

** ******** *********** **** ***** ***** **** *************, **** ***** platforms *** ********, *** ******* ******* ** **** ******.

[***************]

Vulnerability *******

**** ******** ********* *** ************* ** * ****-***** ***** ***** ******* *** lists *** ********* ** ******** ** *** ********** ** ********** this *************:

"** ******** **** * *** ***** ***** ** **** ** exploit **** *************."

*** ***** *** ******** **** ** ******** ******* *.**.**, *** the ******* ************** **** ***** ** *** ***** ** ******* version *.**, ***** ** ******** **** *** ******* ****** ******* ****.

********* ** *** ********, ********* ********* *** ********* ** **** account ** ***** ***, ** **** *** ****** ** **** been ************* ********** ** ********* (***).

Pelco's ********

***** **** **** **** ******* ************* *** ******* ** ***** ********* ******** *** **** **** ********* ****** *** ***** ********** customers. ***** ********* *** *****-***** ******* ***** ** **** ******** *** allowed **** ****** ** ******** *****.

*****'* ***** ******* ***, ********** *** **** ** *** **** * ******* ****-***** *******.

Hard ***** ******** *** *******

************ ******* ********* ***** **** ** *** ****** ****** ** a ****** *** ***************, ******* ** ******* ******* *** ******* means ********* ** *** ***-**** ** ********** ****.  ****-***** *****-***** accounts ******* ***** ******* ***** * ********** *** ** *** into *** ** ** *** ****** *** **** ****** ********, or ******* ***** ********* **** ***** * ********* ***** ********.

*** ******* ** ********* ******* **** "*****'* *********** **** ****** *** **** * ****** ******" *******, ** ******* **** ********* *** ***** ** * device, **** ***** ******** ****** ******** ** ******* ***** **** want ** ***** ******* ******* *** ***********.  ***** ************ ******* tech ****** *** * ***** ***** *** **** **** * hard-coded ***** ******* ** ******* ** ***** *******, ** ****** they *** *** **** **** *******.

Impossible ** **** ******

***** ****-***** ******** *** ******** ** ******* *****, **** **** ********* of ***** ******** ***** ***, ****** ** *** **** ** the **** ***********, ** **** ********* **** **** ** ******* level ******. ** ***** **** **** *** ** ***, **** take **** ******** ********* **** ****, ********** *** ******* ** is *** *** **** ** ******* * ********'* ******.

Can ***** ******* ***** ** ********** *********

********** ********* ***** **** ****** **** ****-***** "******" ********, *** for **** ******.  ***** ******** *** ****** ****** ***** ****** to * ******, **** ***** ** * ****** **** ***** not **** ** ** ******** ****, ******** ****** *** ***** the ******* *********** ** ******** **** ***** ** ********* *****, or *** *** *********** ****** ** * ********* **** ** the *******.  

****** ********** ********* **** ***** ******* **** ******* ****** ******** full ******* ** ***** ********, ** ******* ******* ** ******* a ***** **** ** **** ****-***** ******** ***** ** *** software.  ** ******* **** ** **** *** **** *** ** Pelco ******** * ****-***** ******* **** ****** ******* ** *** product *** ******* *****. 

Practical Alternatives ** **** ***** ********

***** *** **** ****** **** ** **** ***** *****-***-**** ****** **** ********** the **** ***** *********** ** **** ** ********* ** *****. **** examples:

  • ******* ***** ******* ** * **** ** ******-******** ****, **** as * ******'* ****** ******. **** ** *** ****** ********* uses, ***** ********* ** ***** ******** **** ** **** ** the ******'* ****** ******, *** **** *** **** (** *** admin ******** ******* ******* ***** ***).  ****** *** ********* *** figuring *** *** ***** ******** *** ** ****** (** ******** ** ********* ** ****), ** *** ******'* ****** ****** ** *** ******** ******** this ******** ** ********** ******.
  • ******* *** **** ** ****** ****** ******* ****** ** ******* on * ******** ********, ******* * ****** ** *** ******, or ******* ******.  **** ******** ******* ***** **** ********* *** unit ******* *** ******** ***** ***** *** ********** ******** **** access, *** *** *** ******** ** ********* *** **** ** enable *** ********, ***** *** *** ** ******** ** *** user ********* ** ****, ** ** *** **** ** ****** out.  *********, ******* * ****** ** ****** **** ******** ***** at *** ****** *** ****** *************** ** *** ****** ** at * ******/******** ****.
  • *** ***-****** **************, ***** *** ******* **** ***** ******** **** piece ** **** **** ** ****** ********** ****** ** *** manufacturer's **.  **** ****** *** *** ******* ** ***** **** to *** *** ********* ****** ** * ***** ****, *** when, ********* ** ***** *** ** ***** *****.

Pelco *** ***** - ***** **** ***** ******** *****

**** ***** ************* ********* **** ****** ********. *********** *** ***-***** should *** ************* ***** *********, ****** ********, ***** **** ** access ******* **** *** *** ********* ** ******** *************.

Comments (9)

* ** **** ******* ****** *** ***/***** ******* ** ***** an ********* ** ****** * ****** *** ******* ***** ** factory ******* * ****** ** *** *********** *** ****.

** *** **** ** ***** ** **** * "******** ** the ***" ** ******* ********'* ******* **** * ****'* **** credentials ***, *** *** **** **** ** **** ****** **** with *** **** **** ***** *********** ** *** ****.

** ***** **** * ******* *******, *** ***** ********* **** someone *** ****** ** **** ****** **** **** ******* *********** no ****** ****.

* ***** **** **** *********** ** ****. **'* **** ** be **** ** ***** * ****** ******* ****** ** ***** a ****** (** *** * ****** *****), *** ***** *** inherent ********** ** **** ********.

**********, * **** * ****** **** ******** ****** ******** ****** to *** ****** (* ***** ******, *** *** ********* *** need ** *********** *** ****** ** *** **).

***, *** ***** ****** **** *** ****, *** **** **** accounts, ** ****** ***. **** ***, ** ******* **** ****** to *** ****, *** ****** *** **** **, **** *** forced ** **** *** *** *********** *********** **** *** **** (this ***** ********* ****** ** **-**** ** ** ********).

*********** ****** **** ** *** ******* ***** **** ** ********* separate **** *** **** ******* ****-**** **** ***** *** ** place. ***, ** *** ********** ** ********, *** **** ***** of ***** ******** *** *** ******** ******(*) ** *****/**********. *** in **** **** ***** *** ** *****-***** ******* **** *** not ********* ** *****, *** *** ********** ****** *** *******. In **** ********, **** *** **** *** ******* ** *** account *** ***** ****** *** **** *** *** ******* ************ to.

**** ** *******, *** ***** ***** "******** ** *** ***" requires ***** ****** ** *** ******. ** **** *** **** through *** *** ** *******.

**** *** *** ****** *** ****** ********. ***** ****** ****. Just ** **** ****** *** ********* ***** *****.

****** ******* *** ** **** *** ****** *******, *** **'* not ** ***** ******* *******.

* **** **** ******* **** ***** ******** *** **** **** 5 *****, *** **** *** ** **** ****** * ****** that ****** *** ****** ****** ***** ****** ****** ** ******. As *** ** * ****, ***** **** ****** **** ***** only ********.

****** ***, ** *** **** * ***** ****** **** ** having **** *****, ** ******* ******* ** ** *** *** issue ********. ****** ** ** *** ***** ** *** ******, and * *** *** *** * ******** ****** **** **** address ****.

* **** ******* * *** ********* *** **** ** *** early ***** (****-**** ***) ***** **** **** *** ****** ******** remotely (*** *** *** *****). * **** ******* * **** recent *******, ** ***** ***, *** **** *** *** *** work ********.

* ***** *** ****** ** ***** **** ** *** ****** is **** ** *** ****** *** ***** ** ****** *** 666666 ******** **** ******* *******, *** ******** ********. **** *** not ******** **** *** ***** *****. **** ***** *** ** removed, ** ** **** **** ** ******* ** * ******** as *** ***** *******.

****, ***** ***'* * ** ******* **** (****, ****), ** you **** **** ** *** **** ** **** ** **** info. ** *** *** * ***** ********, * **** *******, much **** **************** ****.

(****, ***)

***, *'** ******** ***** **** ********* ** **** *******. ** B.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Most Recent Industry Reports

Honeywell Sues Alarm.com For Violating Anti-Trust Laws on Feb 24, 2017
Is Alarm.com about to dominate the smart home software market? That is what Honeywell alleges in its new lawsuit, first reported by...
Axis: "Everything is IP" - False on Feb 24, 2017
Axis is congratulating itself, with executive Fredrick Nilsson declaring: "Now the conversion is all done and everything is IP and analog is...
Advertising Like Avigilon at the ISC West Airport on Feb 24, 2017
Avigilon has grabbed a lot of attention over the last few years advertising at the Las Vegas airport when attendees fly in. But how does that...
Artificial Intelligence Robot Assistant (ACTi) on Feb 23, 2017
Has artificial intelligence come to the video surveillance industry? ACTi has released 'SARA' which it bills as an 'AI assistant that brings...
Cutting Costs 70% Using Milestone With HD Analog on Feb 23, 2017
HD analog and enterprise VMSes are often thought of as being on opposite sides of the spectrum, with HD analog best for small jobs due to its low...
Dahua 4K HD Analog Cameras Announced on Feb 23, 2017
HD analog has been gaining popularity (even if Axis hopes otherwise). Last year, HD analog's max resolution doubled from 1080p to 4MP (see our 4MP...
Uniview (UNV) IP Cameras Tested on Feb 22, 2017
"We're #3," in China says Uniview (UNV). While the company significantly trails Hikvision and Dahua in total sales, one notable difference is that...
Glass Doors and Access Control Tutorial on Feb 22, 2017
The biggest challenge for many access control systems are glass doors. Here's what happens when a maglock is improperly installed to an existing...
Exacq Favorability Results on Feb 22, 2017
For years, Exacq has been one of the most frequently favored VMSes in IPVM integrator statistics (e.g., see Favorite VMS Manufacturers...
The Hot RMR Company - Electric Guard Dog on Feb 22, 2017
The financiers at the Barnes Buchanan conference praised a company named 'Electric Guard Dog'. While the name sounds fairly low tech, the money and...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact