Sony Misleading Marketing Hides Cracked Backdoor

By Brian Karas, Published Jan 25, 2017, 09:12am EST (Info+)

Sony is attempting to deemphasize the severity of the backdoor uncovered in Ipela cameras.

Meanwhile, IPVM has verified that the root password for the backdoor has been cracked.

Downplaying the severity of the hard-coded backdoor puts both users, and Sony's brand, at risk, as we explain in this report. 

Sony's *****

**** ***** ** ******* *** *** as "******** ******* ********':

***** *********** ****, **** ** **** describing * ********* ** * ****** to **** ** "******** *********". ** top ** ***, **** ******** ** abstract ***** **** **** *** ** all ****** *** **** ***** ** unpatched ******* ****.

Sony ******* ******* *******

****'* ******-****** ******** *** ******** ********* also **** ** ******* **** ***** with ***** ******** **** ** ******* ******** to ******* **** *******:

Cracked ******** **** ********

**** *** ******* *** ***** *********, the *********** ********* *** ****** *** the **** ******** *** *** *** reveal **** *** *********** ******** ***.

* ********* *** *********** ** *********** firmware ******** **** **** *** *** unencrypted ******** **** ******** *** *** 6 *******, *** ** ******** **** it ******.

** **** ****** ** ******* **** the **** ******** *** ******* **** years ***, *** **** ****** **** public **********, ** *** ****** ******* was ********* ** ******* ******. ***** it ** ******* *** **** *** wide *** ******* **** ******** *** been *****, ***** ****** ** ** doubt **** ** ** *******. 

****: ** *** *** ******* *** backdoor **** ******** ***** ** ** *** easily ********* ****** *** ***** **, in **** *******, ***** ******** **** to **** *****.

Misleading ********* **** ***** ** ****

**** ****** **** **** "********" ******* security ******* **** ***** **** ******** ** ** already ****** ******, ***** ** ********** in **** ****. ********* ******* *** extremely ********, ***** ****** **** ******** might ********** ****** **** **** *** avoid **** ****** ** **** ******* perceive ***** ****** ** ******, *** to ****** ***** ***** **** ******** default ********* ** ******* ** ******** user ********. *******, ***** ******* ****** **** to ****** **** ****** *** *** reach **** *** * *******.

Sony ******* ** ******** ******

****** **'* **** ****'* ***** ******** installed ******* ** ***** **'***** **** ********* **** **** ** Sony ******* *** **** *******, *** interfered **** ***** ***** ** *** computer's *********. ****** ** *** ******** **** ******* had ****** ****** ** ****** *** other ******* **** ** **** ********. ** **** ** ***** ********* Sony's ***** ******** ** ****** **********. While **** ** ***** ********* **** severe, ******* **** ******** ******* ** Sony's ******** ********.

*** ******** ********** ** ***** *******, and ****'* ******* ** *********** **, show *** ******* ********* ******** *** security ** *** *******, *** **** has *** **** ****** ** **** ********* fully ***** ** ****.  *** **** reason **** ******* *** *** ** more *********** ** **** ** ******* ****'* Security ******** ***** ** ********** ** its ***** *** ****** *********.

Manufactures ****** *** ******** ******** ***********

***** ** ****** ******* ** ********** to ******** ******** ** ********** ********, information ** *** ******* ********* ** the ********, *** ** ***** *** shown, ***** *** ****** *******. ********* are *** ****** ** *** *** existing *******, ** ****** ****** ** future ********, ** * ********* ******* is ***** *** ********* ******* **** good ************* **** *** ************. *** **** may ****** ***** ******* ** **** find *** **** *** ************ *** not ******** ****** **** ** ******** and ******* ********* ***** *** **** exploits.

Comments (3)

Undisclosed

01/25/17 05:37pm

There should be a CVE number for this issue.  The fact there isn't suggests Sony doesn't get CVE's allocated for itself (and nobody shouted loud enough to get the CVE elves to allocate one unilaterally.)  Classic example of an epic fail in answer to the question "what's your cyber security posture".  The fact a flaw existed is almost less disturbing than their denial process.  Although, backdoor passwords have been considered bad for years.

 

So?  How's it' going out there in integrator-land selling vulnerable Sony cameras?

Agree
Disagree
Informative
Unhelpful
Funny

Undisclosed #1

IPVMU Certified | 01/26/17 01:35am

The Gen6 DES password is easily cracked from the hash in less than two hours.

The real gem here is the revelation of the script syntax surrounding: /debug/start-telnetd-sshd.cgi, which completes the exploit.

This, to my knowledge has not been published by SEC Consult or anyone else, AFAIK.

Agree: 1
Disagree
Informative
Unhelpful
Funny

Undisclosed #1

IPVMU Certified | 01/26/17 05:51pm

Curious, was anyone able to crack the Ipela Gen5 password from this hash?

$1$$mhF8LHkOmSgbD88/WrM790

If so, don't post it, I'm just wondering what the length etc, was actually.  Had a process running for a couple weeks on it with no results.

Agree
Disagree
Informative
Unhelpful
Funny
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts reporting, tutorials and software funded by subscriber's payments enabling us to offer the most independent, accurate and in-depth information.
Loading Related Reports