Big Security Hole in Surveillance Cameras

By: Ethan Ace, Published on Feb 06, 2012

The mainstream press has been abuzz with an IP camera vulnerability that allows people from anywhere on the Internet to directly and easily access TRENDnet cameras without any authentication. In this note, we explain how it was done, why we believe Trendnet engineers had to know about it and what implications this has for the rest of the surveillance industry.

Firmware Exploit

While it took real skill for an outsider to find the exploit, usig the exploit itself is very simple. Basically, a standard URL exists that if entered provides direct access to the MJPEG video stream without any restrictions.

The hacker deconstructed Trendnet's firmware, manually inspecting the enclosed files. This inspection revealed multiple CGI scripts used for requesting live video. Trendnet had left a folder called 'anony' (as in anonymous access). In that folder is a file named mjpg.cgi. A request to that file returns a live video stream (e.g., http://192.168.1.17/anony/mjpg.cgi). Here's what the basic queries look like on a Linux distrobution:

The hacker then detailed a method by which users were able to search for Trendnet cameras available on the internet. Taking this information, active internet messageboards, such as Reddit and 4chan, set about finding as many open camera feeds as possible, sharing lists of IP addresses of cameras as they were found. This led to likely hundreds of readers of these sites viewing feeds and capturing stills from hundreds of IP cameras, many in private residences, along with businesses. 

Some of these captures are extremely disconcerting, looking directly into users' homes:

We suspect that Trendnet engineers knew about this security flaw, simply because it is an obvious, "in plain sight" feature for an engineer, likely used as a backdoor or a shortcut by their internal team to do testing. 

Trendnet's Response

Trendnet has since released an apology and firmware update for affected cameras. However, notice of this firmware update was sent only to those users which registered their Trendnet camera, which is typically a small percentage. Additionally, given Trendnet's position in the industry, as a low-cost manufacturer often used for residential and small business systems by less tech-savvy users, many users will be unlikely to ever hear about this issue and subsequent fix, leaving them vulnerable indefinitely. 

Implications for the Industry

While this exploit was performed on cameras from Trendnet, a minor presence in the professional surveillance industry, the implications it has for the industry as a whole are potentially huge. With so many different IP cameras available, chances are high that issues such as this exist in other manufactuers' lines. The exact hole will likely not be the same but the end result may be.

Cameras in corporate environments may be of less concern, as they are most often running on networks behind firewalls, internal to a facility. However, an attacker who gains access to the network could still use holes such as these to view feeds directly from cameras.

Comments : Members only. Login. or Join.

Related Reports

Vivotek Trend Micro Cyber Security Camera App Tested on Jul 22, 2019
Vivotek and Trend Micro are claiming five million blocked attacks on IP...
Phone Camera Calculator Released on Mar 10, 2020
IPVM has released the first-ever Phone Calculator, video surveillance design...
Budget Covert Cameras Tested on Nov 26, 2019
Covert cameras under $100 are widely available online but are they any...
Breaking Into A Facility Using Canned Air Tested on Jan 28, 2020
Access control is supposed to make doors more secure, but a $5 can of...
YCombinator AI Startup Visual One Tested on Apr 02, 2020
Startup Visual One, backed by Silicon Valley's powerful Y Combinator, aims to...
Uniview Deep Learning Camera Tested on Jul 14, 2020
Uniview's intrusion analytics have performed poorly in our shootouts. Now,...
Wyze Smart Door Lock Test on Jan 14, 2020
Wyze's inexpensive cameras have grabbed the attention of many in the consumer...
Vulnerability Directory For Access Credentials on Feb 20, 2020
Knowing which access credentials are insecure can be difficult to see,...
Free IPVM Memberships For The Unemployed on Apr 02, 2020
IPVM is giving 3-month free memberships (regular price $99) for the...
Hidden Camera Detectors Tested on Nov 18, 2019
Hidden cameras are a growing problem as cameras become smaller, cheaper and...
OnTech Smart Services Partners With Google and Amazon To Compete With Integrators on Sep 25, 2020
A pain point for many homeowners to use consumer security and surveillance is...
Video Surveillance History on May 06, 2020
The video surveillance market has changed significantly since 2000, going...
Wyze Massive Data Leak on Dec 26, 2019
Wyze has exposed millions of user's data, as reported by Twelve Security, and...
Bosch / Milestone Forensic Search Tested on Jan 08, 2020
Bosch's Forensic Search Milestone plugin integrates Bosch IVA and EVA...
Video Surveillance Business 101 on Mar 30, 2020
This report explains the fundamental elements of the video surveillance...

Recent Reports

New Products Show Fall 2020 continues tomorrow with Genetec, Milestone, Avigilon, Microsoft and more! on Sep 29, 2020
IPVM's sixth online show continues tomorrow and will feature New Products...
Avigilon / Motorola VS Virtual ISC West on Sep 29, 2020
ISC West has historically been so dominant that no player would think of...
Dartmouth College Deploys K3 Temperature Screening on Sep 29, 2020
While Dartmouth College has a $6+ billion endowment, the College has bought...
Hanwha AI Object Detection Tested on Sep 28, 2020
Hanwha has added detection and classification of people, cars, clothing...
Favorite Access Control Manufacturers 2020 on Sep 28, 2020
200+ Integrators told IPVM "What is your favorite access control management...
OnTech Smart Services Partners With Google and Amazon To Compete With Integrators on Sep 25, 2020
A pain point for many homeowners to use consumer security and surveillance is...
The Future of Metalens For Video Surveillance Cameras - MIT / UMass / Immervision on Sep 25, 2020
Panoramic cameras using 'fisheye' lens have become commonplace in video...
Hikvision Sues Over Brazilian Airport Loss on Sep 24, 2020
Hikvision was excluded from a Brazilian airport project because it is owned...
China General Chamber of Commerce Calls Out US Politics on Sep 24, 2020
While US-China relations are at an all-time low, optimism about relations...
Verkada Disruptive Embedded Live Help on Sep 24, 2020
Call up your integrator? Have someone come by the next day? Verkada is...
IP Networking Course Fall 2020 - Last Chance - Register Now on Sep 23, 2020
Today is the last chance to register for the only IP networking course...
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
Norway Council of Ethics Finds Hikvision Human Rights Abuses "Ongoing" on Sep 23, 2020
Hikvision's involvement in "serious human rights abuse" in Xinjiang is...
IPVM Camera Calculator User Manual / Guide on Sep 23, 2020
Learn how to use the IPVM Camera Calculator (updated for Version 3.1). The...