Cybersecurity Startup VDOO Disclosing 10 Manufacturer Vulnerabilities Starting With Axis And Foscam

By: IPVM Team, Published on Jun 20, 2018

Cybersecurity startup VDOO has uncovered significant vulnerabilities in Axis cameras along with many others not yet disclosed.

In this report, we examine the company and its funding, their vulnerability research, and the value/impact of the vulnerabilities.

************* ******* ******* ********* *********** *************** ** **** cameras ***** **** **** ****** not *** *********.

** **** ******, ** examine *** ******* *** its *******, ***** ************* research, *** *** *****/****** of *** ***************.

[***************]

Company ********

**** *** *********** ** Israel ** **** ***** *****,**** ******, ******* *****, *** *** **** strong *********** ** ******* security. ***** *** ***** co-founded ******, ** ******** security ****, ***** *********** ** **** **** Networks ** ****. ******* ***** ********* came **** ****** *** EMC, ** ****.

* ******* **** ** VDOO's ******* ** ****** clearly ** ***** *******:

**** **** ** ****** the ******** ********* (**) for ********* *******.

***********, **** ** ******** IP ****** *** ***** IoT ****** ************* (*** others) * ************ ******* (~$**,*** to ******* * ************'* products) ***** ********* ************* checks ** *** ******* and ********.

**** **** **** ** provide (****) * *********** that ******** *** ******* has **** ******* ** their ****** ** * non-vulnerable ******. **** **** to ********* * ******** process *** "****-********** **********", presumably ** ******* *************** they ******** ***** ********** a ******* ** ***-**********.

*******

**** ******** *********$** ******* ** ****************,**** ************ *******, *** ***** ********* investors.

**** ***** **** **** plan ** *** **** funding:

** ******* *** ************* VDOO’s *****-**-***-**** ******** ** Things (***) ******** ********, which ******** ** *********, end-to-end ******* **** ******** devices, ******** *** ***** security ************ *** ************** guidance ***** ** **** analysis, *** ******** ******** certification *** * **** range ** ********* *******.

Axis ************* *******

**** ********* ***** *************** to *** ****' ******** team (******: ** ** 6/27/2018, ******* **** **** added ** *** **********):

***-****-*****,***-****-*****,***-****-*****,***-****-*****,***-****-*****,***-****-*****,***-****-*****

***** *** ** * high **** ***** **** can ****** ** **** administrative ****** ** *** camera. *** ******* ******** to perform ** ****** ** complex, ********* ******** ***** and ******** *********, ****** simpler ****** *************** **** as*****'* ********* ************* ************ ************* *** ****** **** only ****** *******.

*******, **** **** *********** now ******, ** ** only * ****** ** time *** ********** *** bad ****** **** **** advanced ****** ** ****** scripts ***** ******** ***** attacks, ****** ***** *************** **** priority *** ***** ** patch.

Impact ** *************

*** *************** ******* * specific *********** ** ***** to **** *** **** advantage ** ****** ** view ** ****** *** camera ******, ***** *** camera's ******** (****** *********, lens ***********, ***** *******) or *** *** ****** as * ******** ** other ******* ** ****** the *******.

**** ****** ************* ******, which ****** **** ** gain ************ ****** ** the ******* ******** ***.

**** ***** ***** ************ by ******** ** **** logo ***** ******* ** a ********** ******:

***** ******* ***** ********, the ******* (** ******* - * ***** **** logo) ******* ** *** top **** ****** ** the ***** ******:

Foscam *************

** ******** ** *** Axis ***************, ******* ** June, **** **** ********** "***** ***************" ** Foscam *********** **** ********* ** Foscam's ******** ****. ********* these ***** ***************, ********* may ***** *** ******* the ******'* *** ******, inject ********, *** **** over *** ******.

Botnet ****

**** ****** ** ***** reports **** **** *** Axis *** ****** *************** may *********** ** **** to *** ******* ** a ****** *** **** for ****** **** *******, bitcoin ******, ** ***** purposes. ** ******** ** the ***** ******, ***** ******* may ***** ****** ********** to *** **** ******** targets ********* ************* *******.

VDOO *************** ** *************

** **** ***********, **** is ************ ******** *********** considerations:

  • ****** ******* ********** **** parts: ** *** *** all ********* ** "****"
  • ****** ***** ************: ****** external ******** *** ******** input *******
  • ****** ******** *****: **** of ****** *********** ****** hackers ** ******* ******** for **** ** *******

Axis ********

**** ********** ******** ** Axis ********** **** ** ******** products *** ******* ********** ****** *** *************** in *****, ***** ******** 390 ********* **** ****** models.

More *********** ****** / ******** ******

**** *** **** *** months, **** **** ** disclosing **** *************** **** more *************, **** *** responsible ********** ******* ***.

**** ***** **** * positive ****** ** *** cybersecurity ** *** ***** surveillance ********, ***** *** been * ****** ********* focus *** **** *************. Cybersecurity ******** **** *** yet ****** *********** ******** financial ****** ** **** of *** ************* **** have ******** **** ******** vulnerabilities. ****, ***** *** pricing **** **** *** asking *** ************, *** type ** ******* **** are ******** *** *** they *** *********** *** market, **** *** **** a ********* **** ******* partners.

Addendum: **** ******** ** *********

***** ** ******** *** discussion ********* ** *** initial ******, ** ******* VDOO * **** ** questions *** **** *********. There *** * *** remaining ****** ** ******* that ** *** ***** in ********** **** **** for *************, *** ** will **** ***** ********* as **** ** ** receive ****.

****: ** ***** **** about *** ********** **** manufacturers *** **** **** not *** *********, ** have ***** **** *** details *****.

  • *: **** ** *** process / ****** **** your ******** ******* *** a ************ ** ******* a *******? **** * manufacturer **** ***** ******* to ***?  
  • *: "**** **************-**************** ** ******** ** the ******'* ******** ****, thus ** **** *** require *** ****** ** the ******** ****** ** to *** ****** ****. It **** ******** ** automated ******** ** ***** the ************ ** ******** implement ********-********* ******** ****** and ***** ******** ** design"
  • *: *** *** ********** the ***** ****** ** hardware *** ********/******** ** just ********?
  • *:*** ******** ******* ******* device-specific ******** ************, ******** to *** ******** ***** of *** ******, ***** its ******** *** ******** components *** *** ******** risk *******.
  • *:*** *** ******* *************** in ** ****** ******** that **** **** ****** eliminated ** ***** **********, or *** **** ****** across **** *** *********? 
  • *:** *******, ****** *** research **’** **** **** practices **** *** ******’* expect ** *** ** 2018. **’** **** **** in ********* ******* ** well ** ** **** “sensitive” *** ******** & systems ** *** ****** of Safety *** ********.
  • *: ** **** ******* intent *** ***** *********** simply ** **** *********? 
  • *: *** ******** ** to ** *** ** our *** *** ** commercialize ***** ******** ** a ******* “***********” ********* ******. We *** * ***** deal ** ******** ** (1) ****** ******** (**** of ******) - ** fix *** ****** ********, as **** ** (*) user ******** - ** make **** **** ******** the ********* ******, **** if ** ****** ** not **********; *** (*) general *********** ** *** specific ****** ** **** as “lessons *******” ** ***** vendors ** ****** ********* security *** *** ******** architecture *** ****** *****.
  • *: *** ***** ***** specific ********** *** *** targeting ********/******* *************** ***** now?
  • *:** **** ******** ********* Project *******, * ******* which ******** *** *************** of ********* ******* **** the ****** *** ******** fields *** ************ **** the ************ ******* ********. VDOO ***** ***** **** of ******** ***** **** have ****** ****** ** business ********** *****, ****** be ********** “********” ** the ******** *** ******* the ***** ***** ** security.
  • *: *** **** *** typical ****** ************ ******** team ******* **** *** contact ****? **** *** been *******/*********?
  • *:** **** ********* ** discover **** *** *** leading ************* ** **** been ******* **** **** reached *** *********** **** they *** ** ****** ignore *****-******** *** ** not **** *** ********* to ** “*******” ** “skeptical”. **** ********* **** they *** ***** ***** more *** **** ** their ********* ********* ***** products’ ********.
  • *:** ***** ************ ****** companies ** **** ** for **** ******* **** VDOO *** **** **** they *** **** **** and ******? *'* *** for ******* ************* *** cameras, *** **** ***** a ****** **** *********, unless **** *** ****** are ***** *******
  • *:***** ** * ***** distinction ******* *** ************* disclosure *******, ***** ** will ******** ** **** with ***** ************ ***** on *** ******** **** practice ********** **. * significantly ****** ** ***** business ********** ***** ************* discovery ** **** * fraction ** **** **** is ********* *** *** set ** ******* & services, *** **** * goal ** ************* *** entire ******** ******* ** the ************* ********. ********, when * ************ ************* uses *** ********* ******** SaaS ********, ** * web ******* ******* ****** by *** ************ ******* our **********, *** *********** automatically ********* ** *** analysis ****** *** *** process **** *** ** shared **** **, ***** we **** *** ** able ** ****** ** and ******* **. ** the ************ ******* ** certify *** *******, ** will ******* **** *********** and **** *********, *** certification ******* **** ** shared ********. ** *** two ***** **** **** published, ** ******** **** than ***** **** (**. industry **** *********) *** the ************* ** *** their ***************, ** **** as ********, ************ **** their ********** ****** ******* the *************** *** ******** they ******* ***** ********'* risks.

 

Comments (33)

** ********* *** ***** proactive ***** ***** ******** they ***** ***** ***** guys * ****** ****** to ***** ****** **** review ***. **** ****** way ** **** **** confidence *** ********** **** to ****** **** ** open ********. 

****** **** * ***** idea. * ****** **** are ****** ** ** the ** ** *** cybersecurity *****. ** ** $50,000 *** ******* ** $50,000 *** *** ********? if $**,*** *** **** product, **** ** ****** steep. $**,*** ********** ** have *** ******** ****** isnt ***.

**** ** ** ******** from ****, **** *** products **** ********************* ** **** ******, depending ** *** **** different ********* ** ****/******** are ********. * ***** imagine ************* **** ****** and ******* ******* ***** (video, ****** *******, *********, etc) ***** **** ** pay ****.

*****: ********** ** *********, the ***** ********** *** astarting ***** for pricing to manufacturers.

***, **** ** * fair ***** *** * manufacturer. * **** **** gain ******** ** * ***** this ** * ***** idea. ** **** ** industry ****** **** **** that ************* *** **** to ** *** ***** products ********* **** ** industry ******* ******.

*** ** ** ***** ** *************, *****? *****...?

* **** **** *******. 

**’* **** *** ***** security ** ** *** priority *** ******** *******.  I **** *** ************ use **** ** * resource.  **** **.

********* ****** ****** (***** ****) so ****** ** **** are ***** ******* *** remarkable * **** ***, good *** ****!

***** **** *** ******** they ***** *** ************, let's *** **** ************ get **** ***.

 

********* ****** ****** (***** only) ** ******...

**, *** *** ******* *******?

 **** ***** *** ******** be ***** ** *** IPVM ************* *******?

 

***: ***, ** ****** have *** *** *************** added ** **** ****.

*** *** **** ******* against **** ***** ** known, *** ****** ******* against **** ***** ** not *****.

*** *** **** ******* against **** ***** ** known, *** ****** ******* against **** ***** ** not *****.

********* **’** ****** ***********?

**** ****** ****/***** **** are ****** ******* ** submit ***** ******* ** the ******* ****.

*******, *** **** ** behind **** ******** ********* fueled ** ************* ***** to ******* *** **** of *****.

*** ***** **** **** always **** **** *** hands ** *** ******** seeker.

********* ********-** ***** ** take *** ***** *** bullet *** ******** *** useless ** ***** *** inevitable ***** ** ***********.

******** *** ******* **** to **** *** ****** for *** ******* ****** is *** ** *** consumer's **** ********, ** lies **** *** *******/****.

********* ********** ** ****. Always *** ****** ***********, MOOT.

** ** ********** ** see *** **** **** security ***** **** ** real ***** ** ******** relative ** *** *************** born **** ***** ***********. 

********* ********** *** ******** stupidity, ******** ********** *** exploitation ** **** * back **** ** ***** check-sum *********.

*** ***** ** ****. 

*** **** ** ************** garbage.

** *** ****** **** the ****.

**** *******, ** ***** surveillance ****** ********* ** sign ** *** **** ******* will **** *** **** like **** *** **** Axis *** ******? *'* all *** ******* ************* for *******, *** **** seems * ****** **** extortion, ****** **** *** Foscam *** ***** *******.

**** ****** ***** **** be ***, ** *** want ** *** >$**,*** to **** **** ********** included, **** **** *** usually *** ****?

** ***** ** **** they *** ***** **** for *********. 

****** *** *** ********, I ******* *** ** VDOO *** * ********.

** *******, * ****** imagine **** ***** ******* a ******* ** ***-**********, and **** ********** ********, without *** ******* ** the ************, ********* **** missed?

***** ******* * ******* as ***-**********, *** **** publically ********, ******* *** consent ** *** ************, something **** ******?

*** ******* ** *** ********. Let's *** * *** CrappyCam. * **** ** VDOO *** *** "*** sign ** **." * *** my *****. * ***** later VDOO ***** **** *** says ** ***** ** critical ***************. *** ******** then **: ** * client ** ****, **** VDOO ******** ***** ***************?

* ***, *** *** both ******* ** *** pre-certified *****. * ******* there ***** ** ******** if *** ************ *** trying ** **** * new ******* ** * deadline ***** ** ******* any ************* ****.

****, *** ****** ******** rebranding ****** ******** ***** cybersecurity ******.

**** ** ***** * was ****** ****, ** Axis **** *** **** a *********** **** **** *** HIKVision ****. *** ******* purposes ****, ** **** both **** *** **** vulnerability, **** **** *** both ********* ** **** the *** **** ***'* their ******. ** **'* the ******, ***** ** be * ****** ********* going **. **** ** $50,000 ** ** **** write ** ******* ***** your *************.

** **** *** *** companies **** *** **** $50k, **** ***** ****** crappy *** * **** imagine **** ********* ***** business **** ****. **** should ***** *** ****** up ** *** *************.

* ***** ****** **** are ****** ********* ********** right *** ** ****** attention *** ********* ******** which ** *****.

* ***** ********** ** they ***** *** ******* if *** ************ *** not ******* ** *** vulnerability ** * ********** amount ** ****, *** public ****** ********. *** even **** * ***** **** would **** ** ****** the ************ ** **** case ******* *** *** still ** ****** ******** someone **** **** *** 50K ****.

**** ***** *****, ****** for ********** **** *****.

* ***** ********* ** a ****** *** ** put **, ****** **** stop *********** ********** *************** for ***-******** ** **** point.

** * ************ ***** cares ***** ***** ********, the $*** ** ***** well *****.  ** ***** a ********** ** ***** security. ****, ****/** * vulnerability ** *****, * would ****** **** ***** give **** * ***** up *** **** ** patch ****** **** **********.  So **** **** *** announce *** ***** *** resolution, *** *** ************ shows ***** ********** ** cyber.

************* ***** ***** $ on *********** *******...

* ***** ***** **** would **** **** ******** submitted ** ************* **** an ********* ** ******** after * ************* ****** of **** ** ******** that *** ******* ******** and *** ******** *** found ****** *** ***-******* period, ******** **** **** before *******.

************* ******* ** ********* should ** ***** * short **** ** **** disclose.

**** ** **** *** references **** ******* (***** you ****** **** ****** out ** *** ***'* look **** ***** *****.)

****** ******, * **** be ****** *** **** to **** ****, *** will ** ******** *** to *** **** ***** details **** ******** ** the ***(*).

**** ******** **** ********** to *** ****** **** that *** *** ********* details **** **** *****, in **** ****** ***** to ****** ****.

* ***** **** *****/***** make * ***** "******" for ******** *******....

** ******** ******* *** been ***** ** *** report.

***** ** ******** *** discussion ********* ** *** initial ******, ** ******* VDOO * **** ** questions *** **** *********. There *** * *** remaining ****** ** ******* that ** *** ***** in ********** **** **** for *************, *** ** will **** ***** ********* as **** ** ** receive ****.

  • *: **** ** *** process / ****** **** your ******** ******* *** a ************ ** ******* a *******? **** * manufacturer **** ***** ******* to ***?
  • *: "**** **************-**************** ** ******** ** the ******'* ******** ****, thus ** **** *** require *** ****** ** the ******** ****** ** to *** ****** ****. It **** ******** ** automated ******** ** ***** the ************ ** ******** implement ********-********* ******** ****** and ***** ******** ** design"
  • *: *** *** ********** the ***** ****** ** hardware *** ********/******** ** just ********?
  • *:*** ******** ******* ******* device-specific ******** ************, ******** to *** ******** ***** of *** ******, ***** its ******** *** ******** components *** *** ******** risk *******.
  • *:*** *** ******* *************** in ** ****** ******** that **** **** ****** eliminated ** ***** **********, or *** **** ****** across **** *** *********?
  • *:** *******, ****** *** research **’** **** **** practices **** *** ******’* expect ** *** ** 2018. **’** **** **** in ********* ******* ** well ** ** **** “sensitive” *** ******** & systems ** *** ****** of ****** *** ********.
  • *: ** **** ******* intent *** ***** *********** simply ** **** *********?
  • *: *** ******** ** to ** *** ** our *** *** ** commercialize ***** ******** ** a ******* “***********” ********* effort. ** *** * great **** ** ******** on (*) ****** ******** (free ** ******) - to *** *** ****** properly, ** **** ** (2) **** ******** - to **** **** **** mitigate *** ********* ******, even ** ** ****** is *** **********; *** (3) ******* *********** ** the ******** ****** ** well ** “******* *******” to ***** ******* ** better ********* ******** *** fix ******** ************ *** design *****.
  • *: *** ***** ***** specific ********** *** *** targeting ********/******* *************** ***** now?
  • *:** **** ******** ********* Project *******, * ******* which ******** *** *************** of ********* ******* **** the ****** *** ******** fields *** ************ **** the ************ ******* ********. VDOO ***** ***** **** of ******** ***** **** have ****** ****** ** business ********** *****, ****** be ********** “********” ** the ******** *** ******* the ***** ***** ** security.
  • *: *** **** *** typical ****** ************ ******** team ******* **** *** contact ****? **** *** been *******/*********?
  • *:** **** ********* ** discover **** *** *** leading ************* ** **** been ******* **** **** reached *** *********** **** they *** ** ****** ignore *****-******** *** ** not **** *** ********* to ** “*******” ** “skeptical”. **** ********* **** they *** ***** ***** more *** **** ** their ********* ********* ***** products’ ********.
  • *:** ***** ************ ****** companies ** **** ** for **** ******* **** VDOO *** **** **** they *** **** **** and ******? *'* *** for ******* ************* *** cameras, *** **** ***** a ****** **** *********, unless **** *** ****** are ***** *******
  • *:***** ** * ***** distinction ******* *** ************* disclosure *******, ***** ** will ******** ** **** with ***** ************ ***** on *** ******** **** practice ********** **. * significantly ****** ** ***** business ********** ***** ************* discovery ** **** * fraction ** **** **** is ********* *** *** set ** ******* & services, *** **** * goal ** ************* *** entire ******** ******* ** the ************* ********. ********, when * ************ ************* uses *** ********* ******** SaaS ********, ** * web ******* ******* ****** by *** ************ ******* our **********, *** *********** automatically ********* ** *** analysis ****** *** *** process **** *** ** shared **** **, ***** we **** *** ** able ** ****** ** and ******* **. ** the ************ ******* ** certify *** *******, ** will ******* **** *********** and **** *********, *** certification ******* **** ** shared ********. ** *** two ***** **** **** published, ** ******** **** than ***** **** (**. industry **** *********) *** the ************* ** *** their ***************, ** **** as ********, ************ **** their ********** ****** ******* the *************** *** ******** they ******* ***** ********'* risks.
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

'Bunker Busting' Wireless Access Startup: Sure-Fi Profile on Oct 03, 2019
An access startup is claiming its 'bunker busting' wireless Wiegand radios can punch through 'any obstruction'. We examine their offering,...
Startup XNOR.ai, Inventors of YOLO, Video Surveillance Plans Examined on Sep 24, 2019
YOLO is arguably the most discussed and hyped computer vision model today. The inventors of YOLO have a startup named XNOR.ai that aims to bring...
Directory of 70 Video Surveillance Startups on Sep 18, 2019
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known. 2019...
Schmode is Back, Aims To Turn Boulder AI Into Giant on Sep 16, 2019
One of the most influential and controversial executives in the past decade is back. Bryan Schmode ascended and drove the hypergrowth of Avigilon...
ASIS GSX 2019 Final Show Report on Sep 12, 2019
IPVM went to Chicago for ASIS GSX 2019, with many exhibitors disappointed about traffic and the exhibitor schedule changing next year. However,...
JCI Sues Wyze on Aug 21, 2019
The mega manufacturer / integrator JCI has sued the fast-growing $20 camera Seattle startup Wyze. Inside this note: Share the court...
Verkada People And Face Analytics Tested on Aug 16, 2019
This week, Verkada released "People Analytics", including face analytics that they describe is a "game-changing feature" that "pushes the...
Mobile Access Control Shootout - Farpointe, HID, Openpath, Nortek, Proxy on Jul 29, 2019
One of the biggest rising trends in access control is using phones as credentials but which offering is best? IPVM has tested five of the...
Giant Tyco Campaigns Against Startup Qumulex on Jul 25, 2019
One is a giant conglomerate that owns the world's largest security integrator. The other has no shipping products. But Tyco is campaigning...
How To Quickly Research An Unknown Company on Jul 23, 2019
There are hundreds of companies in the physical security markets, ranging from a flood of new startups to small companies that may or may not be...

Most Recent Industry Reports

Alarm Veteran "Demands A Criminal Investigation" Of UL on Oct 18, 2019
The Interceptor's Project pressure against UL continues to rise. Following Keith Jentoft's allegation that "UL Has Blood On Their Hands", Jentoft...
Camect "Worlds Smartest Camera Hub" Tested on Oct 18, 2019
Camect is a Silicon Valley startup that claims the "Smartest AI Object Detection On The Market", detecting not only people and vehicles, but...
Hikvision Global News Reports Directory on Oct 17, 2019
Hikvision has received the most global news reporting of any video surveillance company, ever, ranging from the WSJ, the Financial Times, Reuters,...
Camera Calculator V3.1 Release Improves User Experience on Oct 17, 2019
IPVM has released a new version of our Camera Calculator, V3.1, with significant user experience improvements, a new development plan, and an...
Securing Access Control Installations Tutorial on Oct 17, 2019
The physical security of access control components is critical to ensuring that a facility is truly secure. Otherwise, the entire system can be...
Access Control Course Fall 2019 - Last Chance on Oct 17, 2019
Register Now - Fall 2019 Access Control Course. Thursday, October 17th is the last day to register. IPVM offers the most comprehensive access...
US DoD Comments on Huawei, Hikvision, Dahua Cyber Security Concerns on Oct 16, 2019
A senior DoD official said the US is "concerned" with the cybersecurity of Hikvision, Dahua, and Huawei due to "CCP" (China Communist Party)...
Pelco Sarix Pro3 Camera Tested on Oct 16, 2019
Pelco has released their Sarix Professional Series 3 cameras, claiming "more security detail in challenging scenes with excellent low light and...
IPVM Camera Calculator User Manual / Guide on Oct 16, 2019
Learn how to use the IPVM Camera Calculator. The guide below includes instructions, images, gifs, and videos demonstrating and explaining the...
Altronix Claims Tango 'Eliminates Electricians' on Oct 15, 2019
Power supply provider Altronix claims its new Tango power supply 'eliminates the need for an electrician, dedicated conduit and wire runs'. In...