printer friendly version

Who is responsible? You are!

Gone are the days of installing IP cameras without a care about security; and by that I mean information security or cyber security, or whatever you want to call it. A security company, Sucuri, was recently asked to help a small jewellery business suffering a distributed denial of service (DDOS) attack. The business’s website was receiving around 35 000 requests per second, which basically made the website useless for everyone.

Sucuri dealt with the attack, only to find the number of requests increasing to almost 50 000 after the site came back online. This is where the IoT (Internet of Things) comes into the picture. IoT devices have been used in attacks before, but this time the IoT devices were surveillance cameras that were connected to the Internet. To be more specific, Sucuri was able to identify over 25 000 IP addresses from cameras located around the world.

The cameras were located in 105 different countries. What is nice is that for once South Africa wasn’t in the top 10, although it was one of the 105.

The key issue here was the vulnerability the attackers took advantage of dates back to 2014. The software was developed in China and affects over 70 vendors who use it in their DVRs – which means the cameras attached to the DVRs can be compromised. You can read a technical investigation into the vulnerability at www.securitysa.com/*ksrce1, as well as a list of the affected vendors.

Fortunately, most of the vendors are small companies you probably haven’t heard of, but there are enough recognisable names to make one nervous. Of course, one doesn’t know who may have bought from these vendors and put their own branding on the product.

We also don’t know which vendors may have patched their products since the article was published, but we do know there are over 25 000 cameras out there that are still vulnerable. But these are only the ones discovered in this incident, how many more may be out there?

You can read the story at www.securitysa.com/*subot1, but the moral of the story is simply that you can not expect security when you are on the Internet for any reason. It would be nice if we could expect our vendors and service providers to do their jobs and ensure security, but at the end of the day it’s you who must take responsibility for your own kit.

This means buying trusted brands from suppliers and service providers who know what they are doing and won’t vanish into thin air after the account is paid. It also means taking responsibility for your own upgrades and security patches – even on cameras, NVRs and DVRs, as well as computers, laptops and servers. At the very least, include it in your SLA and check that it’s done.

This won’t solve all the malware and similar problems, but it will make it harder for malware deviants to ply their trade. Also, maybe it’s time for physical security vendors to upgrade their patch release schedules?

Andrew Seldon

Editor

Share this article:

Further reading: