Incident: Security Flaws in Hanwha Techwin America's Smart Cameras

Published Date: 2018-03-09

Postmortem Analysis
Timeline 1. The software failure incident with Hanwha Techwin America's surveillance cameras, as reported by Kaspersky Lab, happened in December [69107].
System 1. Hanwha Techwin America's surveillance cameras 2. Hanwha's PNW SmartCam 3. Hanwha's cloud network 4. Hanwha's smart cameras 5. Hanwha's cloud servers
Responsible Organization 1. Hanwha Techwin America's surveillance cameras were responsible for causing the software failure incident as they had 13 vulnerabilities that allowed attackers to exploit the cameras and potentially access sensitive information [69107].
Impacted Organization 1. Hanwha Techwin America's surveillance cameras [69107]
Software Causes 1. The software causes of the failure incident were the 13 vulnerabilities found in Hanwha Techwin America's surveillance cameras, which allowed attackers to view footage, disable the camera, access computer networks, mine for cryptocurrency, and perform other malicious activities [69107].
Non-software Causes 1. Lack of proper firewall protection for the cameras connected to Hanwha's cloud servers [69107]. 2. All cameras being hosted on a single cloud server instead of being spread apart [69107].
Impacts 1. The security flaws in Hanwha Techwin America's surveillance cameras allowed attackers to view footage from every connected camera, disable the cameras, and potentially gain access to the user's computer network, posing a significant privacy and security risk [69107]. 2. Attackers could use the compromised cameras to mine for cryptocurrency, potentially exploiting the devices for financial gain [69107]. 3. The vulnerabilities in the cameras could lead to unauthorized access and tampering with the surveillance footage, compromising the integrity of the recorded data and potentially impacting investigations or security monitoring [69107]. 4. Personal information stored on the cameras was at risk of being stolen, as Kaspersky Lab found a way to decrypt the camera's files, highlighting a potential breach of user privacy [69107]. 5. The incident raised concerns about the security of Internet of Things (IoT) devices in general, emphasizing the need for robust security measures to protect connected gadgets from cyberattacks and unauthorized access [69107].
Preventions 1. Implementing proper security measures such as using firewalls to protect the cameras from remote attacks [69107]. 2. Spreading the smart cameras across multiple cloud servers instead of hosting them all on one server to reduce the risk of a single point of failure [69107]. 3. Regularly updating firmware to address vulnerabilities and ensure the security of the devices [69107]. 4. Encrypting sensitive information stored on the cameras to prevent unauthorized access in case of a breach [69107].
Fixes 1. Implementing firmware updates to remediate the security flaws identified by Kaspersky Lab [69107]. 2. Fixing the remaining potential vulnerabilities that are currently being addressed by the company [69107]. 3. Enhancing security measures by adding firewalls to protect the smart cameras from remote attacks [69107]. 4. Spreading the smart cameras across multiple cloud servers instead of hosting them all on one server to improve security [69107]. 5. Ensuring that personal information stored on the cameras is encrypted and secure to prevent unauthorized access [69107].
References 1. Kaspersky Security Analyst Summit 2. Vladimir Dashchenko, head of Kaspersky Lab's vulnerability research team 3. Hanwha Techwin America 4. CNET 5. Hanwha Group 6. Samsung

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident has happened again at one_organization: - The incident occurred with Hanwha Techwin America's surveillance cameras, which were found to have 13 vulnerabilities that could allow attackers to view footage, disable the camera, access computer networks, and mine for cryptocurrency [69107]. - Hanwha's security cameras were exposed to remote attacks due to vulnerabilities in their cloud network, with cameras being connected to cloud servers without a firewall protection [69107]. - Kaspersky Lab's researchers discovered vulnerabilities in Hanwha's PNW SmartCam, affecting any camera connected to the company's cloud servers [69107]. - Hanwha acknowledged the vulnerabilities and mentioned that developers were working on solutions and a firmware update to address the concerns [69107]. (b) The software failure incident has happened again at multiple_organization: - The incident highlights the broader issue of security vulnerabilities in Internet of Things (IoT) devices, indicating that connected gadgets face challenges in maintaining security and are susceptible to cyberattacks [69107]. - Researchers and senators have warned about the security risks posed by IoT devices and the need for better security measures to protect against vulnerabilities [69107]. - The vulnerabilities in Hanwha's cameras, which allowed remote attacks and unauthorized access, serve as a cautionary example of the security challenges faced by IoT devices [69107].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the vulnerabilities discovered by Kaspersky Lab researchers with Hanwha Techwin America's surveillance cameras. The vulnerabilities allowed attackers to view footage from every Hanwha camera connected online, disable the camera, use it to access computer networks, and even mine for cryptocurrency. These vulnerabilities were a result of flaws in how the cameras connected online, indicating a design flaw in the system development process [69107]. (b) The software failure incident related to the operation phase is evident in how the Hanwha security cameras were exposed to remote attacks due to being hosted on cloud servers without proper protection. The vulnerabilities in the cloud network and the cameras themselves allowed attackers to access and tamper with the footage, clone cameras, block camera registration, and even destroy the cameras remotely. These operational failures highlight the risks introduced by the operation and use of the system [69107].
Boundary (Internal/External) within_system (a) within_system: The software failure incident with Hanwha Techwin America's surveillance cameras was primarily due to security flaws within the system itself. Researchers from Kaspersky Lab identified 13 vulnerabilities with the cameras and how they connected online, allowing attackers to view footage, disable the camera, access the computer network, mine for cryptocurrency, and more [69107]. The vulnerabilities were present in the cameras and the way they were connected to Hanwha's cloud servers, without the protection of a firewall and with all cameras on one cloud server, making them susceptible to remote attacks [69107]. Additionally, there were nine vulnerabilities on the camera itself that could be exploited through the cloud, enabling attackers to destroy the camera, steal personal information, and decrypt passwords from its communications [69107]. The software failure incident was a result of internal security weaknesses within the system.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case was primarily due to non-human actions, specifically security flaws in the Hanwha Techwin America's surveillance cameras. Researchers from Kaspersky Lab discovered 13 vulnerabilities with the cameras and how they connected online, which could allow an attacker to view footage, disable the camera, access the computer's network, and even mine for cryptocurrency [69107]. (b) However, human actions were also involved in this software failure incident. The vulnerabilities in the cameras were a result of how they were hosted on cloud servers online without proper security measures such as a firewall. Additionally, the vulnerabilities on the camera itself were exploited through the cloud, indicating a potential lack of robust security practices during the development and deployment of the cameras [69107].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The software failure incident with Hanwha Techwin America's surveillance cameras was due to security flaws in the cameras themselves, particularly vulnerabilities in how they connected online [69107]. - The vulnerabilities in the cameras allowed attackers to view footage from every connected camera, disable the camera, use it to access computer networks, mine for cryptocurrency, and even clone cameras to show different surveillance feeds [69107]. - The cameras were exposed to remote attacks due to being hosted on cloud servers without proper firewall protection, making them vulnerable to hacking from anywhere in the world [69107]. (b) The software failure incident related to software: - The vulnerabilities in the Hanwha security cameras were primarily software-related, with 13 vulnerabilities identified by Kaspersky Lab's vulnerability research team [69107]. - The vulnerabilities affected any camera made by the company that was connected to its cloud servers, indicating software flaws in the camera systems themselves [69107]. - Kaspersky Lab's researchers found ways to exploit the vulnerabilities through the cloud, without needing physical access to the cameras, demonstrating software weaknesses in the camera systems [69107].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case is malicious. The security flaws discovered in Hanwha Techwin America's surveillance cameras were identified as vulnerabilities that could be exploited by attackers to view footage, disable the cameras, gain access to computer networks, mine for cryptocurrency, tamper with surveillance feeds, clone cameras, block camera registration, and steal personal information stored on the cameras [69107]. These vulnerabilities were not accidental but were intentionally exploited by attackers to compromise the security and functionality of the cameras.
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident related to the security flaws in Hanwha Techwin America's surveillance cameras can be attributed to poor decisions made in the design and implementation of the cameras' online connectivity and cloud hosting. The vulnerabilities discovered by Kaspersky Lab researchers were a result of poor decisions in how the cameras connected online, the lack of proper security measures such as firewalls, and hosting all cameras on a single cloud server without proper isolation [69107]. These poor decisions allowed attackers to exploit the cameras remotely, access footage, tamper with surveillance feeds, and even clone cameras to show different feeds to users. Additionally, the vulnerabilities on the camera itself, such as the ability to decrypt passwords from communication and steal personal information, indicate poor decisions in the camera's security design and encryption protocols [69107]. Overall, the software failure incident can be attributed to poor decisions made in the design, implementation, and security measures of the smart cameras, leading to significant security flaws and potential risks for users.
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the article can be attributed to development incompetence. The security flaws in Hanwha Techwin America's surveillance cameras were a result of 13 vulnerabilities with how the cameras connected online, allowing attackers to view footage, disable the camera, access computer networks, and even mine for cryptocurrency [69107]. (b) Additionally, the vulnerabilities in the cameras, such as being exposed to remote attacks and lacking proper firewall protection, were accidental factors that contributed to the software failure incident [69107].
Duration permanent (a) The software failure incident in the article seems to have a permanent impact. The vulnerabilities discovered in Hanwha Techwin America's surveillance cameras were significant and could have allowed attackers to view footage, disable the cameras, access computer networks, mine for cryptocurrency, tamper with footage, clone cameras, block camera registration, and even steal personal information stored on the cameras. These vulnerabilities were not limited to a specific circumstance but rather represented inherent flaws in the design and implementation of the cameras, making the impact of the failure long-lasting and severe [69107].
Behaviour crash, omission, value, other (a) crash: The software failure incident in the article can be categorized as a crash. The vulnerabilities discovered in Hanwha Techwin America's surveillance cameras could allow an attacker to completely disable the camera, making it unable to perform its intended function of surveillance ([69107]). (b) omission: The software failure incident can also be categorized as an omission. The vulnerabilities in the cameras allowed attackers to view footage from every connected camera, tamper with the footage, and even block camera registration, omitting the system from performing its intended functions properly ([69107]). (c) timing: The software failure incident does not align with a timing failure as the system was not reported to perform its intended functions too late or too early ([69107]). (d) value: The software failure incident can be categorized as a value failure. The vulnerabilities in the cameras allowed attackers to exploit the system, perform unauthorized actions, mine for cryptocurrency, and potentially steal personal information stored on the cameras, indicating that the system was performing its intended functions incorrectly ([69107]). (e) byzantine: The software failure incident does not align with a byzantine failure as there were no mentions of inconsistent responses or interactions from the system ([69107]). (f) other: The other behavior exhibited by the software failure incident is a security vulnerability. The vulnerabilities discovered in the cameras exposed them to remote attacks, allowing unauthorized access, tampering with footage, and potential data theft, highlighting a critical security flaw in the system ([69107]).

IoT System Layer

Layer Option Rationale
Perception sensor, processing_unit, network_communication, embedded_software (a) sensor: The software failure incident related to the Hanwha Techwin America's surveillance cameras was primarily due to security flaws in the sensor layer. The vulnerabilities discovered by Kaspersky Lab's researchers allowed attackers to view footage from the cameras, disable the cameras, and gain access to the computer's network through the cameras [69107]. These vulnerabilities were present in the cameras themselves, indicating issues at the sensor level. (b) actuator: The articles do not mention any specific failures related to the actuator layer of the cyber-physical system in this software failure incident. (c) processing_unit: The processing unit of the cameras was affected by vulnerabilities that allowed attackers to exploit the cameras through the cloud without needing physical access to the devices. The vulnerabilities also enabled attackers to completely destroy the cameras and steal personal information stored on them [69107]. (d) network_communication: The failure in this incident was also related to network communication errors. The cameras were hosted on cloud servers without proper protection, making them susceptible to remote attacks from anywhere in the world. Additionally, the vulnerabilities in the cloud network where the cameras were connected exposed them to security risks [69107]. (e) embedded_software: The software failure incident involved vulnerabilities in the embedded software of Hanwha's surveillance cameras. The flaws in the cameras' software allowed attackers to perform various malicious activities, such as mining for cryptocurrency, tampering with footage, cloning cameras, and decrypting passwords from communication [69107].
Communication connectivity_level The software failure incident reported in Article 69107 was related to the connectivity level of the cyber physical system that failed. The security flaws discovered in Hanwha Techwin America's surveillance cameras were primarily due to vulnerabilities in how the cameras connected online, specifically through the cloud servers. Researchers from Kaspersky Lab found that the cameras were exposed to remote attacks because they were hosted on cloud servers without the protection of a firewall. Additionally, the vulnerabilities on the camera itself could be exploited through the cloud, indicating issues at the network or transport layer of the system [69107].
Application TRUE The software failure incident described in the article [69107] was related to the application layer of the cyber physical system. The vulnerabilities discovered in Hanwha Techwin America's surveillance cameras were due to security flaws introduced by bugs and incorrect usage. The vulnerabilities allowed attackers to exploit the cameras remotely, tamper with footage, clone cameras, block camera registration, and even destroy the cameras. These issues were not related to the physical hardware but rather to flaws in the software application layer of the cameras, making it a clear example of a failure at the application layer of the cyber physical system.

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving security flaws in Hanwha Techwin America's surveillance cameras had significant consequences related to property. The vulnerabilities discovered by Kaspersky Lab researchers allowed attackers to potentially view footage from every Hanwha camera connected online, disable the cameras, access users' computer networks, and even use the cameras for cryptocurrency mining [69107]. Additionally, the vulnerabilities could lead to the theft of personal information stored on the cameras, as Kaspersky Lab found a way to decrypt passwords from the camera's configuration files [69107]. These consequences directly impact the property of individuals who own and use these surveillance cameras.
Domain information (a) The failed system in this incident was related to the information industry, specifically in the realm of security cameras and surveillance technology. The vulnerabilities discovered by Kaspersky Lab in Hanwha Techwin America's surveillance cameras highlighted significant security flaws that could be exploited by attackers to view footage, disable cameras, access computer networks, mine for cryptocurrency, and manipulate surveillance feeds [69107].

Sources

Back to List