Incident: Vulnerability in Internet-Connected Surveillance Cameras Allows Hackers Access

Published Date: 2018-05-07

Postmortem Analysis
Timeline 1. The software failure incident of vulnerable surveillance cameras to hackers happened in 2018 [71482].
System 1. Surveillance cameras made by TBK Vision 2. Cameras sold by CeNova, Night Owl, Nova, Pulnix, Q-See, and Securus [71482]
Responsible Organization 1. The surveillance cameras made by various brands such as TBK Vision, CeNova, Night Owl, Nova, Pulnix, Q-See, and Securus were responsible for the software failure incident as they had a flaw that allowed hackers to exploit and access login credentials [71482].
Impacted Organization 1. Internet-connected surveillance camera users, including those using cameras made by TBK Vision, CeNova, Night Owl, Nova, Pulnix, Q-See, and Securus were impacted by the software failure incident [71482].
Software Causes 1. Vulnerability in surveillance cameras allowing hackers to exploit a flaw with a short line of code to log in, leading to the exposure of usernames and passwords in plain text [71482].
Non-software Causes 1. Lack of proper response from camera makers TBK Vision, Pulnix, Q-See, CeNova, Night Owl, Novo, and Securus to address the vulnerability in their surveillance cameras [71482].
Impacts 1. The vulnerability in tens of thousands of surveillance cameras allowed hackers to exploit a flaw to log in and obtain the cameras' usernames and passwords in plain text [71482].
Preventions 1. Implementing strong password policies and ensuring that default passwords are changed upon installation could have prevented the software failure incident [71482]. 2. Regular security audits and vulnerability assessments of the surveillance cameras could have helped identify and patch the flaw before it was exploited by hackers [71482]. 3. Providing timely responses to security researchers who report vulnerabilities in the software could have allowed for quicker mitigation of the issue before it was publicly exploited [71482].
Fixes 1. Manufacturers should promptly release firmware updates to patch the vulnerability in the surveillance cameras [71482].
References 1. Researcher Ezequiel Fernandez 2. Spanish camera maker TBK Vision 3. CeNova 4. Night Owl 5. Nova 6. Pulnix 7. Q-See 8. Securus 9. Other security experts 10. CNET 11. Bleeping Computer

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident has happened again at one_organization: The article mentions that the researcher first found the flaw in cameras made by Spanish camera maker TBK Vision, but then found that several other brands from around the globe appeared to be affected, including cameras sold by CeNova, Night Owl, Nova, Pulnix, Q-See, and Securus. This indicates that the software failure incident has happened again within the same organization (TBK Vision) as well as with its products and services [71482]. (b) The software failure incident has happened again at multiple_organization: The article highlights that the flaw discovered by the researcher affected not only cameras made by TBK Vision but also cameras from other brands such as CeNova, Night Owl, Nova, Pulnix, Q-See, and Securus. This indicates that the software failure incident has happened again at multiple organizations or with their products and services [71482].
Phase (Design/Operation) design, operation (a) The software failure incident in the articles can be attributed to the design phase. The vulnerability in the surveillance cameras was due to a flaw that allowed hackers to exploit a short line of code to log in and access the cameras' username and password in plain text. This flaw was present in cameras from various brands, indicating a design issue in the cameras' software [71482]. (b) The software failure incident can also be linked to the operation phase. The vulnerability was exacerbated by the use of default passwords for the cameras, making them easy targets for hackers. Additionally, the incident mentions how hackers can find these cameras online using search engines and attempt to log in, highlighting the operational aspect of the security breach [71482].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident reported in the article is primarily within the system. The vulnerability in the surveillance cameras, allowing hackers to exploit a flaw to log in and access the cameras' username and password in plain text, originates from within the system itself. The flaw was found in cameras made by various brands, indicating an internal issue within the design or implementation of the cameras' software [71482]. (b) outside_system: Additionally, external factors contribute to the software failure incident. The use of default passwords in internet-connected surveillance systems makes them especially vulnerable to hackers. Hackers can easily locate these cameras online using search engines like Google or Shodan, which are external tools that facilitate the identification of vulnerable devices. The Mirai attacks in 2016, where hackers infected internet-connected cameras with malicious software to create a network of hacked devices, also highlight the impact of external factors on the vulnerability of these systems [71482].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident in this case is primarily due to a flaw in the surveillance cameras' software that allows hackers to exploit it with a short line of code, enabling them to log in and access the cameras' username and password in plain text. This vulnerability in the cameras' software was identified by a researcher, Ezequiel Fernandez, who found that multiple brands of cameras from different manufacturers were affected by this flaw [71482]. (b) The software failure incident occurring due to human actions: The software failure incident also involves human actions, particularly in the aspect of default passwords being used for the internet-connected surveillance cameras. The article highlights that these cameras are especially vulnerable to hackers when default passwords like "admin" are not changed, making it easier for hackers to access the cameras. Additionally, the lack of response from some camera manufacturers to address the issue or provide comments on the vulnerability also reflects a human factor contributing to the software failure incident [71482].
Dimension (Hardware/Software) hardware, software (a) The software failure incident in the article is primarily related to hardware vulnerabilities in surveillance cameras. The flaw that allowed hackers to exploit the cameras and access login credentials was a hardware vulnerability present in cameras from various brands like TBK Vision, CeNova, Night Owl, Nova, Pulnix, Q-See, and Securus [71482]. (b) The software failure incident also has a software aspect to it as the flaw in the surveillance cameras allowed hackers to exploit the software running on the cameras to retrieve usernames and passwords in plain text. This software vulnerability enabled the unauthorized access to the cameras [71482].
Objective (Malicious/Non-malicious) malicious (a) The objective of the software failure incident was malicious. The incident involved a flaw in surveillance cameras that allowed hackers to easily exploit and access the cameras' login credentials. This vulnerability could be used by hackers to gain unauthorized access to the cameras, potentially for malicious purposes such as surveillance, data theft, or further attacks. The article mentions previous incidents like the Mirai attacks in 2016, where hacked cameras were used to create a network of compromised devices to launch large-scale attacks on popular websites [71482].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor_decisions: - The software failure incident involving tens of thousands of surveillance cameras being vulnerable to hackers was primarily due to poor decisions such as using default passwords for the cameras, making them easily accessible to hackers [71482]. (b) The intent of the software failure incident related to accidental_decisions: - The software failure incident did not specifically mention any accidental decisions contributing to the vulnerability of the surveillance cameras to hackers.
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in Article 71482 can be attributed to development incompetence. The vulnerability in the surveillance cameras was due to a flaw that a researcher in Argentina found, which allowed anyone with a short line of code to exploit and log in to the cameras. This flaw was present in cameras made by various brands from around the globe, indicating a lack of professional competence in ensuring the security of these devices [71482]. (b) Additionally, the incident can also be categorized as accidental, as the flaw in the cameras that made them vulnerable to hackers was not intentional but rather a result of oversight or lack of proper security measures during the development and manufacturing process. The fact that default passwords were a significant factor in the vulnerability further supports the accidental nature of the incident [71482].
Duration permanent (a) The software failure incident described in the article is more aligned with a permanent failure. The vulnerability in the surveillance cameras that allowed hackers to exploit a flaw in the system to log in was a fundamental issue with the design and implementation of the cameras themselves. This flaw could be consistently exploited by anyone with the knowledge of a short line of code, indicating a systemic issue that persisted until addressed. Additionally, the article mentions past incidents like the Mirai attacks in 2016, where hackers were able to access internet-connected cameras and create a network of hacked devices. This historical context suggests that the vulnerability in such devices can lead to long-term consequences and persistent risks of exploitation by malicious actors. Therefore, the software failure incident in this case appears to be more of a permanent nature, as the underlying vulnerability in the surveillance cameras could continue to pose a threat until mitigated [71482].
Behaviour omission, value, other (a) crash: The article mentions the Mirai attacks in 2016 where hackers accessed internet-connected cameras and infected them with malicious software, creating a network of hacked devices. The hackers then used the cameras to send an overwhelming number of requests to popular websites like Twitter, Reddit, and Netflix, temporarily taking them offline [71482]. (b) omission: The vulnerability in the surveillance cameras allowed hackers to exploit a flaw that enabled them to receive a camera's username and password in plain text. This omission in the security system allowed unauthorized access to the cameras [71482]. (c) timing: The article does not specifically mention any failures related to timing. (d) value: The software failure incident in this case is related to the system performing its intended functions incorrectly, as hackers were able to exploit a flaw in the cameras to access login credentials [71482]. (e) byzantine: The article does not mention any failures related to the system behaving erroneously with inconsistent responses and interactions. (f) other: The other behavior observed in this software failure incident is the vulnerability of internet-connected surveillance systems due to default passwords. Hackers could easily find these cameras online using search engines and attempt to log in, especially when default passwords like "admin" are used, making unauthorized access easier [71482].

IoT System Layer

Layer Option Rationale
Perception sensor (a) The failure was related to the perception layer of the cyber physical system that failed due to contributing factors introduced by sensor error. The vulnerability in the surveillance cameras allowed hackers to exploit a flaw that enabled them to access the cameras' username and password in plain text. This flaw in the cameras' sensors made it possible for hackers to easily log in and compromise the devices [71482].
Communication connectivity_level The software failure incident described in the article [71482] is related to the connectivity_level of the cyber physical system. The vulnerability in the surveillance cameras allowed hackers to exploit a flaw in the software to log in and access the cameras' username and password in plain text. This indicates that the failure was due to contributing factors introduced by the network or transport layer, as hackers were able to exploit the cameras' connection to the internet to gain unauthorized access.
Application TRUE The software failure incident described in the article [71482] is related to the application layer of the cyber physical system. The vulnerability in the surveillance cameras allowed hackers to exploit a flaw in the cameras' software, enabling them to easily log in and access the cameras' username and password in plain text. This vulnerability was due to a bug or flaw in the software that allowed unauthorized access, which aligns with the definition of a failure at the application layer caused by bugs or incorrect usage.

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) death: There is no mention of any deaths resulting from the software failure incident in the provided article [71482]. (b) harm: The article does not mention any physical harm caused to individuals due to the software failure incident [71482]. (c) basic: The incident did not impact people's access to food or shelter [71482]. (d) property: People's material goods, money, or data were impacted due to the software failure incident. The vulnerability in surveillance cameras allowed hackers to potentially access the cameras and obtain login credentials, which could lead to privacy breaches and unauthorized access to personal property [71482]. (e) delay: There is no mention of any activities being postponed due to the software failure incident in the article [71482]. (f) non-human: Non-human entities, specifically internet-connected cameras, were impacted by the software failure incident. The vulnerability in the surveillance cameras allowed hackers to exploit them and potentially compromise their security [71482]. (g) no_consequence: The article does not mention that there were no real observed consequences of the software failure incident [71482]. (h) theoretical_consequence: The article discusses potential consequences of the software failure incident, such as the vulnerability of internet-connected surveillance systems to hackers and the risks associated with default passwords. It mentions the Mirai attacks in 2016 where hackers infected internet-connected cameras with malicious software to create a network of hacked devices [71482]. (i) other: The article does not mention any other specific consequences of the software failure incident beyond those related to property and theoretical risks discussed [71482].
Domain information, utilities, other (a) The software failure incident reported in the article is related to the industry of information. The incident involved tens of thousands of surveillance cameras being vulnerable to hackers due to a flaw that allowed anyone with a short line of code to exploit and access the cameras' login credentials [71482]. These surveillance cameras are connected to the internet, making them susceptible to hacking attempts, especially when default passwords are not changed, as was the case with some of the affected camera brands. (g) The incident also has implications for the utilities industry, as internet-connected surveillance systems, such as the vulnerable cameras in this case, are part of the infrastructure that provides security and monitoring services. The vulnerability of these cameras to hacking poses a risk to the security and functionality of the utilities sector, which includes power, gas, steam, water, and sewage services [71482]. (m) Additionally, the software failure incident can be categorized under the "other" industry as it pertains to the broader issue of cybersecurity and the interconnected nature of digital systems. The incident highlights the importance of securing internet-connected devices across various industries to prevent unauthorized access and potential malicious activities [71482].

Sources

Back to List