Firmware bug in CCTV software may have given POS hackers a foothold

Surveillance cameras could provide hackers with a foothold into networks

A researcher with RSA says faulty firmware found in security cameras sold by at least 70 vendors may be a contributor to many of the credit card breaches that have proved costly to retailers.

Rotem Kerner based his research on a paper RSA published in December 2014 into a malware nicknamed Backoff, which steals payment card details processed by point-of-sale systems.

The U.S. Secret Service and Department of Homeland Security warned in August 2014 that upwards of 1,000 U.S. businesses may have been infected with Backoff.

The advisory came after a hard year in which many major retailers became victims of large payment card breaches, including Target, Neiman Marcus, Michaels and UPS Store.

Kerner looked at the technical data RSA had collected from computers that were infected with Backoff. Strangely, many were running small Web servers with open ports on 81, 82 and 8000.

The software, named "Cross Web Server," proved to be for CCTV DVR (digital video recorder) equipment, which is widely used by retailers for physical monitoring. But the server software was left running and open to the Internet, which is a potential security risk.

Shodan, a search engine for finding networked devices open to the Internet, turned up 30,000 machines running the same software, according to Kerner's writeup.

Kerner figured out the Web server software was made by a Chinese company called TVT. He downloaded a version of the firmware for the CCTV DVR devices from the company's website.

Probing the firmware, he found a weakness in the code that would allow him to get remote access to the device through a malicious URI.

The big security problem is that this kind of software shouldn't be accessible from the public Internet. The mere presence of camera software left open to the Internet can help attackers identify a particular network and figure out if one belongs to a retailer.

Access to the device itself could help in gaining entry to the broader network, which could eventually lead to payment processing systems.

"When the old fashion thieves used to physically break into stores, on their way to the cashier they had to try and avoid or neutralize any surveillance equipment," Kerner wrote. "The digital thieves are entering the store through them. Truly Hollywood material."

His investigation turned up at least 70 manufacturers that use the same firmware, which he listed in a writeup. Kerner tried but failed to reach officials at TVT to warn them of the vulnerability, so he decided to publicly disclose the problem.

TVT officials could not be immediately contacted via email on Thursday.

It's not uncommon for firmware -- which is low-level code -- to be licensed and used by many vendors for products such as routers, IP cameras and some consumer electronics.

But it's well-known that vendors are notoriously lax about creating patches. As Werner put it: it's hard to rely on a vendor's patch "to arrive at your doorstep." Adding to the complexity is that each vendor may use the firmware in many different models.

Werner's recommended defense for those running these types of cameras is to "deny any connection from an unknown IP address to the DVR services."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?