CISA Warns About Video Camera SDK Vulnerability Affecting Millions of Devices

• There’s a flaw in ThroughTek P2P SDK that could let someone spy on the video feeds of millions of cameras.
• The vulnerability has been addressed via an update since last summer, but many clients still run an old version.
• CISA has published an alert to raise awareness on this important cybersecurity issue.

CISA (Cybersecurity and Infrastructure Security Agency) has published a new advisory warning about a novel flaw in the ThroughTek P2P SDK versions 3.1.5 and older, which could permit unauthorized access to cleartext video and audio feeds through millions of affected cameras. The flaw in question is tracked as “CVE-2021-32934” and has a severity score of 9.1 in the CVSS v3 evaluation standard. It is also exploitable remotely, and it doesn’t require much complexity to do so.

According to the advisory, the following products are affected by the flaw:

• Versions 3.1.5 and prior.
• SDK versions with nossl tag.
• Device firmware that does not use AuthKey for IOTC connection.
• Device firmware using the AVAPI module without enabling DTLS mechanism.
• Device firmware using P2PTunnel or RDT module.

The proposed mitigations are the following:

1. If SDK is Version 3.1.10 and above, enable authkey and DTLS.
2. If SDK is any version prior to 3.1.10, upgrade library to v3.3.1.0 or v3.4.2.0 and enable authkey/DTLS.

CISA also suggests that users should minimize network exposure for all control system devices and to locate control system networks and remote devices behind firewalls and isolate them from the business network. If remote access is required and there’s no other option, reliable VPNs should be deployed for secure access and also the encryption of the data that comes and goes.

ThroughTek has clarified that this issue has been addressed in SDK version 3.3 and onwards, which was released last summer. Even though a full year has passed since then, it appears there is still a noteworthy number of customers who have either ignored the new version or didn’t implement it correctly. These customers correspond to several millions of devices, so the impact of this flaw is pretty big.

As for who discovered the vulnerability, that would be researchers at ‘Nozomi Networks Labs.’ They discovered that the video and audio feed passed through ThroughTek’s P2P platform lacks a secure key exchange and relies instead on an obfuscation scheme based on a fixed key. They then created a proof-of-concept script that deobfuscates on-the-fly packets from the sniffed network traffic and disclosed the bug to ThroughTek in March 2021.

Related

Patched FortiClient EMS Vulnerability Exploited in the Wild Worldwide

Rapido Ride-Hailing Platform Leaks User and Driver Data via Website Flaw

GPS Tracker Company ‘Hapn’ Exposes Thousands of Customers' Identities Due to Website Flaw

Clipper DEX Exploit Targets Withdrawal Functionality, Resulting in $450K Loss

Critical ICS Flaws Seen in Schneider Electric, mySCADA, and Automated Logic Products  

Zyxel Firewalls Vulnerability Targeted by Helldown Ransomware

Most Popular

Attack on Titan: The Last Attack- all the Confirmed International Theatrical Release Dates

Den of Thieves 2: Pantera- All we know About the sequel to the Surprise hit Heist film

Does Sonic 3 have a Post-Credits Scene?

What we know so far About Virgin River Season 7

Colleen Hoover’s Verity Movie Adaptation adds two more Hollywood Stars to its cast

Stranger Things Season 5 Release date: One good news and one bad news for fans