{"id":6925,"date":"2017-03-09T14:19:30","date_gmt":"2017-03-09T22:19:30","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/03\/09\/news-716\/"},"modified":"2017-03-09T14:19:30","modified_gmt":"2017-03-09T22:19:30","slug":"news-716","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/03\/09\/news-716\/","title":{"rendered":"SSD Advisory – Over 100K IoT Cameras Vulnerable to Source Disclosure"},"content":{"rendered":"

Credit to Author: noam| Date: Thu, 09 Mar 2017 08:34:23 +0000<\/strong><\/p>\n

\n

Vulnerability Summary<\/strong>
The following advisory describes an arbitrary file content disclosure vulnerability found in GoAhead web server.<\/p>\n

The GoAhead web server is present on multiple embedded devices, from IP Cameras to Printers and other embedded devices.<\/p>\n

The vulnerability allows a remote unauthenticated attacker to disclose the content of the file being accessed. As most embedded devices do not run a SQL (or SQL-like) daemon, the credentials for authentication are stored inside the file being accessed. Through this disclosure attack, an attacker can view the credentials required to access the device.<\/p>\n

Credit<\/strong>
An independent security researcher Istvan Toth has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.<\/p>\n

Vendor response<\/strong>
Update: the vendor (GoAhead) claims the vulnerability is not in his product, but rather in the camera vendor’s code.<\/p>\n

We at Beyond Security, are unsure about this, but as none of the camera vendors responded, we are left in the dark at the root cause for the vulnerability.<\/p>\n

Since this vulnerability affects practically multiple devices that have the GoAhead web server (these devices appear to implement old versions of GoAhead), there is no one company you can report these vulnerabilities to or get them addressed – further the majority of the products that are vulnerable are OEM products with no real “vendor” behind them.<\/p>\n

We urge users who have an embedded device and have GoAhead running on them, you can know this by seeing the following banner returned when you connect to the device:<\/p>\n<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n