Exploiting CCTV and IP Cameras

Surveillance cameras has helped launch the biggest attacks on the Internet. The Internet of Things (IoT) is now a major force in the weaponization of DDoS and the cameras being one they are used as botnets to fuel attacks. This blog article shows how they can be compromised and exploited by attackers using various techniques.Surveillance Cameras is a group term used to encompass both CCTV and IP Cameras. There are some major differences between Closed Circuit Television (CCTV) systems and Internet Protocol (IP) cameras. IP cameras are the modern choice, though business owners and property managers prefer to use CCTV cameras to monitor large spaces. Below is a brief comparison of some of the main features of each type of cameras.

CCTV cameras	IP cameras
Sends video back through coaxial or UTP cables.	Broadcasts video as a digital stream over an IP network to an NVR (network video recorder).
Video is recorded on a physical DVR which can be connected to the internet for remote viewing.	Use of SD cards, allowing them to record locally, or sends video via the internet to an NVR
Power and network cables run between each camera and the base station.	Uses PoE (Power over Ethernet) making it unnecessary to run power cables.
Because cabling is required, CCTV cameras all have to be in one location.	Because cabling is not always required, IP cameras do not all need to be kept in one location.
Cameras typically offer lower resolution of 960 x 480, but some systems offer HD resolution.	Some cameras feature increased resolution of 4096 x 2160. Standard resolution tends to be 1080p HD.
Primarily provides video surveillance without advanced features.	Includes advanced features such as analytics, advanced motion detection, and remote focus.
There is a physical limit to the number of cameras that can be added to the network.	Unlimited cameras can be added to the network.
2-way audio for communication with people on the other end.	2-way audio for communication with people on the other end.
Uses television to broadcast signals.	Uses Wi-Fi and bandwidth.

In this article we will concentrate more on IP Cameras since they are the mostly used and it provides a direct communication between the computer network and the internet hence it can be accessed anywhere on the live feed using any device.

Google Dorks
Google dorks are Google Search queries that find vulnerable systems or sensitive information about databases, websites or any IoT device.
The following type of queries can be used to find vulnerable security cameras in the internet:

Inurl:”CgiStart?page=”
inurl:/view.shtml
intitle:”Live View / – AXIS
inurl:view/view.shtml
inurl:ViewerFrame?Mode=
inurl:ViewerFrame?Mode=Refresh
inurl:axis-cgi/jpg
inurl:axis-cgi/mjpg (motion-JPEG) (disconnected)
inurl:view/indexFrame.shtml
inurl:view/index.shtml
inurl:view/view.shtml
liveapplet
intitle:”live view” intitle:axis
intitle:liveapplet
allintitle:”Network Camera NetworkCamera” (disconnected)
intitle:axis intitle:”video server”
intitle:liveapplet inurl:LvAppl
intitle:”EvoCam” inurl:”webcam.html”
intitle:”Live NetSnap Cam-Server feed”
intitle:”Live View / – AXIS”
inurl:indexFrame.shtml Axis

Shodan is also great search engine that lets one find specific types of computers or anything imaginable connected to the internet in this case the IP Cameras. Using filters you can get a list of exploitable IP cameras.

Angry IP Scanner

Also known as ipscan, is an open source network scanning tool that can be used to scan ip addresses and ports on your network. Angry IP scanner tool works by just inputting a network range to scan. For first time use, make sure you add the web-detect feature by going to Tools>Fetchers. 

In an internal network it easy to input the network range, start with your default gateway network address to the last network address. When the scan is complete it will show you the IP address assigned to the IP camera. The IP Camera may be configured to be outside the network. 

myip.ms is an online IP database, it is good for finding any Public IPv4 network address of any Country or Province. Since you will not get the exact IP address for the Camera you have to input a network range to scan, preferably from the first to the last octet tof the subnet (0-255).

After a successful scan note the name of the cameras on the Web detect tab.

The following are the keywords to look out for from the web detect tab, they do identify the IP cameras;
RomPager/4.07 UPnP/1.0
Uc –httpd 1.0.0
DVRDVS-Webs
Microhttpd
Webs
Hikvision-Webs
iBall –Baton

Copying the IP address on your web browser you will be presented with a web login page. Their are different IP cameras models out in the market. This article will also try to point out how poor the security is and how it can be easily exploited.
You should first try logging in with default passwords. System administrators leave their devices with default username and password combinations for a variety of reasons. Simply not knowing that a password needs to be changed or assuming that their perimeter firewall will protect them from unauthorized access are some of the reasons for doing so, which is a stupid idea. During an attack phase, attackers spent most of their time going through products specification, configuration to find any way to get into a device or system.
Different Camera models have different default logins, try googling for them for your case. Some IP cameras like the Avigilon and new Axis require password creation during first login which is a good practice, other Models like Hikvision,Panasonic, Nothern, Samsung and Bosch have adopted the same by upgrading their firmware to require unique password creation.
After a successful login some cameras need plugins for them to work on the web page, you can it download them from the same page or from the manufacture website.

Non default credentials do not keep attackers away, the passwords can be cracked. Poor password creation is exploited at this point, the simpler the passwords are the easier they can be cracked.

Hydra is powerful tool that can be used to crack the IP/CCTV cameras passwords or other password secured applications. You will need a wordlist which is can be found in default in Kali Linux distro or you create a custom one for yourself.

hydra -s 80 -l admin -P /path/to/your/wordlist.txt -e ns -t 16 targetIP http* 

The arguments of the above hydra command is shown below:
-s 80 -- define port number
-l admin -- default login name 'admin'
-P -- path to your wordlist
-e --- empty password
ns --- try login as password and try empty password
http --- port name for attack

Most of the commercial IP cameras out there utilize RTSP as a mechanism for streaming their video feeds. Real Time Streaming Protocol (RTSP) is a network control protocol designed for use in entertainment and communications systems to control streaming media servers. The protocol is used for establishing and controlling media sessions between end points. Clients of media servers issue VCR-style commands, such as play, record and pause, to facilitate real-time control of the media streaming from the server to a client.
RTSP just like HTTP protocol runs on specific ports i.e ports 554 (default RTSP port) and 8554 (default emulated RTSP port). RTSP has different structure and control commands but is textual in its format hence easy to use after learning the basic commands behind it.
RTSP is not that in the limelight but not to the Security professionals since it is exploitable. Their is a tool; Cameradar that hacks its way into RTSP CCTV cameras. It is available in Github. It has got the following cool features:

• Detects open RTSP hosts on any accessible subnetwork.
• Gets the public info (hostname, port, camera model.)
• Brute forces its own way into them to get their stream route.
• Brute forces its own way into them to get the username and password of the cameras
• Generates thumbnails from them to check if the streams are valid.
• It creates a Gstreamer pipeline to check if they are properly encoded.
• Prints a summary of all the information.

Cameradar uses docker an application that automates the deployment of applications inside software containers.

Before you run the tool, ensure you install all the dependencies depending on your Linux distribution package manager:
sudo pacman -S docker

Start the docker service:

sudo systemctl start docker

Install the tool by git cloning it from Github then build it.
git clone https://github.com/EtixLabs/cameradar.git
cd cameradar/deployment
sudo rm *.tar.gz
sudo ./build_last_package.sh
docker-compose build cameradar
docker-compose up cameradar
Run Cameradar from the terminal:
sudo docker run \
-v /tmp/thumbs:/tmp/thumbs \
-e CAMERAS_PORTS=your_ports \
-e CAMERAS_SUBNETWORKS=your_subnetwork \
ullaakut/cameradar:tag

The arguments of the above command is explained below:
tmp/thumbs - path to the saved thumbnails

CAMERAS_SUBNETWORKS - a subnet (e.g.: 172.16.100.0/24) or even an IP (e.g.: 172.16.100.10).
CAMERAS_PORTS - a port, multiple ports and even port ranges (e.g.: 554,8554,9000-9554)
tag - lows you to specify a specific version for cameradar.

After a successful scan and brute force the generated thumbnails will be in /tmp/thumbs on your machine and in the container. The results would be outputted in JSON objects like:
{
"address" : "127.0.0.1",
"ids_found" : true
"password" : "123456",
"path_found" : true,
"port" : 554,
"product" : "Vivotek FD9381-HTV",
"protocol" : "tcp",
"route" : "/live.sdp",
"service_name" : "rtsp",
"state" : "open",
"thumbnail_path" : "/tmp/thumbs/127.0.0.1/1234567.jpg",
"username" : "admin"
}

VLC Media Player can be used to view the RTSP live stream from Media>Stream>Network option in the this format :
username:password@address:port/route

admin:123456@127.0.0.1:554/live.sdp

Further research on the IP Cameras is ongoing, more so on how they can be used as bots.


References
https://github.com/EtixLabs/cameradar#quick-install
http://badguyfu.net/rtsp-brute-forcing-for-fun-and-naked-pictures/

[root@e13olf]# exit