Friday, November 29, 2013

Seriously Samsung? Home surveillance cameras that exposes usernames and passwords to login.

SDE-4001N
Samsung's home surveillance IP cameras (including the SDE and SDR models) must be controlled with Silverlight Internet Explorer plugins, so I decided over the Thanksgiving holiday to see whether I could study the network traffic and understand how these devices worked.  While studying some of the endpoints, I came upon this security bulletin published 3 months ago.

http://www.securityfocus.com/archive/107/528120/30/0/threaded
Samsung provides a wide range of DVR products, all working with nearly
the same firmware. The firmware it's a Linux embedded system that
expose a web interface through the lighttpd webserver and CGI pages.

The authenticated session is tracked using two cookies, called DATA1
and DATA2, containing respectively the base64 encoded username and
password. So, the first advise for the developers is to don't put the
user credentials into the cookies!

Anyway, the critical vulnerability is that in most of the CGI, the
session check is made in a wrong way, that allows to access protected
pages simply putting an arbitrary cookie into the HTTP request. Yes,
that's all.

This vulnerability allows remote unauthenticated users to:

- Get/set/delete username/password of local users (/cgi-bin/setup_user)

- Get/set DVR/Camera general configuration

- Get info about the device/storage

- Get/set the NTP server

- Get/set many other settings
It turns out that the major Samsung home surveillance DVR have this security flaw. Essentially all the username and passwords are unhashed and can be retrieved by using an arbitary cookie.   The source code that retrieves this info is included here:

http://www.andreafabrizi.it/download.php?file=samsung_dvr.py

If you want to verify whether your device is vulnerable, check out :

http://ismysamsungdvrhacked.appspot.com/ (GitHub code here)

Hoping to find that Samsung fixed the issue, I went to http://www.samsungsv.com/Support/DVRFirmwareUpdate and discovered that the firmware versions have yet to be updated.

Why does this issue matter? For one, Samsung provides a Dynamic DNS service at samsungipolis.com (i.e. http://samsungipolis.com/home1) that enables customers to have their systems devices report the IP location.  This IP address is stored by Samsung and provides a redirect to the owner's hosted cameras.

$ curl http://www.samsungipolis.com/testing
<body>

    <meta http-equiv="refresh" content="0;url=http://98.17.152.5:80"/>


</body>

In other words, all you have to do is find a name that's using Samsung's Dynamic DNS service, point the Python script at this IP, and assuming the owner has enabled remote web interface access for the user account, you can login to their service (and possibly gain admin access to make any changes).  You obviously have to use Internet Explorer to test, since the plug-ins were built in Silverlight.  (If you get a blank white screen, you're probably using a non-IE browser.)

I've sent a note to their customer support and tweeted to them about this unpatched security flaw (now going on 3 months)  If you are running one of these systems, you're best option is to disable the web interface until this flaw is patched.

Update (12/1/2013): Samsung's web site at samsungsv.com does not have the updated firmware images, but you can sign up for a free account at http://developer.samsungtechwin.com and get access to newer versions of the firmware.

For the SDE-5001 DVR device, for instance, the latest version is v1.05.  However, this last update was made on 01/2013, about a year ago, which suggests that the patch has yet to be applied.  Also, by mounting the flash image, we can also see that the binary for the cgi_login program which has this security hole does not appear to have changed since the v1.02 version.   I also checked the lighttpd configuration and did not see any differences in the files. In other words, the security flaw still seems to exist.

110 comments:

  1. Any status updates on this fix? Updated firmware? Units are out of compliance at this point, and the web server (lighttpd) must be shut down until this is fixed. Please Samsung, get this update out ASAP!

    ReplyDelete
  2. I guess there are no updates yet. I too need to know about that.
    Surveillance cameras

    ReplyDelete
  3. I only see v1.02h for the SDE-5001N, where do you see v1.05? Also, I signed up on the techwin site, but there's no firmware for any device. Do I need to request for access?

    ReplyDelete
  4. This is insane... as of 2:00PM EST 31JUL2014, the support team at Samsung TechWin told me "The developer has decided NOT to resolve this issue." Not via FW update or any other fix... they have simply said... Oh Well!!! OH HELL... This is a massive breach for any system... but it's even more egregious when you consider that it's your SECURITY system that is being breached!!! At this stage you are basically giving any novice hacker a birds eye view of your premises!!! AND the ability to LOCK YOU OUT of your own monitoring system or ERASE evidence of their criminal activity!!!

    I'm looking for a number for Samsung Corporate to demand they fix the issue, issue a refund or at least exchange the affected systems with more updated and SECURE systems from within their line.

    In the meantime... does anyone know of any other systems that can be used to work with this hardware? Maybe a non Samsung DDNS option or different remote access software? Thanks in advance

    ReplyDelete
  5. How fine of you!!!! Really awesome efforts you have shown. weatherproof security camera

    ReplyDelete
  6. Samsung's home surveillance IP cameras (including the SDE and SDR ... survalliancecameras.blogspot.com

    ReplyDelete
  7. I was searching about this issue as you have discussed very clearly and lovely manner that I don’t have to go now any other webpage. home security companies

    ReplyDelete
  8. I generally don’t comment in the Blogs but your blog is the only one that forced me to, amazing work... best home security

    ReplyDelete
  9. It turns out that the major Samsung home surveillance DVR have this ... samsungtvkamera.blogspot.de

    ReplyDelete
  10. Samsung's home surveillance IP cameras (including the SDE and SDR ... ssecuritycameras.blogspot.com

    ReplyDelete
  11. I am glad to see such amazing things at one place, how did you do this? I am still surprised.
    best home security camera system consumer reports

    ReplyDelete
  12. Hi everybody, you have done the superb job guys. I am much impressed to you!

    Thanks
    Security Cameras

    ReplyDelete
  13. So my girlfriends parents are going on vacation and they are super strict and paranoid so they are installing cameras in the house, which is weird since she is 21..... So how can we get around it, in the movies they always "loop" it but i dont know if that is possible, or what else we can do
    snooping

    ReplyDelete
  14. I truly get pleasure from while I read your blogs and its content. securiy cameras

    ReplyDelete
  15. Have you tried to get the source code? As per the back of the manual there is an "Open Source License Report" that states:
    You may
    obtain the complete Corresponding Source code from us for a period of three years after our last shipment of this
    product by sending email to help.cctv@samsung.com

    ReplyDelete
  16. Thank you so much for this great share,.It's really good,.
    CCTV Installation Brisbanee

    ReplyDelete
  17. This is surely a very good blog, thanks a lot for sharing such nice information here.
    iSpyyou

    ReplyDelete
  18. Endeavour Africa provides organizations and firms with finest quality CCTV Cameras to assist them with high end security and prevent security breaches.

    ReplyDelete
  19. I really feel good that i checkout your post and found actual info that i needed.
    ______________________________
    http://www.dynapost.com/

    ReplyDelete
  20. I want to say that this article is amazing, great written and come with approximately all vital informations. I'd like to peer more posts like this. So nice to discover someone with genuine thoughts on this issue. Wireless Camera in Lahore

    ReplyDelete
  21. Good post....thanks for sharing.. very useful for me i will bookmark this for my future needs. Thanks.
    New Branded Laptops and Desktops In Delhi

    ReplyDelete
  22. Hi guys,
    Thank you so much for this wonderful article really!
    If someone want to know more about this security cameras long island I think this is the right place for you!

    ReplyDelete
  23. Nice article as for me. It would be great to read something more concerning this theme. The only thing it would also be great to see on this blog is some pics of some gadgets.

    RFID Access Control System

    ReplyDelete
  24. You have done superb job friends. thanks you so much for this excellent post. Security Camera Installation Orlando

    ReplyDelete
  25. I am undeniably thankful to you for providing us with this invaluable related information about the security cameras.
    Handle set door locks

    ReplyDelete
  26. Great Post.. awesome.. thanks for sharing about cctv camera keep posting..

    ReplyDelete
  27. Samsung's home surveillance IP cameras (including the SDE and SDR models) must be controlled with Silverlight Internet Explorer plugins, so I decided over the Thanksgiving holiday to see whether I could study the network traffic and understand how these devices worked. While studying some of the endpoints, I came upon this security bulletin published 3 months ago.

    Oxford Security

    ReplyDelete
  28. This blog is gonna useful for ordinary people to get understand about home security systems & security products. security camera

    ReplyDelete
  29. Rewiresecurity is the most experienced body worn camera evidence solutions company in the world. Choose from our easy to use body worn spy cameras. Wearable bodyworn cameras can be a valuable tool for Law enforcement agencies - https://www.rewiresecurity.co.uk/body-worn-video-cctv-cameras-headcam



    ReplyDelete
  30. Definitely agree with what you stated. Your explanation was certainly the easiest to understand. I tell you, I usually get irked when folks discuss issues that they plainly do not know about. You managed to hit the nail right on the head and explained out everything without complication. Maybe, people can take a signal. Will likely be back to get more.

    Video Surveillance System

    ReplyDelete
  31. Really such nice article. Very interesting information sharing. Never found any where this type of article about Samsung's surveillance IP cameras and Audio and Video Integration.

    ReplyDelete
  32. This iris will open completely to allow more light and increase the depth of field to give you the most precision with your adjustments. Sydney CCTV

    ReplyDelete
  33. it is imperative that the guards always be attentive and aware of their surroundings. Smarter alarm systems

    ReplyDelete
  34. The best thing about DVR is they now have a wireless technology system, now you can monitor activity from anywhere. There are 2 major areas you need to monitor, one is office and other one is home sweet home. Automated Security Service College Station Tx 77485. is the perfect invent you need to monitor indoor or outdoor activity.

    ReplyDelete
  35. I really appreciate the efforts you put into reviewing these useful resources.

    And safety is not a privilege, it's a right, and here at SSP Australia (a leading security guards company in Melbourne Australia)
    provide professional and well experienced security services.

    ReplyDelete
  36. Nice post ! Thanks for sharing such useful stuff. Find the best DVR camera from trusted resource: china dvr manufacturer

    ReplyDelete
  37. Spot on with this article, I really think this website needs more attention. I'll probably be back to read more, thanks for the info.
    hd security cameras

    ReplyDelete
  38. I really appreciate your work especially the research part of it which made the whole point very easy to understand. The issue that you have raised through this blog "Home automation Auckland" is actually the one to think on.tandem jogging stroller

    ReplyDelete
  39. I am expecting more interesting topics from you. And this was nice content and definitely it will be useful for many people. CCTV Melbourne

    ReplyDelete
  40. Security is necessary for saving your lives.Thanks for sharing great valuable article. Its really helpful. You may also find best cctv camera Suppliers : cctv camera Suppliers

    ReplyDelete
  41. I must say this is the best post. Thankyou and have a great service related to CCTV Installation and this Advice for all affordable price.

    ReplyDelete
  42. It took significantly more activity than I had hoped before I triggered the alert. Sydney CCTV Installation

    ReplyDelete
  43. Hi Dear,

    i Like Your Blog Very Much..I see Daily Your Blog ,is A Very Usefull For me.


    You Can see also my services.....


    We offer security cameras services in London. Bison security provide latest technology HD CCTV camera In construction site, home security & fire alarms.


    Visit Now - Security cameras
    -----------

    ReplyDelete
  44. hi

    thank you for great posts and great website

    farshid ghasemi
    from imenshop CCTV company iran
    دوربین مدار بسته

    ReplyDelete
  45. I visited your blog for the first time and just been your fan and get many informative information about the security camera and I Will be back often to check up on new stuff you post well done.
    security camera

    ReplyDelete
  46. Nice Post on Survilliance Cameras. Thanks for sharing this post.

    If you want to check more details on CCTV Installation Click here CCTV Installers

    ReplyDelete
  47. Good blog,dear sir,I hope you can reviews for ELP usb camera.
    http://www.webcamerausb.com/sony-imx322-hd-usb-camera-c-37_61/
    Main point:
    1.Sony Imx 322 low illumincation image sensor
    2,New feature: H.264 compression format + low illumination
    3.1080P HD high resolution good for dark image vision It comes with sharp clear image in dark place.
    4.1280X720@ 30fps/1920X1080@ 30fps
    5.2.8-12mm lens (Customizable)

    ReplyDelete
  48. . No its not the type of hacking you may know or hear of, but it is STILL hacking. So be warned. Use this tut at your own risk.Penrith CCTV Systems

    ReplyDelete
  49. Hi Dear,

    i Like Your Blog Very Much..I see Daily Your Blog ,is A Very Useful For me.

    Visit Now - http://bisonsecurity.co.uk/testimonials/

    Hikvision Bison security provide CCTV camera system in London. We have hikvision HD CCTV camera for Security solutions are available as sale or rental packages.

    ReplyDelete
  50. that point are m every(prenominal) benefits to utilize a CCTV bail administration. If you give a commercial enterprise you adopt outing be able to propose a safer purlieu as healthy as Serious Security

    ReplyDelete
  51. I liked your blog! It is really helpful and useful. Your post covered interesting facts on security cameras. Thanks for sharing this with us.

    Surveillance Cameras Melbourne

    ReplyDelete
  52. Thank you for providing information.Here is info of another one for
    Samsung Refrigerator service Center in Hyderabad these guys are doing their job well as yours. From my personal experience I'm suggesting them. To avail there services contact info.

    electronicservicecenter
    Contact Us: 9493725242

    ReplyDelete
  53. Thank you so much for sharing such a nice and useful information with us. I liked reading you post. Keep sharing.
    Best hidden cameras

    ReplyDelete
  54. I truly value your blog and extremely decent and fascinating data about the crisis locksmith that is better than average.
    Locksmith Brisbane Southside

    ReplyDelete
  55. Wired and Wireless(802.11G built in) Networks. If you have an existing network the system is simply plug and play.
    Smarter Security

    ReplyDelete
  56. Your Post is very useful, I am truly to this blog which is specially design about the stun gun, It helped me with ocean of awareness so I really appreciate your blog.
    stun gun

    ReplyDelete
  57. Arlo security is better in comparision to other camera. Because in it lots of security features.

    ReplyDelete
  58. The information shared in the blog about the Locksmith Brisbane Northside is to a great degree respectable. If you are scanning for a full time locksmith .

    ReplyDelete
  59. Valuable information in your blog and I really appreciate your work and keep it up dude I really very informative blog about the door entry systems well done.
    door entry systems

    ReplyDelete
  60. Interesting blog..!! I will recommend to buy Security Cameras from Shipgig.

    ReplyDelete
  61. This blog have a very interesting and so helpful information about the security camera well done.
    alarme maison

    ReplyDelete
  62. I was really want to get some more detail and information about the camera and security but your blog helped me so much thank you for sharing it.
    alarme maison

    ReplyDelete
  63. Valuable information in your blog and I really appreciate your work and keep it up dude I really very informative blog about the Alarm Monitoring keep posting.
    Alarm Monitoring

    ReplyDelete
  64. Thank you so much for sharing this great blog.Very inspiring and helpful too.Hope you continue to share more of your ideas.I will definitely love to read.
    best security cameras

    ReplyDelete
  65. Found your blog. Its really valuable for security camera. I appreciate your article. Its important for ge good informations on security camera. So thanks for sharing all that important information.

    ReplyDelete
  66. Thanks for posting the useful information to my vision. This is excellent information,.
    road spike system

    ReplyDelete
  67. This is a good post. Really it’s very informative and creative blog. This concept is a good way to provide the information about manages the username and password of surveillance camera. I like it and help me to development very good. Thank you for this brief explanation and very nice information.
    Thanks and Regards,
    Jordan Caver
    Home Theater Vancouver
    Home Theater Toronto

    ReplyDelete
  68. Companies including Tesla also arrive with fairly generous battery warranties and might replace at no charge. For more information on Locksmith brisbane read here.

    ReplyDelete
  69. Lắp đặt camera quan sát lắp đặt camera wifi giá rẻ
    https://cameraquansatdanang.com/

    ReplyDelete
  70. The current systems are great but there would be much better results if we embraced smarter solutions like
    https://finclock.com/staff-management/

    ReplyDelete
  71. smart watches for sale

    https://everydaytechshop.com/product-category/smart-watches/

    Buy Smart Watches Online for low prices, we offer the best Smart Watches for sale online. Find the best Smart Watches online at EverydayTechShop and shop with the lowest prices.

    ReplyDelete
  72. Very informative and creative content. This concept is a good way to enhance the knowledge.thanks for sharing
    IP Camera Singapore

    ReplyDelete
  73. Nice blog..! I really loved reading through this article. Thanks for sharing such a amazing post with us and keep blogging...
    meshsecuritysystem
    security systems for house

    ReplyDelete
  74. security cameras for sale

    Shop our wide range of security cameras from EverydayTechShop, We offer the best online security cameras for sale at affordable prices. Contact us now.

    to get more - https://everydaytechshop.com/product-category/security-systems//

    ReplyDelete
  75. IFB machine Service Center in Hyderabad
    A microwave oven is a kitchen appliance which helps to reheat the food and we can cook a variety of types of foods. They ar e three kinds of microwave ovens they are solo, grill, and convection. With a microwave oven, we can make different kinds of food items like cakes, chocolate, chicken and meat, etc. Microwave ovens are typically more different appliances


    IFB Microwave Oven Service Center in Hyderabad
    The direct heat of other types of kitchen appliance can heat the surface while the inside stays cold. In a microwave oven, the food cooks for much less time than in a conventional oven or on a stove.


    IFB Microwave Oven Service Center in Hyderabad
    Nowadays usage of microwave oven is more in this busy schedule people are busy in going jobs so they don’t have a time to cook the food. But in these with microwave oven we can reheat the food cook the food faster. We can make different kinds of varieties in microwave oven so usage of microwave oven is more. IFB Microwave oven service center in Hyderabad. If you have any issues in your product there is no heating, microwave oven door not opening, display not working, and our professionals to your home itself we are one of the trusted companies for IFB service center in all areas

    ReplyDelete
  76. samsung washing machine repair center in secunderabad Our experts will go to the doorstep and fix or resolve our things before customers in a manner of speaking. Whirlpool garments washer organization center in Hyderabad If your garments washer unexpectedly starts to exhaust progressively and you start to separate additional water in the machine after a cycle then it likely won't be as critical as it looks.
    Samsung Washing Machine Repair Service Center in Secunderabad Our specialists are 10 years experienced up-and-comers in our organization network. They can sort out any issues that appear in our home mechanical assemblies. Our organization is open 24*7. We are there for any time if you need to just call us and loosen up about the issue of the thing. Your consequence of our obligation.
    Samsung Ac Service center in Hyderabad We give you ace support to cover you for any result at home. So you by and by don't have to worry about voltage spikes or unbalanced cooling or whatever else that you don't wish to stress over. Samsung Air Conditioner fixes and an advantage in Hyderabad

    ReplyDelete
  77. samsung washing machine repair center in secunderabad Our experts will go to the doorstep and fix or resolve our things before customers in a manner of speaking. Whirlpool garments washer organization center in Hyderabad If your garments washer unexpectedly starts to exhaust progressively and you start to separate additional water in the machine after a cycle then it likely won't be as critical as it looks.
    Samsung Washing Machine Repair Service Center in Secunderabad Our specialists are 10 years experienced up-and-comers in our organization network. They can sort out any issues that appear in our home mechanical assemblies. Our organization is open 24*7. We are there for any time if you need to just call us and loosen up about the issue of the thing. Your consequence of our obligation.
    Samsung Ac Service center in Hyderabad We give you ace support to cover you for any result at home. So you by and by don't have to worry about voltage spikes or unbalanced cooling or whatever else that you don't wish to stress over. Samsung Air Conditioner fixes and an advantage in Hyderabad

    ReplyDelete
  78. Samsung Washing Machine Repair Service Center in Secunderabad We use to attempt the administration for not exactly out of guarantee items and furthermore, our experts need to take just 350/ - Yet, for your washer, if any extra parts may get any harm it takes an extra sum. So rush up no had the opportunity to stress simply settle on a decision and acquire the least difficult assistance at the doorstep.

    Samsung Ac Service center in Hyderabad A washer is included with the clock and kind of cycle. On the off chance that we have a greater heap of articles of clothing, at that point we will choose the bigger wash cycle. In a similar way, we will choose the customary burden for a restricted burden. The technique for washing garments utilizing the washer is incredibly simple. Samsung Washing Machine Customer Care in Hyderabad

    ReplyDelete
  79. Samsung AC Service Center in Secunderabad Here all types of Samsung air conditioners servicing like, split ac, duct ac, window ac. Our team comprises the best technicians in this field and they are well trained for technical competence. If you’re air conditioner troubles you call us we will send our technicians to your house. We respond within 24 hours at meanwhile our professionals will call you within a short period of time. We do service for all brands of air conditioners. And we use quality spare parts
    Samsung Air Conditioner Service Center in Pragnapur Secunderabad We are the best Samsung air conditioner in Worli Mumbai. We are well experienced provides to technicians there are few troubles in your air conditioner our technician can help your all home appliance products they will solve all issues in few minutes air conditioner common problems they are, water leak, fan failure. Our technicians are solved very easily your products. We provide 1-month general service warranty and 3 months warranty, our service center available 24/7 hours.
    Samsung AC Repair Service Center in Secunderabad We are providing the best Samsung microwave oven service center in Mumbai Maharashtra. A microwave oven is used to heat the food and decrease the development of bacteria. Our technicians are specialists in repair at your doorstep. Our technicians can solve and fix your problems within 24 hours. We are providing our technicians in all areas in Mumbai. Samsung microwave oven service center is the best and perfect service center for customers.

    ReplyDelete
  80. Get the best Asset Management software in Kenya AsseTrack FAMS is a web based asset management system designed for the efficient management of any company’s fixed assets.

    ReplyDelete
  81. Thanks for sharing a nice post with us. Keep posting informative piece of writing.

    ReplyDelete
  82. Are you looking for a Samsung Washing Machine Service Center in kukatpally ? Don't waste the time on looking simply make a call to our service center in kukatpally? Our experts have proper knowledge in repairing the Samsung Washing Machine with genuine spare parts.
    Our technicians will analyse the issue in your product and offer the best Samsung Washing Machine Service Center in kukatpally and it is one of the best and biggest trusted names in the home appliances.

    Samsung Washing Machine Service Center in Madhapur



    Contact Us Phone No: +91 889 633 9999
    Official Website: https://www.sam-sungservicecustomercare.com/

    ReplyDelete
  83. i think CCTV camera is getting popular day by day, because any one can quickly point out, what actually happened

    ReplyDelete
  84. Hikvision gives you a much needed security products including Smart home tech, industrial automation and powerful business intelligence for end users. Rhodium security is a trusted partner for Hikvision cameras for your safety and security to your loved ones.
    Hikvision Security cameras melbourne

    ReplyDelete
  85. Are you looking to hire home camera installation services at reasonable prices? You must check out Touchtec, we have a flexible solution for your home security and provide the best HD Cctv camera, home security cameras. Visit our website to get to know more about us.

    ReplyDelete
  86. Wow, this is perfect security checking tips. To know which device is vulnerable these is useful technique. Thanks.
    security company columbus ohio

    ReplyDelete
  87. Very Nice Blog! it is very informative blog. Efficient Systems provide high-quality IP based office security cameras, CCTV cameras, and other surveillance systems at the best price.


    ReplyDelete
  88. Are you looking to buy a fit pro cold press slow juicer at the best prices with quality then visit Kenstar India

    ReplyDelete
  89. This comment has been removed by the author.

    ReplyDelete