1

My wife and I got into a discussion about the security of our home WiFi the other day, so I have come to this discussion board to see if I am wrong about how secure I/we feel. We have your normal home WiFi that is password protected, router config page is locked down with (non-default) username/pword, upnp disabled, etc.

We have:

  • 2 foscam cameras not port forwarded (yes we know these are insecure, and that is what sparked the conversation). I created a custom webpage, hosted only on our LAN, to check video on these because we didn't want to use a 3rd party app.
  • Port forwarded items: Nest, minecraft server, Splunk server, some Steam ports, openVPN server.

My wife is worried that somehow the cameras will be hacked into (even though they aren't port forwarded) or that some of the other items that are port forwarded will be compromised. She is afraid that because we used a third party app for a while these cameras have a feed to the outside world. Should there be any concerns with these cameras residing in our home? Does having any of those other items port forwarding present a security vulnerability?

1

I don't know about this specific camera model but IoT cameras were often in the press in the last years because of the many security issues. This includes cameras from Foscam.

Not all attacks against IoT devices need direct access to the device, i.e. port forwarding through the router. Especially with CSRF attacks the browser could be used as a trampoline to hijack internal devices from outside. All you need to do is visit some site which contains malicious code to hijack the device - this could even by done by an advertisement embedded into a site with high reputation, i.e. malvertising. And if you are using google to search for IoT camera CSRF or even Foscam CSRF you get lots of hits so the risk looks real.

One of the hits you get when search for concrete vulnerabilities is probably "All your video are belong to us. The Foscam webcam" which explains how to hijack a Foscam device which is only visible in the internal network from outside via CSRF and make it upload the captured images to an external server. This should be scary enough that you don't want to have these cameras in the internal network.

And, if you consider such attacks only theoretical you might have a closer looks at reports like hijacking 4.5 million routers in brazil with CSRF. Such attacks are real and even if the attacker is not interested in getting the images taking from the camera he might be interested to use the camera to attack other systems, both in your internal network and also external systems as part of a botnet consisting of IoT cameras.

  • Thanks for a great answer, I hadn't even thought about really any of those vulnerabilities, I was looking in the completely wrong direction. We have since unplugged them. I think that even with monitoring with splunk, blocking the IP of the camera, that there are too many scenarios that I can't cover and don't know enough about. Too bad I used them for so long without looking into it :( – Orion Jun 26 '17 at 15:11
  • And maybe this is beyond the scope of your answer, but can you explain a bit more how the CSRF would work? In that article I understood that the server he stood up was inside the home network, and then was able to forward the camera data to the server. Guessing that I am wrong, can you explain how that would work in my case? – Orion Jun 26 '17 at 16:08
  • @Orion: CSRF in short: Sites can embed resources from other sites (i.e. images, iframes...). This also means an external site can embed resources from an internal site. Thus a visit of an external site could trigger a request to an internal site, like your router, camera, printer or similar devices reachable by the browser. And unless the device specifically protects against such cross-site requests this might cause unwanted actions. For more details see Understanding CSRF, the video tutorial edition. – Steffen Ullrich Jun 26 '17 at 16:35
  • Thanks for that video, it was nice to see an example in action. It seems that these cameras are far from the mark of being secure from any of these... I think that this is something that could be very well happening with these cameras, as I know for a fact that they have terrible account management (pword & uname sent in plaintext) and it sounds like videos/pics could be remotely uploaded from something so unsecure (they made the webpage config for it, who know what was done there, for all I know they ship with that hidden iframe uploading to a remote server) Again, thanks for the examples. – Orion Jun 26 '17 at 21:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.