TrustED'16 (Workshop of ACM CCS 2016) Security of CCTV & Video - - PowerPoint PPT Presentation

▶
trusted 16 workshop of acm ccs 2016 security of cctv
SMART_READER_LITE
LIVE PREVIEW

TrustED'16 (Workshop of ACM CCS 2016) Security of CCTV & Video - - PowerPoint PPT Presentation

Sep 22, 2022 397 likes •812 views

TrustED'16 (Workshop of ACM CCS 2016) Security of CCTV & Video Surveillance Systems: Threats, Vulnerabilities, Attacks, and Mitigations Andrei Costin andrei@firmware.re Agenda Problems and Motivation Prior Work Threats,

slide-1
SLIDE 1

TrustED'16 (Workshop of ACM CCS 2016) Security of CCTV & Video Surveillance Systems: Threats, Vulnerabilities, Attacks, and Mitigations Andrei Costin andrei@firmware.re

slide-2
SLIDE 2

28th Oct 2016 Andrei Costin (andrei@firmware.re) 2

Agenda

  • Problems and Motivation
  • Prior Work
  • Threats, Attacks, Mitigations
  • Contribution Summary
  • Conclusion
  • Q&A
slide-3
SLIDE 3

28th Oct 2016 Andrei Costin (andrei@firmware.re) 3

Problems and Motivation

  • Embedded/IoT devices shown to be massively

insecure/exploitable [CZFB14] [CZF16] [CEWD16] [FZXC16]

slide-4
SLIDE 4

28th Oct 2016 Andrei Costin (andrei@firmware.re) 4

Problems and Motivation

  • Embedded/IoT devices shown to be massively

insecure/exploitable [CZFB14] [CZF16] [CEWD16] [FZXC16]

  • CCTV/VSS estimated to 245 mil. devices [IHS15]

– 20% (i.e., ~50 mil.) are IP-based

slide-5
SLIDE 5

28th Oct 2016 Andrei Costin (andrei@firmware.re) 5

Problems and Motivation

  • Embedded/IoT devices shown to be massively

insecure/exploitable [CZFB14] [CZF16] [CEWD16] [FZXC16]

  • CCTV/VSS estimated to 245 mil. devices [IHS15]

– 20% (i.e., ~50 mil.) are IP-based

  • At least 38% of CCTV/VSS/cameras shown vulnerable to

default credentials attacks [CSt10], in comparison:

– Enterprise Devices ~2%, Home Networking ~7%, Power

Management ~7%

slide-6
SLIDE 6

28th Oct 2016 Andrei Costin (andrei@firmware.re) 6

Problems and Motivation

  • 21 Sep 2016 and 21 Oct 2016
slide-7
SLIDE 7

28th Oct 2016 Andrei Costin (andrei@firmware.re) 7

Problems and Motivation

  • 21 Sep 2016 and 21 Oct 2016
slide-8
SLIDE 8

28th Oct 2016 Andrei Costin (andrei@firmware.re) 8

Problems and Motivation

  • 21 Sep 2016 and 21 Oct 2016

Source: Downdetector.com

slide-9
SLIDE 9

28th Oct 2016 Andrei Costin (andrei@firmware.re) 9

Some Observations

  • In 2013, Shodan queries for more than 1 mil. CCTV/VSS
  • nline devices [Cos13]

– https://github.com/zveriu/cctv-ddns-shodan-censys

  • http://insecam.org, 2014

– Streams data from ~100k CCTV/VSS online devices – Privacy invasion attack via default credential

vulnerability

slide-10
SLIDE 10

28th Oct 2016 Andrei Costin (andrei@firmware.re) 10

Some Observations

  • Mirai, 2016: 30k , 100k, 500k, 1500k CCTV/VSS
slide-11
SLIDE 11

28th Oct 2016 Andrei Costin (andrei@firmware.re) 11

Some Observations

  • More than 80% of devices in Mirai attack were CCTV/VSS

Source: KrebsOnSecurity.com

slide-12
SLIDE 12

28th Oct 2016 Andrei Costin (andrei@firmware.re) 12

Prior Work

  • "Security Requirements for Network CCTV" (Lee and Wan,

WAS 2010)

  • "User authentication protocol for blocking malicious user in

Network CCTV environment" (Park and Sun, ICCIT 2011)

  • "Security model for video surveillance system" (Kim and

Han, ICTC 2012)

  • “Embedded systems security: Threats, vulnerabilities, and

attack taxonomy” (Papp et al., PST 2015)

slide-13
SLIDE 13

28th Oct 2016 Andrei Costin (andrei@firmware.re) 13

Contribution Summary

  • We present a comprehensive survey of generic and

specific attacks and mitigations for VSS & CCTV systems

slide-14
SLIDE 14

28th Oct 2016 Andrei Costin (andrei@firmware.re) 14

Contribution Summary

  • We present a comprehensive survey of generic and

specific attacks and mitigations for VSS & CCTV systems

  • We discuss in-depth novel and specific attacks on VSS

and CCTV systems

slide-15
SLIDE 15

28th Oct 2016 Andrei Costin (andrei@firmware.re) 15

Contribution Summary

  • We present a comprehensive survey of generic and specific

attacks and mitigations for VSS & CCTV systems

  • We discuss in-depth novel and specific attacks on VSS and

CCTV systems

  • We propose one novel covert channel specific to CCTV

cameras (namely mechanical movement and position), and propose extensions of several existing covert channels over VSS and CCTV systems

slide-16
SLIDE 16

28th Oct 2016 Andrei Costin (andrei@firmware.re) 16

CCTV/VSS Systems

  • Simplified schematic of most CCTV/VSS systems
slide-17
SLIDE 17

28th Oct 2016 Andrei Costin (andrei@firmware.re) 17

Attack Categories

  • Software
  • Hardware/Software
  • Hardware
  • RF/Wireless
  • Optical
slide-18
SLIDE 18

28th Oct 2016 Andrei Costin (andrei@firmware.re) 18

Attack category: Software

  • Attack surfaces

– Web Interface – Other Interfaces (e.g., telnet) – Firmware Update Interface

slide-19
SLIDE 19

28th Oct 2016 Andrei Costin (andrei@firmware.re) 19

Attack category: Software

  • Attack types

– Weak/broken authentication/authorization – Insufficient transport layer protection – DoS – Command injection – XSS – CSRF – Information leakage/file disclosure – Buffer overflow – Reverse engineering upgrade – Unverified upgrade

slide-20
SLIDE 20

28th Oct 2016 Andrei Costin (andrei@firmware.re) 20

Attack category: Hardware/Software

  • Attack surfaces

– USB ports – Debug ports – Pan-Tilt-Zoom (PTZ)

slide-21
SLIDE 21

28th Oct 2016 Andrei Costin (andrei@firmware.re) 21

Attack category: Hardware/Software

  • Attack types

– TOCTTOU – Unverified upgrade – Bootloader attacks – Debug protocols attacks – Data exfiltration

slide-22
SLIDE 22

28th Oct 2016 Andrei Costin (andrei@firmware.re) 22

Attack category: RF/Wireless

  • Attack surfaces

– “Raw”/modulated RF (GHz range) – WiFi 802.11

slide-23
SLIDE 23

28th Oct 2016 Andrei Costin (andrei@firmware.re) 23

Attack category: RF/Wireless

  • Attack types

– Eavesdropping – Interference/Jamming/DoS

slide-24
SLIDE 24

28th Oct 2016 Andrei Costin (andrei@firmware.re) 24

Attack category: Optical

  • Attack surfaces

– PHY Laser – PHY Infrared – PHY LED – Visual Layer (Imagery Semantics)

slide-25
SLIDE 25

28th Oct 2016 Andrei Costin (andrei@firmware.re) 25

Attack category: Optical

  • Attack types

– Camera blinding/Dazzling/DoS – Data exfiltration – Command and control

slide-26
SLIDE 26

28th Oct 2016 Andrei Costin (andrei@firmware.re) 26

Generic attacks: Example 1

  • Weak/broken authentication or default credentials
slide-27
SLIDE 27

28th Oct 2016 Andrei Costin (andrei@firmware.re) 27

Specific attacks: Example 1

  • Data exfiltration via VisiSploit

Source: Guri et al., arXiv 1607.03946

slide-28
SLIDE 28

28th Oct 2016 Andrei Costin (andrei@firmware.re) 28

Specific attacks: Example 1

  • Data exfiltration via VisiSploit extension

Source: Guri et al., arXiv 1607.03946

slide-29
SLIDE 29

28th Oct 2016 Andrei Costin (andrei@firmware.re) 29

Specific attacks: Example 2

  • Command and control via malicious optical input

Source: [Cos13]

slide-30
SLIDE 30

28th Oct 2016 Andrei Costin (andrei@firmware.re) 30

Specific attacks: Example 2

  • Command and control via malicious optical input

Source: Mowery et al., USENIX Security 2014

slide-31
SLIDE 31

28th Oct 2016 Andrei Costin (andrei@firmware.re) 31

Specific attacks: Example 3

  • Data exfiltration via PTZ mechanics

– Similar to marshalling signals concept

Source: Langley Flying School

slide-32
SLIDE 32

28th Oct 2016 Andrei Costin (andrei@firmware.re) 32

Specific attacks: Example 3

  • Data exfiltration via PTZ mechanics

1

Camera position in normal operation Camera position data exfiltration attack

slide-33
SLIDE 33

28th Oct 2016 Andrei Costin (andrei@firmware.re) 33

Specific attacks: Example 3

  • Data exfiltration via PTZ mechanics

– More cameras = more exfiltration bandwidth

1 1

slide-34
SLIDE 34

28th Oct 2016 Andrei Costin (andrei@firmware.re) 34

Summary: Threats, Attacks, Mitigations

slide-35
SLIDE 35

28th Oct 2016 Andrei Costin (andrei@firmware.re) 35

Conclusions

  • Embedded/IoT devices represent the new powerhorse for

large-scale or sophisticated attacks

slide-36
SLIDE 36

28th Oct 2016 Andrei Costin (andrei@firmware.re) 36

Conclusions

  • Embedded/IoT devices represent the new powerhorse for

large-scale or sophisticated attacks

  • CCTV and VSS systems are particularly exposed due to

their number, ease of installation and intended functionality

– Largest Internet DDoS attack to date was run mainly

from CCTV and VSS systems

slide-37
SLIDE 37

28th Oct 2016 Andrei Costin (andrei@firmware.re) 37

Conclusions

  • Embedded/IoT devices represent the new powerhorse for

large-scale or sophisticated attacks

  • CCTV and VSS systems are particularly exposed due to

their number, ease of installation and intended functionality

– Largest Internet DDoS attack to date was run mainly

from CCTV and VSS systems

  • CCTV and VSS systems open avenues for specific attacks
slide-38
SLIDE 38

28th Oct 2016 Andrei Costin (andrei@firmware.re) 38

Conclusions

  • Embedded/IoT devices represent the new powerhorse for

large-scale or sophisticated attacks

  • CCTV and VSS systems are particularly exposed due to their

number, ease of installation and intended functionality

– Largest Internet DDoS attack to date was run mainly from

CCTV and VSS systems

  • CCTV and VSS systems open avenues for specific attacks
  • A systematic and practical approach should be taken to

securing CCTV and VSS systems

– Our paper can serve as a starting guideline and checklist

slide-39
SLIDE 39

28th Oct 2016 Andrei Costin (andrei@firmware.re) 39

Acknowledgements

  • Prof. Aurélien Francillon

– For guidance and comments during early versions of

this paper

  • Enno Rey and ERNW GmbH

– For generous support that made it possible to present

this paper and its results at TrustED’16

slide-40
SLIDE 40

28th Oct 2016 Andrei Costin (andrei@firmware.re) 40

References

  • [CZFB14] "A Large Scale Analysis of the Security of Embedded Firmwares" (Costin

et al., USENIX Security 2014)

  • [CZF16] "Automated Dynamic Firmware Analysis at Scale: A Case Study on

Embedded Web Interfaces" (Costin et al., ASIACCS 2016)

  • [CEWD16] "Towards Automated Dynamic Analysis for Linux-based Embedded

Firmware" (Chen et al., NDSS 2016)

  • [FZXC16] "Scalable Graph-based Bug Search for Firmware Images" (Feng et al.,

CCS 2016)

  • [CSt10] "A quantitative analysis of the insecurity of embedded network devices:

results of a wide-area scan" (Cui and Stolfo, ACSAC 2010)

  • [Cos13] "Poor Man's Panopticon: Mass CCTV Surveillance for the masses"

(Costin, PowerOfCommunity 2013)

  • [IHS15] IHS Video Surveillance Camera Installed Base Report – 2015
slide-41
SLIDE 41

28th Oct 2016 Andrei Costin (andrei@firmware.re) 41

Thank you!