SoylentNews is people
SoylentNews
Arthur T Knackerbracket has found the following story:
The popular Samsung SmartCam security cameras contain a critical remote code execution vulnerability that could allow hackers to gain root access and take full control of them.
The vulnerability was discovered by researchers from the hacking collective the Exploiteers (formerly GTVHacker), who have found vulnerabilities in the Samsung SmartCam devices in the past.
The flaw allows for command injection through a web script, even though the vendor has disabled the local web-based management interface in these devices.
The Samsung SmartCam is a series of cloud-enabled network security cameras that were originally developed by Samsung Techwin. Samsung sold this division to South Korean business conglomerate Hanwha Group in 2015 and the company was renamed Hanwha Techwin.
In response to vulnerabilities reported in the web-based management interface of various SmartCam models over the past few years, Hanwha Techwin decided to completely disable the local administration panel and allow users to access the cameras only through the accompanying smartphone app and its My SmartCam cloud service.
[...] While the flaw was found in the SNH-1011 model, the researchers believe that it affects the entire Samsung SmartCam series.
Ironically, the vulnerability can be exploited to turn on the disabled web-management interface, whose removal was criticized by some users. The Exploiteers published a proof-of-concept exploit that does just that. They also provided instructions on how to manually patch the flaw.
Re-enabling the web interface will allow users to monitor the camera feed via the local network again without having to use the My SmartCam service. But there's a catch: It also reactivates some of the old vulnerabilities that the vendor mitigated by simply disabling the interface in the first place.
Also covered at Ars Technica .
-- submitted from IRC
(Score: 3, Insightful) by WizardFusion on Thursday January 19 2017, @10:29AM
...cloud-enabled network security cameras...
Well, there's your problem right there.
(Score: 0) by Anonymous Coward on Thursday January 19 2017, @01:16PM
How else do you expect to offshore your security guards who watch video feeds all day and call the local cops for you. Capitalist bonus points for outsourcing labor to the local cops for free because your physical security is handled offsite.
(Score: 0) by Anonymous Coward on Thursday January 19 2017, @03:26PM
But...but...but... Internet of Shit!!!
(Score: 1) by Victa on Friday January 20 2017, @03:33AM
IoT = Internet of Turds
(Score: 0) by Anonymous Coward on Thursday January 19 2017, @03:33PM
Exactly. Allowing your lofal devices to hook into the cloud is like letting Fleece Johnson [theroot.com] into your house.
(Score: 0) by Anonymous Coward on Thursday January 19 2017, @03:46PM
Local not lofal. *facepalm*