Hacker News Reader

Comment by fanzhang | Hacker News Reader

How would the malware even know that the camera was connected in? Especially if you're on a home network (which is firewalled / has NAT on).

I suspect that it must be the central server that this camera reports to that is infected, either directly, or indirectly with some program sitting at a nearby router listening for traffic.

View on HN

Because the camera requests port forwarding from your firewall using UPnP. Now your mobile app connects directly to port 83785 and streams video from the camera without any firewall hassles. The problem now is that hackers can also connect to port 83785 and exploit unpatched security holes.

If a firmware update exists, its probably too technically challenging for Joe User to find and install. For a lot of these devices, there isn't even a published fix. These manufacturers are just rebranding some generic camera from a larger manufacturer or using the same camera and IoT guts and putting them into different cases. These companies probably don't even have a software developer on staff who has access to these firmwares, just perhaps a binary blob, assuming they have any software people on staff at all.

so are you stating the hacker was notified, or was the hacker polling to check the port?

They're just mass scanning for known IoT ports. UPnP opens up the port for everyone. My port number is an example. This blogger found his camera opening up port 80 via UPnP:

https://www.pentestpartners.com/blog/hacking-the-aldi-ip-cct...

Also Brian Krebs examined that Foscam camera and found it enabled a P2P protocol and opened a port on the firewall using UPnP as well:

https://krebsonsecurity.com/2016/02/this-is-why-people-fear-...

Polling sounds the most likely. Note that previously compromised cameras can be used to perform tasks such as port scanning other IP addresses. They can also be used to compromise other devices in the home network.

I don't believe you could download and install a firmware update in those 2 minutes.

If you knew about the risk, you would have secured your router firewall. If you did not know, you wouldn't be rushing to install the firmware.

Once the camera is compromised, it can modify the firmware being transmitted (to compromise it) or prevent its install.

If you knew about the risk, you would have secured your router firewall

I suppose there's a follow-up story to be had on routers that come with UPNP enabled by default, because wherever that's the case, your firewall has a hole poked in it as soon as the device powers up and connects to the LAN.

Assuming the router is somehow allowing NAT punctures or port forwarding, or if there is no router, then any easily compromised device will be compromised within 5 minutes of connecting it to the Internet.

Usually much less than 5 minutes. There's just that much Internet scanning.

If NAT is configured properly, then there is no risk.

Reply on news.ycombinator.com