Patch Now: Axis Cameras’ Flaws Could Give Attackers Control

Security researchers disclosed seven vulnerabilities in the firmware of 390 models of Axis IP cameras that threat actors can exploit to gain full control to video streams and software, render the device useless, use as an entry point for network infiltration, or use for other attacks such as distributed denial of service (DDoS). The manufacturer released solutions for these flaws after being notified, and users of the identified models should update their firmware as soon as possible.

[Read: A look into the most noteworthy home network security threats of 2017]

Researchers notified Axis Communications of the vulnerabilities after examining a number of Internet of Things (IoT) flaws affecting consumer and commercial products, including zero-day vulnerabilities. Using three of the flaws in sequence allows remote access for shell commands with root privileges, as well as other controls with accompanying proofs-of-concept (POCs) for the following:

• Access to real-time video stream
• Freeze the video stream
• Control direction and activate/deactivate motion detection
• Add to a botnet
• Alter the software
• Perform lateral movement after network infiltration
• Render it useless
• Perform other malicious tasks such as cryptocurrency mining and DDOs attacks

[Read: Tech support for the Internet of Things]

The researchers add that none of the flaws have been exploited in the wild, but warn that the company’s customers should immediately update their firmware to protect their systems. Axis’ presence spans more than 150 countries and offers IP cameras in public and private spaces such as casinos, banks, prisons, and transportation systems.

This report adds to a growing list of IoT concerns. Here are a few ways to mitigate these risks:

• Regularly download patches and updates released by legitimate vendors and your devices’ manufacturers.
• Change default credentials set by the manufacturers, use strong passwords and frequently change them to reduce possible unauthorized access by outsiders.
• Familiarize yourself with the features of your IoT device. Choose devices with secure infrastructure reputation from trustworthy vendors.

[Read: Ensuring IoT security for IP cameras]