Massive security flaw in CCTV systems

[Kevin Lancaster]

Massive security flaw in CCTV systems

Over 70 CCTV vendors have white-labelled products from TVT which are vulnerable to a remote code execution attack.

 

[Petec]

Awesome article.

They killed Barnaby Jack, but there are still loads of skilled people, more than willing to expose manufacturers gross negligence.

 

[angotull]

For one thing, never use these things' cloud service. Rather assume they have bad security and take measures to use them better. I make sure mine has no access out the firewall and its certainly not exposed. I use a vpn into the firewall and access the DVr via the app through that.

I noticed early on that these things communicate with external servers even when you turn the cloud service off. Nasty little things.

 

[sajunky]

I make sure mine has no access out the firewall and its certainly not exposed. I use a vpn into the firewall and access the DVr via the app through that.

I agree. Known IP address is one way, VPN another one.
BTW, Is there any home router I can VPN in?

 

[Sinbad]

Mikrotik

 

[kianm]

TVT, which is based in China, ignored Kerner’s reports of the bug, so he publicly disclosed the issue.

Makes sense