Flaw In IoT Security Cameras Leaves Millions of Devices Open To Hackers

New submitter Aliciadivo writes: A nasty vulnerability found in Axis security cameras could allow hackers to take full control of several types of Internet of Things devices, and in some cases, software programs, too. The Senrio research team found that devices and software programs using an open source software library called gSOAP to enable their product to communicate to the internet could be affected. Stephen Ridley, founder of Senrio, said: “I bet you all these other manufacturers have the same vulnerability throughout their product lines as well. It’s a vulnerability in virtually every IoT device […] Every kind of device you can possibly think of.” A spokesperson for ONVIF, an electronics industry consortium that includes Axis and has includes some members that use gSOAP, said it has notified its members of the flaw, but it’s not “up to each member to handle this in the way they best see fit.” Also, gSOAP “is not in any way mandated by the ONVIF specifications, but as SOAP is the base for the ONVIF API, it is possible that ONVIF members would be affected.” Hundreds of thousands of devices might be affected, as a search for the term “Axis” on Shodan, an engine that scours the internet for vulnerable devices, returns around 14,000 results. You can view Senrio Labs’ video on the exploit (which they refer to as the “Devil’s Ivy Exploit”) here.


Share on Google+

Read more of this story at Slashdot.

Clip to Evernote

Leave a Reply

Your email address will not be published. Required fields are marked *