Cybersecurity firm Nozomi Networks recently revealed it had discovered a new vulnerability affecting the implementation of an Open Network Video Interface Forum (ONVIF) authentication mechanism in some IP cameras developed by Dahua Technology.
According to a blog post by the cyber experts, this vulnerability could be abused by attackers to compromise Dahua network cameras by sniffing a previous unencrypted ONVIF interaction and replaying the credentials in a new request towards the camera.
ONVIF is an open industry forum that provides and promotes standardized interfaces for effective interoperability of IP-based physical security products.
In order to communicate between products, ONVIF sends requests through XML SOAP messages via HTTP. One authentication mechanism ONVIF uses is WS-UsernameToken, which relies on the transmission of the username for a certified user, nonce (a random, unique number generated by a client), created (the UtcTime when the request is made) and a password to authenticate a request.
In its investigation, Nozomi Networks was able to forge a CreateUsers request to be added to an IPC-HDBW2231E-S-S2 dome network camera as an attacker-controlled administrator. It was then able to sniff an unencrypted ONVIF request authenticated with the WS-UsernameToken schema.
After creating the attacker-controlled administrator, researchers were able to use the account to access the Dahua device with full privileges, including watching live footage from the camera.
The firm says sniffing an unencrypted ONVIF request authenticated with the WS-UsernameToken schema is not an uncommon condition due to the following reasons:
- WS-UsernameToken is still used by default by many popular ONVIF clients, such as ONVIF Device Manager, or DSE VMS.
- By default, the IPC-HDBW2231E-S-S2 (like other Dahua devices) does not expose an HTTPS service, and all ONVIF interactions occur through unencrypted HTTP.
Nozomi Networks says in the real world, asset owners should not using the default WS credentials and use HTTPS for secure connections in order to prevent such an attack from occurring.
Upon notification of the vulnerability, Dahua released a patch at the end of June. When reached for comment, Dahua told SSI, “On 6-28-22 we released a security notice, which you can find here. As of today (1 August) Dahua has released firmware patches that address these vulnerabilities.”
This article originally appeared on MyTechDecisions’ sister-site Security Sales & Integration.
Leave a Reply