Security bloggers have exploited a loophole in a cloud-monitoring service to break into Samsung's Smartcam security cameras, just over a year after Samsung fixed similar vulnerabilities.
Exploiteers, a white-hat hacking group with extensive experience breaking into connected home devices, detailed its new exploit in a blog post last week. By accessing php files designed to facilitate firmware updates for Smartcam devices, the hackers were able to install a remote command execution script that gave them full control of the cameras.
The vulnerability, according to Exploiteers, lies with Samsung's iWatch webcam monitoring service. The iWatch server's lax security allowed the group to install their scripts, including user-defined file names, in order to take over the cameras by gaining access to their administration panels.
As Exploiteers notes in its blog post, the group joined other white-hat hackers in exploiting a similar exploit at last year's Defcon 22 security conference. It allowed for remote command execution and the ability to arbitrarily change the camera's administrator password. Samsung removed those loopholes, and now requires all users to log in to their cameras via the more secure Smartcam web interface.
"This angered a number of users and crippled the device from being used in any DIY monitoring solutions," Exploiteers wrote. "So, we decided to audit the device once more to see if there is a way we can give users back access to their cameras while at the same time verifying the security of the devices' new firmware."
Related
- D-Link Webcams Vulnerable to HackingD-Link Webcams Vulnerable to Hacking
It's unclear whether the group's exploit affects all eight of the Smartcam models Samsung currently lists on its website. The company did not immediately respond to a request for comment.
Vulnerabilities that allow hackers to take over web-connected security cameras are not uncommon. Senrio, a private security firm, announced last summer that it had discovered a remote code execution vulnerability in D-Link's latest firmware version that could affect five cameras in the D-Link product line, including the DCS-930L Network Cloud Camera.
And live footage from more than 5,000 unsecured webcams showed up on a Russian website in 2014, a year after researchers uncovered a loophole in Apple's iSight system that allowed them to hack into some versions of MacBook laptops and iMac desktops and disable the webcam indicator LED.