Cybercriminals are attacking surveillance cameras from multiple manufacturers, leveraging two zero-day vulnerabilities to take over the endpoints, watch and manipulate the feeds, and more.
Cybersecurity researchers GreyNoise claim to have spotted the attacks after their AI-powered analysis tool Sift raised an alarm that crooks are attacking network device interface-enabled (NDI) pan-tilt-zoom (PTZ) cameras from multiple manufacturers.
The cameras can be found in different environments, including industrial and manufacturing plants, where they are used for machinery surveillance, and quality control. They can also be found in business conferences, used for high-definition video streaming and remote presentations, in healthcare (used for telehealth consultations and surgical live streams), state and local government environments, including courtrooms, and houses of worship, where they’re used for live streaming.
Waiting on patches
GreyNoise says the affected devices are typically high-cost, with some models costing several thousand dollars.
Affected devices use VHD PTZ camera firmware < 6.3.40 used in PTZOptics, Multicam Systems SAS, and SMTAV Corporation devices based on Hisilicon Hi3516A V600 SoC V60, V61, and V63.
The vulnerabilities in question are now tracked as CVE-2024-8956, and CVE-2024-8957. The former is deemed critical (9.1), and the latter high (7.2). When exploited, the vulnerabilities can be used to completely take over the cameras, view and manipulate video feeds, disable different camera operations, and assimilate the devies into a botnet.
While for some models, patches have already been released, others remain vulnerable. According to BleepingComputer,…
Read full post on Tech Radar
