{"id":4649,"date":"2024-08-05T14:51:26","date_gmt":"2024-08-05T19:51:26","guid":{"rendered":"https:\/\/www.darkreading.com\/ics-ot-security\/20k-ubiquiti-iot-cameras-and-routers-are-sitting-ducks-for-hackers"},"modified":"2024-08-05T14:51:26","modified_gmt":"2024-08-05T19:51:26","slug":"20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/08\/05\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers\/","title":{"rendered":"20K Ubiquiti IoT Cameras & Routers Are Sitting Ducks for Hackers"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

Tens of thousands of small office\/home office (SOHO) devices <\/span>sold by Ubiquiti Inc.<\/a><\/span> are vulnerable on the open Internet to a five-year-old bug, researchers are warning.<\/span><\/p>\n

In January 2019, broadband Internet <\/span>expert Jim Troutman warned<\/a><\/span> that an exposed port in dozens of Ubiquiti Internet of Things (IoT) gadgets was being exploited in denial-of-service (DoS) attacks. The underlying vulnerability, CVE-2017-0938, was assigned a “high” 7.5 score on the CVSS scale.<\/span><\/p>\n

Seven months after that, researchers from Rapid7 were still able to find <\/span>nearly 500,000 vulnerable devices<\/a><\/span>. And now, even though Ubiquiti has long since acknowledged and patched the issue, around 20,000 devices remain vulnerable, Check Point Research <\/span>noted in a new blog post<\/a><\/span>.<\/span><\/p>\n

“We can see that some of them were compromised,” says Radoslaw Madej, vulnerability research team leader at Check Point Software. “Also, I’ve only done pretty rudimentary fingerprinting of the devices. It’s quite possible that there are more of them [compromised] too.”<\/span><\/p>\n

Check Point also warned that besides being <\/span>used in a SOHO botnet<\/a><\/span> for DoS attack amplification, compromised devices can leak potentially sensitive data, too.<\/span><\/p>\n

Exposed Cameras & Routers Can Leak Data<\/h2>\n

In probing Ubiquiti gadgets like the G4 Instant Camera \u2014 an Internet-enabled camera with two-way audio \u2014 Check Point homed in on port 10001, where the exposed process was first identified five years ago. The service at issue: Ubiquiti’s discovery protocol, used to communicate between the device and its CloudKey+ controller.<\/span><\/p>\n

Using spoofed packets, the Check Point researchers discovered that communicating with neither the CloudKey+ nor its connected devices required any sort of authentication. Further, the messages they received in response to their pings included specific information about the devices, plus their owners’ names and locations.<\/span><\/p>\n

“In a few instances, actually, there was a first name and the last name of a person, and what turned out to be a location where a Ubiquiti router was located,” Madej recalls. “All this information \u2026 it took only one packet from me to receive that response.<\/span><\/p>\n

“If I wanted to attack this entity, it would be easy for me, knowing the type of router they have, the name of the person, the exact software version, and their business address. [I could] find their contact details, and call them up saying: ‘Hey, I’m calling from your Internet provider. I need to do some maintenance work. Provide me with access to the admin panel.’ Because I can validate myself to this person by giving them all the information they need.”<\/span><\/p>\n

The Issue with IoT<\/h2>\n

Patched Ubiquiti products have a safeguard against Internet-based attacks: They do not respond to pings coming from the wider Web, only from internal IP addresses.<\/span><\/p>\n

Despite the easy availability of such a simple fix, tens of thousands affected products in the wild remain unpatched. This seems to have a lot less to do with Ubiquiti itself than <\/span>IoT security in general<\/a><\/span>.<\/span><\/p>\n

“We got used to patching our Windows machines and MacBooks and mobile phones and whatnot, but we’re still not really used to the fact that we should also take care about our IoT devices, be it Wi-Fi routers, cameras, <\/span>vacuum cleaners, fridges, and washing machines<\/a><\/span>,” Madej says.<\/span><\/p>\n

“Of course,” he adds, “the question is: To what extent an end user should even be bothered about it. We live in a time when all devices should have <\/span>automatic updates enabled by default<\/a><\/span>. I don’t think that should be a concern of the end user.”<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Tens of thousands of small office\/home office (SOHO) devices sold<\/p>\n","protected":false},"author":12,"featured_media":4650,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-4649","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?fit=2560%2C1440&ssl=1",2560,1440,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?fit=2048%2C1152&ssl=1",2048,1152,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/20k-ubiquiti-iot-cameras-routers-are-sitting-ducks-for-hackers-scaled.jpg?fit=2560%2C1440&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=4649"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4649\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/4650"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=4649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=4649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=4649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}