How To Hack IoT Cameras - Vulnerability Demonstration

Obvious disclaimer and as mentioned in the video: Do not do this on any device you don't own! That would be illegal and could have serious consequences.

This is a recording from a lecture I gave at a Sydney Based University. In this video I demonstrated the vulnerabilities of IoT devices and how they need the same protection as any other device we expose to the internet.
Obviously to fit within a 15-minute time frame, this process is expedited, and the scanning and information gather / enumeration phases would take much longer. As well as the exploit phase could rely on a CSRF attack as opposed to a brute-force. Regardless, the aim was to demonstrate the same vulnerabilities can still be present of devices we may not expect to have them.

Links:
__________________________________________

About JSON SEC
___________________________________________
JSON SEC is a channel dedicated to helping you advance your cyber security career, whether you're on the Red Team or Blue Team side. Focusing on Training and Course reviews, exam prep guides, career guidance and advice as well as hacking tutorials.

Please consider subscribing if you enjoyed this video.

[pauljamesharper]

Great demo. The other issue with these cheap IoT devices is that the version of Linux they are often running is out of date and unpatched or unpatchable.

[psknhegemn]

Technically clear, nicely done, a touch of humor... Subscribed!

[LouiesLog]

Well done with this, it's interesting. Also nicely done with the speech! Public speaking would terrify me

[Basieeee]

Its a nice introduction to these tools, thanks dude.

[prawnstarrr]

normally the admin web interface for these platforms are vulnerable to a multitude of web based attacks ie CSRF, directory traversal file inclusion etc

[Securitybros]

Thanks! Very interesting. Many IP cameras will lock you out after a few failed attempt, making brute force not possible, correct?

[sanjupoi]

Thank you so much!!! It did work and took less than 5 minutes!

[peterjamesmontes]

THANK YOU SO MUCH I REALLY NEEDED THIS IT WORKED

[jvunein]

great hope one day ill be recognised here in kenya

[Little-bird-told-me]

very good video. Linux is everywhere. IOT device are most vulnerable nobody bothers to make them secure. I was surprised he couldn't login in with just admin/password

[VipXDevelopment]

Once a hacker has physical access to a network all bets are off, meaning you can't stop the hacker.
CCTV cameras are both inside & outside a premises therefore placing the network outside the premises & giving easy access to said hacker for a man in the middle attack.

[ashleygrady]

Hi, would you be able to help me find out who is hacking into my blink camera system?

[cytheonltd]

Join the 'Hacking IoT' online course from Digital Defense Academy. For details, please visit the link below:

Course fee: 29 GBP for enrollments till 30-Sep-2020. Join now!

[voulyful]

In order to make this step at 3:38 you have to have a connection to the network before right? So the first step would be to hack into the wifi is that correct?

[burntchickennugget]

Honestly Id be more curious on how the websites worked. How to decode and how to find the back doors without brute forceing our way in. Its interesting and helps me prepare my security systems the right way

[resurrectedChickens]

I'm a offline, hard wired, anti wireless guy.

[snakeeyes]

That´s why IoT is a big danger for everyone, so I am avoiding smart devices at any cost!

[emmetg]

what if the username isnt default like admin, how does the brute force attack proceed from there?

[naijachess]

Was the camera connected on the Sam WiFi as your laptop?

[shawnmendrek]

CCTV or die. But remember your wires can be 'modded'. I suggest anyone with CCTV check their wires to make sure it is not spliced. Jam cams are 100% real yet highly illegal, but very cheap, yes we can jam your cameras of all kinds even CCTV, make sure to do perimeter checks to make sure your cam works and it not jammed(hacked) to produce a single still frame for as long as a hacker wants.

You never know who is watching you. I suggest folk just open their eyes, if I can think it, they are probably doing it. What I said is not saying I approve of these things. It is an illegal attack on someone. But be aware, you are not secure just because you have a paid for security for the home. Nothing is 100% secure. Don't believe me? Look at them folk with security systems, gates ect and still get robbed.

Get a dog, cameras, guns, problems solved, but remember those close to you who are in good standing w/you, your dog will not bark at them if they broke in your home most likely. So...