Tenable Research Advisory: Peekaboo Critical Vulnerability in NUUO Network Video Recorder

save
Share and earn Cybytes
Facebook Twitter Google+ LinkedIn Email

Tenable Research has discovered a critical vulnerability named Peekaboo permitting remote code execution in IoT network video recorders for video surveillance systems that would allow attackers to remotely view feeds and tamper with recordings.

Tenable Research discovered two vulnerabilities in NUUO’s Network Video Recorder software. The first is a critical unauthenticated stack buffer overflow and the second is a backdoor in leftover debug code. These vulnerabilities were assessed and tested in the NVRMini2, a network-attached storage device and network video recorder.

What you need to know? Tenable Research has found a critical remote code execution vulnerability called Peekaboo in NUUO’s NVRMini2 software that an attacker can exploit to fully compromise the system.

What’s the attack vector? The web service is vulnerable to a stack buffer overflow that can be exploited remotely by an unauthenticated attacker.

What’s the business impact? An attacker can gain full system access, giving them control over and access to attached camera feeds and recordings. In addition, access credentials for connected cameras can be read in cleartext.

What’s the solution? Urgently apply the update from NUUO.

Background

NUUO offers closed-circuit television (CCTV), surveillance and video software and hardware. NUUO software and devices are commonly used for web-based video monitoring and surveillance in industries such as retail, transportation, education, government and banking. The vulnerable device, NVRMini2, is a network-attached storage device and network video recorder. Multiple camera feeds can be viewed and recorded simultaneously.

More interestingly, NUUO OEMs and whitelabels its software to third-party vendors. The full list of affected third-party vendors is currently unknown.

CVE-2018-1149: Peekaboo Unauthenticated Stack Buffer Overflow

Analysis

We found an unauthenticated stack buffer overflow (CWE-121) permitting remote code execution. This vulnerability has a CVSSv2 Base score of 10.0 and a Temporal Score of 8.6; it’s rated as Critical severity.

The NVRMini2 uses an open-source web server that supports some executable binaries via the common gateway interface (CGI) protocol. One of the CGI binaries that can be executed on the NVRMini2 is ‘cgi_system’ and it can be accessed via http://x.x.x.x/cgi-bin/cgi_system. This binary handles a variety of commands and actions that require the user be authenticated.

During authentication, the cookie parameter’s session ID size isn’t checked, which allows for a stack buffer overflow in the sprintf function. This vulnerability allows for remote code execution with “root” or administrator privileges.

Proof of concept

Jacob Baines, senior research engineer at Tenable, developed an exploit to demonstrate how this vulnerability might be leveraged to take over the NVRMini2 and manipulate connected cameras.

CVE-2018-1150: The Mystery of the Backdoor

We also found a backdoor in some leftover debug code.

<pre>
if (file_exists(constant("MOSES_FILE"))) //back door
{
update_session();
return 0;
} </pre>

If a file named /tmp/moses exists, the backdoor is enabled. It permits the listing of all user accounts on a system, and allows someone to change any account’s password. This would, for example, permit an attacker to view the camera feeds, view CCTV recordings, or remove a camera from the system entirely. This vulnerability has a CVSSv2 Base Score of 4.0 and a Temporal Score of 3.2, and is rated Medium severity.

This is a very odd artifact. We weren’t able to determine if it’s leftover development code or if it was maliciously added. To be able to activate and utilize the backdoor, an attacker would need to be able to create the file “/tmp/moses,” so the attack would require some form of access or need to be combined with another exploit. Its existence and lack of obfuscation in the code is the real mystery.

Business impact

NUUO is a global leader in the video surveillance industry and these devices are widely deployed with more than 100,000 installations worldwide. Their software is also OEM’d and integrated in third-party surveillance system deployments by a wide variety of technology and system integration partners. With any NVRMini2 instance able to manage up to 16 connected CCTV cameras, the count of indirectly exposed devices is potentially in the hundreds of thousands.

The remote code execution vulnerability especially is of particular concern. Once exploited, Peekaboo gives cyber criminals access to the control management system (CMS), exposing the credentials for all connected CCTV cameras. Using root access on the NVRMini2 device, cyber criminals could disconnect the live feeds and tamper with security footage. For example, they could replace the live feed with a static image of the surveilled area, allowing criminals to enter the premises undetected by the cameras.

<code>
root@NVR:/NUUO/bin# cat /mtd/block4/NUUO/etc/camera.ini
[Camera01]
CameraAuto=0
ShowModelName=M3044-V
MacAddress=
OutputPinCount=0
InputPinCount=0
ManufacturerName=Axis
BrandName=Axis
Protocol=3
Channel=1
ModelName=M3044-V
Manufacturer=
Brand=
Password=password1
UserName=root
Port=80
HostIP=192.168.1.183
CameraName=AXIS
</code>

Exposed CCTV Camera Credentials

Threat actors are currently actively targeting other CCTV NVRs and cameras, such as the Mirai and GafGyt malware families, which are commonly being used to compromise IoT devices. In addition, NUUO NVR devices were also specifically targeted by the Reaper IoT botnet, as we reported last year.

Solution

As of September 17 at 11 a.m. ET, a patch has not been issued. NUUO has informed Tenable that a patch is being developed and affected customers should contact NUUO for further information. In the meantime, we advise affected end users to restrict and control network access to the vulnerable devices to authorized and legitimate users only.

Identifying affected systems

Tenable has the following plugins available for identifying vulnerable assets.

Plugin ID Description
103929 NUUO NVR Web Interface Detection
117427 NUUO NVRMini2 Multiple Vulnerabilities

Additional information

Share this post and earn Cybytes
Facebook Twitter Google+ LinkedIn Email
Follow
1590 Followers
About Tenable
Tenable™, Inc. is the Cyber Exposure company. Over 24,000 organizations of all sizes around the globe rely on Tenable to manage and measure their modern attack surface to accurately understand and reduce cyber risk. As the creator of Nessus®, Tenable built its platform from the ground up to deeply understand assets, networks and vulnerabilities, extending this knowledge and expertise into Tenable.io™ to deliver the world’s first platform to provide live visibility into any asset on any computing platform. Tenable customers include over 50 percent of the Fortune 500, large government agencies and organizations across the private and public sectors. Learn more at tenable.com.
Promoted Content
Five Steps to Building a Successful Vulnerability Management Program
Is your vulnerability management program struggling? Despite proven technology solutions and the best efforts of IT teams, unresolved vulnerabilities remain an ongoing source of friction and frustration in many organizations. Regardless of how many vulnerabilities are fixed, there will always be vulnerabilities that can’t easily be remediated – and too often, finger-pointing between IT teams and business groups can ensue.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play
 

Support Cybrary

Donate Here to Get This Month's Donor Badge

 
Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?

Continue
Cancel