Cybercriminals are attacking surveillance cameras from multiple manufacturers, leveraging two zero-day vulnerabilities to take over the endpoints, watch and manipulate the feeds, and more.
Cybersecurity researchers GreyNoise claim to have spotted the attacks after their AI-powered analysis tool Sift raised an alarm that crooks are attacking network device interface-enabled (NDI) pan-tilt-zoom (PTZ) cameras from multiple manufacturers.
The cameras can be found in different environments, including industrial and manufacturing plants, where they are used for machinery surveillance, and quality control. They can also be found in business conferences, used for high-definition video streaming and remote presentations, in healthcare (used for telehealth consultations and surgical live streams), state and local government environments, including courtrooms, and houses of worship, where they’re used for live streaming.
Waiting on patches
GreyNoise says the affected devices are typically high-cost, with some models costing several thousand dollars.
Affected devices use VHD PTZ camera firmware < 6.3.40 used in PTZOptics, Multicam Systems SAS, and SMTAV Corporation devices based on Hisilicon Hi3516A V600 SoC V60, V61, and V63.
The vulnerabilities in question are now tracked as CVE-2024-8956, and CVE-2024-8957. The former is deemed critical (9.1), and the latter high (7.2). When exploited, the vulnerabilities can be used to completely take over the cameras, view and manipulate video feeds, disable different camera operations, and assimilate the devies into a botnet.
While for some models, patches have already been released, others remain vulnerable. According to BleepingComputer, PTZOptics released a security update on September 17, but since multiple models reached end-of-life status (PT20X-NDI-G2 and PT12X-NDI-G2) not all were patched. Furthermore, PT20X-SE-NDI-G3, and PT30X-SE-NDI-G3 are still pending a fix.
Chances are, the list of affected models is a lot longer than what the researchers determined at this time. Users are advised to check with their manufacturer if they’ve released a fix for the abovementioned flaws.
