Hackers are targeting security flaws in CCTV cameras, so be on your guard | TechRadar

Nov 02, 2024

Multiple cameras have zero-days that can leak live footage

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Cybercriminals are attacking surveillance cameras from multiple manufacturers, leveraging two zero-day vulnerabilities to take over the endpoints, watch and manipulate the feeds, and more.

Cybersecurity researchers GreyNoise claim to have spotted the attacks after their AI-powered analysis tool Sift raised an alarm that crooks are attacking network device interface-enabled (NDI) pan-tilt-zoom (PTZ) cameras from multiple manufacturers.

The cameras can be found in different environments, including industrial and manufacturing plants, where they are used for machinery surveillance, and quality control. They can also be found in business conferences, used for high-definition video streaming and remote presentations, in healthcare (used for telehealth consultations and surgical live streams), state and local government environments, including courtrooms, and houses of worship, where they’re used for live streaming.

GreyNoise says the affected devices are typically high-cost, with some models costing several thousand dollars.

Affected devices use VHD PTZ camera firmware < 6.3.40 used in PTZOptics, Multicam Systems SAS, and SMTAV Corporation devices based on Hisilicon Hi3516A V600 SoC V60, V61, and V63.

The vulnerabilities in question are now tracked as CVE-2024-8956, and CVE-2024-8957. The former is deemed critical (9.1), and the latter high (7.2). When exploited, the vulnerabilities can be used to completely take over the cameras, view and manipulate video feeds, disable different camera operations, and assimilate the devies into a botnet.

While for some models, patches have already been released, others remain vulnerable. According to BleepingComputer, PTZOptics released a security update on September 17, but since multiple models reached end-of-life status (PT20X-NDI-G2 and PT12X-NDI-G2) not all were patched. Furthermore, PT20X-SE-NDI-G3, and PT30X-SE-NDI-G3 are still pending a fix.

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Chances are, the list of affected models is a lot longer than what the researchers determined at this time. Users are advised to check with their manufacturer if they’ve released a fix for the abovementioned flaws.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

More and more small businesses are being hit with security attacks — but they're fighting back

Worrying WordPress plugin security flaw could let hackers hijack your site

Surfshark launches Bypasser for its iPhone VPN app