Lock It Down or Get Bricked

That explains the email from Ubiquiti on March 20th.

Ubiquiti takes network security very seriously and have fixed the authenticated command injection vulnerability for all affected products: airMAX, airGateway, TOUGHSwitch, and airFiber; please upgrade the firmware for your devices. Please update the firmware of your devices to the version listed below.
(UniFi, EdgeMAX, and AmpliFi products are not affected)

The Duke wrote:

This is an ethical mind f+*k It’s bad, but could be ultimately be a good thing. Maybe? I really don’t know how I feel about it. Probably won’t change a thing… But it may.

I agree with you Steve. If the right people heard about it and took action then it would be good, but the ones who need to know would probably not understand either the issue nor how to deal with its implications, so I agree with you it probably won’t change a thing.

Is there ever a good reason why mass market items should expose their admin interface as a default, I nearly said ever? Perhaps it should be made hard to open it up so that the user would have to search it out and be motivated enough to make some security efforts. Sadly cheap and nasty always wins. I saw that a ‘personal toy item’ had similar public facing issues, why have a camera and mike on something like that and compound the issue with an open access doorway?

That’s exactly what Hikvision kit does. You cannot use it until you’ve set a strong password.

New cameras can be attached to a DVR which then authenticates them with it’s own password, but that password is then the cameras password if you remove it from the DVR as a standalone.

A lot of the DVRs now have an Android like pattern unlock option too for local login.

It’s a huge problem. The Linux we’re talking about is imbedded and internet facing.

It’s always been a worry that the cheap end of IoT would go this way, but until relatively recently even premium kit had generic authentication credentials.

Then you get exploits in even properly locked down kit like the Ubiqiti AirMax kit used in the attacks.

Ed P wrote:

Richard, there are easy ways to fix this issue. I have seen some IoT hardware open on the set Admin password and refuse to go any further until a new Admin name and new password were set.Sadly the Chibay stuff comes with set passwords that are hard to change, and even the Raspberry Pi does not enforce security. A first log-on script could easily make that password 8+ characters including lower and upper case plus number and special character. Or ask some simple questions and tuen it into a password for the user.

Yes, I totally agree and more places and items are doing that with a one time password that only allows you to go to update, it is a pain for rushing first timers, but sensible for others. What I really quibble about is why the command interface is so easily accessed to allow ‘serious updates and modifications’ to be dropped in. I guess that there is not too much that can be done with cheap camera devices, so they do not see any point in doing a respectable job, this is the Chibay-junk marketers dream, stuff in a nut shell, all show, no go. Perhaps there is also a bit of ‘wow it works’ also involved without thinking through the constantly emerging new threat opportunities.

Edit,

I read some of the other posts, the use of SOC chips from old generations with severely limited fixed capabilities is an almost uncorrectable problem, should these devices really be let lose without some guardhouse function interfacing them to the rest of the world? Many of them are very cheap devices right out of their depth in today’s world of threat and ever changing menaces. I am starting to think that some form of minimum construction standards might been to be set as there are with electrical devices, cars, trucks, etc.

If governments cannot bring them selves to do something I can see the likes of the insurance industry starting to take a look via liability clauses and the like, do this, or introduce that and your cover is blown.

I am convinced, they are crap and for that reason I have never wanted the rubbish devices. I still wonder why so many are designed to require full internet access without thoughtful controls, They to conform not to IOT, but IDIOTIC (Internet Direct Integration of Threats Including Chaos.

Why continue to allow the sale of second rate rubbish with such known troubles for now and probably increasingly for the future?

Dave Rice wrote:

Because the people with the power to stop it are clueless about such things. Bear in mind that governments want even less security so they can protect us from pedophiles and terrorists.

Do you think that stuffing the internet full of IDIOTIC devices will help anyone including conspiracy theorists? The IDIOTIC devices are irrelevant to almost everyone, except the rubbish sellers.

However did the world manage before encrypted  from Whatcrap? Better?

The world didn’t do online banking and shopping before encryption.

Encryption units for use with voice calls are easily obtainable, both landline and mobile.

It’s another genie out of the bottle. You can force the big boys to compel via legislation, but to what end? It’d be playing whack-a-mole like so much internet related is. Making it illegal won’t stop the bad boys.