Internet of Things is becoming ever more popular, and vendors seek to capitalize on that: nowadays the manufacturing process of some security cameras is more alike to that of an Internet of Things device, rather than a security device. This reckless attitude undoubtedly leads to security vulnerabilities in critical systems.
Our lead researcher Kirils Solovjovs participated in IT security conference “Cyberchess 2016” jointly organised by CERT.LV and ISACA Latvia, where he presented his research on the security of Milesight IP security cameras. Multiple major security vulnerabilities were presented (CVE-2016-2356, CVE-2016-2357, CVE-2016-2358, CVE-2016-2359, CVE-2016-2360). The presence of vulnerabilities in the wild was verified in cooperation with CERT.LV by testing a Latvian public institution with more than 100 products by this vendor.
Given that vendor is located outside EU, Kirils initiated an international responsible disclosure process, working with the vendor, CERT.LV, the public institution, the installer, HackerOne Inc., and CERT/CC.
The presentation covers the technical aspects of vulnerabilities (presented publicly for the first time), lessons learned, and recommendations to security officers and policy makers. Video recording is also available.
On 13th and 14th of October Possible Security took part in “Cyber Europe 2016” — the largest and most comprehensive EU cyber-security exercise to date. Cybersecurity authorities and cybersecurity experts from more than 300 organisations from all 28 EU Member States, Switzerland and Norway, reacted to a series of unprecedented, coordinated cyberattacks.
Exercise scenario included massive distributed denial of service attacks as well as disinformation campaign and sabotage of critical infrastructure, and featured the Internet of Things, drones, cloud computing, innovative exfiltration vectors, mobile malware, ransomware, etc.
Amongst the goals of the exercise was testing the ability of national and governmental cybersecurity agencies, ministries, EU institutions as well as internet and cloud service providers and cybersecurity service providers to safeguard the European Digital Single Market and creating recommendations to improve cybersecurity in Europe. After-action report will be made publicly available in the first half of 2017.
Exercise was organised by ENISA, the EU Agency for Network and Information Security. Possible Security is honoured to have been invited to participate in “Cyber Europe 2016” and be part of the solution together with our governmental and business partners.