Cracking the Victure PC420 Camera and IPC360 Platform - RCE, Unauthorized Streaming and More

Baby monitors have become essential tools for keeping an eye on kids and nannies when away. Most cameras on the market are packed with features, ranging from real-time or motion-detection recording to two-way communication and anything in between. As households get increasingly interconnected and crammed with video and audio sensors, privacy becomes more important than ever.

While looking into the Victure IPC360 Camera, we have identified several vulnerabilities that allow an outside attacker to access the camera feed or disable encryption of streams stored on the cloud. Additionally, an attacker sharing a network with the camera can enable the RTSP and ONVIF protocols or exploit a stack-based buffer overflow to completely hijack the device.

Key findings

• AWS bucket missing access control
• Camera information disclosure
• Remote control of cameras
• Local stack-based buffer overflow leading to remote code execution, described in CVE-2020-15744
• Hardcoded RTSP credentials

One platform, several vulnerabilities

The Victure IPC360 cloud platform allows querying arbitrary user accounts without authentication.

The identifiers for the user accounts are simple numbers between 1.000.000 and 60.000.000 and are assigned incrementally (thus easy to predict) for each user. The numbers are split in ranges for each geographical region. Querying a user ID (again, no authentication needed) returns a reply from the platform with full details of that account, including the identifiers for devices associated. With that information, an attacker can access the devices of all users. Based on the user IDs we received while testing, we estimate the number of potentially affected victims at roughly 4.000.000

The IPC360 cloud platform serves several other camera models, such as the Mibao Wireless IP Outdoor Camera, the Akaso P50 and the Robicam Waterproof 360. We estimate that these vulnerabilities are affecting more than 4 million devices worldwide.

Our researchers are regularly inspecting IoT devices and platforms to identify vulnerabilities and develop new mitigations in the Bitdefender IoT Security Platform.

Download the whitepaper here