FICS' System to Detect Compromised Hardware

The Florida Institute for Cybersecurity Research (FICS), the same group who developed the "Skim Reaper" (#SkimReaper) a device that can detect payment card skimmers, has engineered a semi-automated system to detect other kinds of subverted hardware like the servers purchased by Amazon, Apple, and others from Super Micro alleged to be compromised by a rice-sized Chinese micro-chip used to spy on the equipment.

According to Mark M. Tehranipoor, the director of FICS and an IEEE Fellow, his institute's system uses "optical scans, microscopy, X-ray tomography, and artificial intelligence to compare a printed circuit board and its chips and components with the intended design."

A semiautomated system built by the Florida Institute for Cybersecurity Research can detect illicit chips and other modifications made by a manufacturer that weren’t part of the original design. https://t.co/4zVEpNvs1g pic.twitter.com/jT9ZtMwRki

— IEEE Spectrum (@IEEESpectrum) October 5, 2018

Peekaboo

Taiwanese based-company NUUO who makes camera firmware has recently issued a patch for a zero-day vulnerability named Peekaboo (CVE-2018-1149, CVE-2018-1150) that exploits IoT video recorder software. The vulnerability was discovered by Jacob Baines, a senior research engineer at Tenable. From Tenable's blog on CVE-2018-1150 specifically:

If a file named /tmp/moses exists, the backdoor is enabled. It permits the listing of all user accounts on a system, and allows someone to change any account’s password. This would, for example, permit an attacker to view the camera feeds, view CCTV recordings, or remove a camera from the system entirely. This vulnerability has a CVSSv2 Base Score of 4.0 and a Temporal Score of 3.2, and is rated Medium severity. 

This is a very odd artifact. We weren’t able to determine if it’s leftover development code or if it was maliciously added. To be able to activate and utilize the backdoor, an attacker would need to be able to create the file “/tmp/moses,” so the attack would require some form of access or need to be combined with another exploit. Its existence and lack of obfuscation in the code is the real mystery.

Bleeping Computer article.

#TenableResearch has discovered a critical vulnerability named Peekaboo permitting RCE in IoT network video recorders for video surveillance systems. Learn more on the blog: https://t.co/a1O3GyLQCB

— Tenable (@TenableSecurity) September 21, 2018