Carding Forum
Professional
- Messages
- 2,788
- Reaction score
- 1,198
- Points
- 113
The researchers warned that the patches do not solve the problem.
Check Point Research has identified a serious vulnerability affecting over 20,000 Ubiquiti devices connected to the Internet. The breach gives attackers access to the owners ' personal data.
Popular Ubiquiti G4 Instant Wi-Fi cameras and Cloud Key+devices were at risk. The root of the problem lies in two privileged processes that have become accessible via the network interface. Unprotected ports 10001 and 7004 work via UDP (User Datagram Protocol) — one of the key communication protocols.
The scale of the problem is so great that some hacked devices already have alarm messages like "HACKED-ROUTER-HELP-SOS-DEFAULT-PASSWORD" (The router is hacked, help, the default password is set).
The study found that vulnerable devices reveal a variety of information, from platform names and software versions to configured IP addresses. This information is a tasty morsel for attackers planning, for example, attacks using social engineering methods.
It is noteworthy that the discovered vulnerability is not new. Back in 2019, it was used to conduct denial-of-service (DoS) attacks on Ubiquiti devices. Then Rapid7 specialists counted almost half a million vulnerable devices. Despite the patches released since then, the problem, as it turned out, has not yet been completely resolved.
Check Point Research experts conducted an experiment by sending fake packets to detect devices on their test network. Both the G4 camera and the CK+ device responded to these packets, confirming the researchers concerns. A spot check showed that more than 20,000 devices on the Internet, probably not updated, also respond to fake requests.
Decoding the hostnames revealed detailed information about the devices, including the owners names and their location. Other vulnerable models included the NanoStation Loco M2 and AirGrid M5 HP. The information received about the owners included full names, company names, and addresses.
Although Ubiquiti previously released a patch to fix the vulnerability and stated that devices with the latest firmware respond only to internal IP addresses, Check Point experts note that even simple errors can remain serious attack vectors for years.
Fixes for IoT devices are slow to spread, and some users never update their systems at all. Therefore, it is critical to develop IoT devices with security principles in mind and build in mechanisms to protect against exploits and malware at the earliest stages.
Device owners are advised to check whether the latest firmware version is installed on their cameras and other gadgets.
Source
Check Point Research has identified a serious vulnerability affecting over 20,000 Ubiquiti devices connected to the Internet. The breach gives attackers access to the owners ' personal data.
Popular Ubiquiti G4 Instant Wi-Fi cameras and Cloud Key+devices were at risk. The root of the problem lies in two privileged processes that have become accessible via the network interface. Unprotected ports 10001 and 7004 work via UDP (User Datagram Protocol) — one of the key communication protocols.
The scale of the problem is so great that some hacked devices already have alarm messages like "HACKED-ROUTER-HELP-SOS-DEFAULT-PASSWORD" (The router is hacked, help, the default password is set).
The study found that vulnerable devices reveal a variety of information, from platform names and software versions to configured IP addresses. This information is a tasty morsel for attackers planning, for example, attacks using social engineering methods.
It is noteworthy that the discovered vulnerability is not new. Back in 2019, it was used to conduct denial-of-service (DoS) attacks on Ubiquiti devices. Then Rapid7 specialists counted almost half a million vulnerable devices. Despite the patches released since then, the problem, as it turned out, has not yet been completely resolved.
Check Point Research experts conducted an experiment by sending fake packets to detect devices on their test network. Both the G4 camera and the CK+ device responded to these packets, confirming the researchers concerns. A spot check showed that more than 20,000 devices on the Internet, probably not updated, also respond to fake requests.
Decoding the hostnames revealed detailed information about the devices, including the owners names and their location. Other vulnerable models included the NanoStation Loco M2 and AirGrid M5 HP. The information received about the owners included full names, company names, and addresses.
Although Ubiquiti previously released a patch to fix the vulnerability and stated that devices with the latest firmware respond only to internal IP addresses, Check Point experts note that even simple errors can remain serious attack vectors for years.
Fixes for IoT devices are slow to spread, and some users never update their systems at all. Therefore, it is critical to develop IoT devices with security principles in mind and build in mechanisms to protect against exploits and malware at the earliest stages.
Device owners are advised to check whether the latest firmware version is installed on their cameras and other gadgets.
Source
