A supply-chain component contains a critical impact vulnerability that allows a remote attacker to eavesdrop on IoT camera feeds. CVE-2021-32934 has a CVSS score of 9.1, it was introduced through ThroughTek, a component that is commonplace in CCTV systems along with other connected camera devices such as baby monitors.
ThroughTek’s point-to-point (P2P) software development kit (SDK) is installed on millions of connected devices and is used to provide remote access to audio and video streams.
Local devices communicate with offsite p2p servers through a software client, in the form of a mobile or desktop application. It is here that researchers from Nozomi found an insecure cryptographic key exchange relying on security through obscurity to hide a fixed key.
This makes it easier for an attacker to intercept packets, dissect the key and reconstruct audio and video streams.
For enterprises and critical infrastructure operators, sensitive business data, employee information, trade secrets and building layouts useful for physical attacks can be disclosed unwittingly to an attacker. For home users, a breach of privacy is their top concern.
Whilst patches have been released for SDK components, end-users will be forced to rely on the camera and IoT manufacturers to install the updates server-side – ThroughTek’s vendor partners are not public.
Affected versions of ThroughTek include:
The following remediation must be applied as soon as possible:
Source: CISA
Introducing ISO 42001 – the world’s first international management system standard focused specifically on AI.…
Data breaches and cyberattacks have become daily concerns for information security professionals and business leaders.…
It is an undeniable fact that all applications and infrastructures are essentially in need of…
