Security flaws let anyone snoop on Guardzilla smart camera video recordings
techcrunch.com
techcrunch.com
The earliest Wayback entry I can find already has a slick site and an upcoming deal with BestBuy https://web.archive.org/web/20141217054015/https://www.guard...
The company has a very small number of employees on LinkedIn:
https://www.linkedin.com/search/results/people/?facetCurrent...
Their CTO's previous job was apparently selling phone systems:
https://www.linkedin.com/in/geoffreytruskowski/
And here's their former president, "founder, creator and driving force", whose background is all sales.
https://www.linkedin.com/in/tedsiebenman/
So at first blush this looks like a Potemkin company, a pure marketing front.
As an aside, it's my firm opinion that salespeople generally make terrible CEOs. I've heard so many horror stories. Their big skill, painting a beautiful picture for potential customers, can easily turn toxic when that is unconstrained by the parts of the organization responsible for practical realities. Was this secure? Definitely not. Did it have enough buzzwords it could be sold as secure? Sure! So ship the boxes, cash the checks, and move on. 3+ years is a great run for a scam.
DES-encrypted AWS S3 creds with unlimited access baked in. Hashcat makes short work (hours) of DES these days.
OpenSSl 1.0.1g, a rather outdated and rather vulnerable. Integer overflow, easily DOS-able, and double-free, amongst others.
And all of this with proof it works, whilst the company blusters.
> Siwak was adamant that the “accusations are false,” but did not say why.
... As far as I can tell without breaching my local laws by running the exploits... S3 hasn't revoked those keys yet, or required a more limited policy.
[0] https://www.0dayallday.org/guardzilla-video-camera-hard-code...
Is this correct?
Couldnt they just change the existing keys in AWS to be "write only" - and therefore allow a one way stream of data "in"?
That way, even with the keys, you cant actually get any existing videos, and only place new ones there?
I do this for my web application backups - my AWS keys on the server are "write only" (with no overwrite) to S3. Then, if my server was every compromised, my backups are NOT and are protected because the attackers cant get to them (to either overwrite or read the existing backup).
Although I've not tested if only having `s3:PutObject` even allows overwriting in the first place? You might not need versioning.
Also - they dont have `list` or `read` access, so they cant even see what files are there to overwrite in the first place. They might be able to guess depending on your code, but adding some random numbers and you'd be pretty safe.
Any AWS IWS experts able to confirm if `s3:PutObject` allows overwrite?
On the other hand we got bug bounties which are never paid using bullshit excuses and so you can't monetize it using white-hat ways too.
The correct solution seems to be to research distribution channels for black hat ways? Doesn't sound constructive.