RE: Odd Pen-test: Security Camera

["Alvin" <appredator () hotmail com>]

Usually the cameras have telnet / ftp access and usually are susceptible to
attacks in the same manner other machines are. The network cameras we
currently have have no protection against DoS or DDoS attacks and can be
knocked offline real easy. I would recommend the cameras not be setup to be
viewed by external sources such as the AXIS cameras when issued an IP.


> -----Original Message-----
> From: Yvan Boily [mailto:yboily () seccuris com] 
> Sent: Tuesday, May 04, 2004 5:45 PM
> To: pen-test () securityfocus com
> Subject: Odd Pen-test: Security Camera
>
>
> I was recently given an odd project.  Given a configured 
> security camera in
> which the hardware configuration is password protected, break 
> the password
> and modify the configuration.
>
> I am completely unfamiliar with this hardware, but am going 
> to give it a
> try.
>
> The camera is GVI-BCDNIR, which connects to the monitoring 
> station via a
> V+2001 Multi-4 PCI capture card.
>
> The software package is a suite called TotalSecure DVR 2.2 
> from Productive
> Consultants Inc.
>
> I am attempting to disassemle the software to identify the 
> authentication
> mechanisms as a starting point, but any further suggestions?
>
> Yvan Boily
> Information Security Analyst
> Seccuris 
>
>
> --------------------------------------------------------------
> ----------------
> Ethical Hacking at the InfoSec Institute. Mention this ad and 
> get $545 off
> any course! All of our class sizes are guaranteed to be 10 
> students or less
> to facilitate one-on-one interaction with one of our expert 
> instructors.
> Attend a course taught by an expert instructor with years of 
> in-the-field
> pen testing experience in our state of the art hacking lab. 
> Master the skills
> of an Ethical Hacker to better assess the security of your 
> organization.
> Visit us at:
> http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> --------------------------------------------------------------
> -----------------

----------------------------------------------------------------------------
--
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the
skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------
---


------------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
-------------------------------------------------------------------------------