Turning Camera Surveillance on its Axis

Turning Camera Surveillance on its Axis

Speakers: Noam Moshe

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=wM8kOq4VVt8

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Noam%20Moshe%20-%20Turning%20Camera%20Surveillance%20on%20its%20Axis.pdf

Overview

Noam Moshe, Team Lead and Lead Vulnerability Researcher at Claroty, presented an investigation into critical vulnerabilities in Axis Communications IP cameras — enterprise-grade surveillance equipment used by major corporations, government agencies, educational institutions, and medical facilities. Beginning with a simple goal of finding new attack surface into internal corporate networks, Moshe discovered and responsibly disclosed multiple severe vulnerabilities in Axis cameras, including an unauthenticated remote code execution chain and weaknesses in the proprietary "Access Remoting" protocol. The research demonstrates how organizations relying on surveillance cameras as passive security infrastructure may actually be exposing their internal networks to sophisticated attackers through the same devices.

Background

▶ Watch: Research motivation: IP cameras as entry points into corporate networks (2:18)

Moshe's research was motivated by a specific adversarial use case: finding internet-facing entry points into internal corporate networks. Starting from Shodan searches for specific companies' IP address ranges, he identified internet-exposed services — VPNs, file sharing, and importantly, a service he had never seen before called "Access Remoting."

Axis Communications is a Swedish company that is one of the world's leading manufacturers of network video surveillance equipment. Their cameras are enterprise-grade devices running custom Linux-based firmware. They are pervasive in environments that require high physical security — exactly the environments where a network compromise would be most damaging. The cameras are typically connected to internal networks and may have direct access to sensitive network segments.

Access Remoting is Axis's proprietary protocol for remote management and video streaming access to cameras. Unlike consumer cameras that might use generic RTSP, Axis cameras use a custom protocol stack that the researcher had no prior documentation about. This unknown territory became the starting point for a deep vulnerability investigation.

Key Findings

▶ Watch: Attack chain: server compromise leads to camera code execution (11:21)

• Multiple critical vulnerabilities were discovered in Axis camera firmware, including vulnerabilities in the Access Remoting protocol and in the camera's authentication stack.
• Unauthenticated remote code execution was achieved through a chain of vulnerabilities, allowing an attacker to execute arbitrary code on the camera without any credentials.
• The Access Remoting protocol was reverse-engineered and found to contain vulnerabilities in its message parsing and authentication handling.
• Axis cameras run Linux with root privileges for many camera services, meaning code execution on the camera provides a privileged foothold on the device.
• From camera to internal network: Cameras are typically well-connected to internal networks. Code execution on the camera provides an attacker with an internal network foothold from an internet-facing device, bypassing perimeter defenses.
• All vulnerabilities were responsibly disclosed to Axis and patches were issued.

Technical Deep Dive

▶ Watch: Root cause: Axis Access Remoting protocol lacks proper authentication (15:45)

Access Remoting protocol analysis:

Moshe began by capturing network traffic between an Axis camera and an Axis management application to understand the Access Remoting protocol. The protocol runs over HTTPS (port 443) and uses a custom framing format on top of TLS. By intercepting and analyzing this traffic, he identified:

1. Protocol message structure: header fields indicating message type, length, sequence numbers, and a data payload
2. Authentication sequence: a multi-message handshake before video streams or management commands are accepted
3. Features: the protocol supports video streaming, PTZ control, configuration, and firmware update capabilities

Reverse engineering the firmware:

To understand the server-side implementation, Moshe extracted the camera firmware (obtained from Axis's public firmware download portal) and analyzed the binaries. Key findings from static and dynamic analysis:

• The Access Remoting server component is implemented in a custom binary running with elevated privileges
• Message parsing is performed in C/C++ without consistent bounds checking
• Error handling in the authentication path has edge cases that the attacker can reach without completing authentication

Authentication bypass vulnerability: The authentication protocol involves a challenge-response sequence. Moshe identified that by sending a specially crafted message of a specific type during the handshake — before authentication was completed — the server would process the message in an authenticated context due to incorrect state tracking. This authentication bypass allowed access to functionality intended only for authenticated clients.

Memory corruption vulnerability: Within the authenticated (or authentication-bypassed) parsing path, a message type that triggered a specific parsing operation had a stack buffer overflow vulnerability: the server allocated a fixed-size buffer and copied a length-specified field from the message into it without validating that the field length was within the buffer's bounds. A message with a large field value triggered a stack overflow, overwriting the return address.

Exploitation chain:

1. Send authentication bypass message to reach authenticated handler without credentials
2. Send crafted message to trigger stack overflow in the authenticated handler
3. Overwrite return address to redirect execution to attacker-controlled code (Return-Oriented Programming to bypass DEP/NX)
4. Execute a reverse shell or implant

Camera as a network pivot: Once code execution is achieved on the camera, the attacker has access to a Linux system connected to the internal network. From this position, they can:

• Scan and interact with internal hosts that are not reachable from the internet
• Intercept and manipulate camera feeds
• Use the camera as a C2 proxy channel that blends into legitimate camera management traffic
• Pivot to other cameras or network equipment on the same segment

Demo / Proof of Concept

▶ Watch: Protocol analysis: JSON-based RPC and the missing signing requirement (20:24)

Moshe demonstrated:

• A complete unauthenticated remote code execution proof-of-concept against a representative Axis camera in his lab environment
• The reverse shell appearing on the attacker's machine after exploiting the vulnerability
• Demonstration of internal network access from the compromised camera: scanning internal hosts and reaching services not accessible from the internet
• Video feed access and manipulation — showing that the same exploit that grants shell access also enables full control over the camera's surveillance function

The demonstration illustrated the full attack chain from internet-accessible Axis camera to internal network foothold.

Defensive Implications

▶ Watch: Escalation path from auth bypass to full pre-auth RCE (29:13)

Patch Axis camera firmware immediately. Axis has issued patches for the disclosed vulnerabilities. Given the severity (unauthenticated RCE), patching should be treated as urgent. Camera firmware is often overlooked in patch management processes.

Audit internet-exposed camera management ports. Access Remoting and camera management interfaces should not be exposed to the internet without VPN or other strong access control. Shodan and similar services can reveal which of an organization's cameras are internet-accessible.

Network segmentation for cameras. IP cameras should be on isolated network segments (VLANs) that cannot initiate connections to sensitive internal systems. Camera network access should be limited to the video management system and legitimate management hosts. This limits the lateral movement opportunity from a compromised camera.

Monitor camera egress traffic. Unusual outbound connections from cameras (to non-VMS endpoints, to internet destinations) should be alerted on. Camera traffic patterns are highly predictable and anomaly detection is tractable.

Inventory IoT and OT devices. Many organizations do not maintain comprehensive inventories of IoT devices like cameras. Without knowing what is deployed, firmware patch status cannot be tracked and network access cannot be appropriately controlled.

Disable unused protocols. If Access Remoting is not needed for legitimate operations, it should be disabled in camera configuration.

Key Takeaways

1. Enterprise IP cameras are a significant and underexamined attack surface that can provide unauthenticated internet-to-internal-network attack chains.
2. The Access Remoting protocol in Axis cameras contained authentication bypass and memory corruption vulnerabilities enabling unauthenticated remote code execution.
3. Cameras are well-positioned network pivot points: internet-accessible, connected to internal networks, and rarely monitored for anomalous activity.
4. Firmware analysis of proprietary embedded devices using standard reverse engineering techniques (firmware extraction, binary analysis, traffic interception) was sufficient to identify critical vulnerabilities in a previously undocumented protocol.
5. IoT and OT devices — cameras, PLCs, medical equipment — are consistently underpatched and under-segmented relative to traditional IT infrastructure, despite being on the same networks.
6. Responsible disclosure led to patches from Axis; organizations must now ensure they apply those patches.

About the Speaker(s)

▶ Watch: Memory corruption: abusing the TLS-like key exchange for buffer overflow (33:53)

Noam Moshe is the Team Lead and Lead Vulnerability Researcher at Claroty. His day-to-day work involves discovering vulnerabilities in OT, IoT, and medical devices and responsibly disclosing them to vendors. His lab contains multiple racks of devices including PLCs, HMIs, medical equipment (DNA sequencers, patient monitors), and IoT devices, making it one of the more unique security research environments in the field. He describes IoT vulnerability research as his personal specialty and primary interest.