Malware discovered on new CCTV systems sold by Amazon

A researcher has found pre-installed malware on a CCTV system sold by Amazon, stumbling ﻿. The researcher stumbled across the malware while trying to configure the surveillance system. After Having found that the page failed to host normal controls or settings, the researcher he opened the browser’s developer tools and discovered a hidden iFrame, which was retrieving content from Brenz.pl; t. This domain was used in malware distribution campaigns in 2011. All the Brenz.pl operator would need to do is push the malicious code through the hidden iFrame. Once the CCTV operator accessed the relevant page, the malware would be downloaded and installed. This in turn would give the attacker the ability to use the equipment to spy on the victim, and potentially use it for data theft.

Be careful while buying any off-brand electronics from Amazon, as they could end up infecting you.





Recently, independent security researcher Mike Olsen discovered that the CCTV surveillance devices sold on Amazon came with pre-installed malware.





Olsen discovered this nasty secret after he bought a set of outdoor CCTV surveillance cameras from Amazon for one of his friends.





He picked Sony Chip HD 6 Camera 1080P PoE IP CCTV surveillance camera kit sold by the Urban Security Group (USG) on Amazon, as it had good reviews and was a relatively cheap set of 6 cameras with all necessary equipment included.





While helping his friend set up the cameras, Olsen logged into the administrator panel to configure the surveillance system and found that the page hosted "no normal controls or settings."





Assuming that it might be bad programming, Olsen opened up the browser's developer tools and was surprised to discover a hidden iFrame loaded at the bottom of the body tag, retrieving content from Brenz.pl.





Surveillance Camera Comes Pre-Installed with Malware





A quick Google search revealed that the Brenz.pl domain was used in malware distribution campaigns, according to a blog post by cyber-security vendor Sucuri in 2011.





In short, this means that the newly bought surveillance camera kit could be infected with malware anytime, when the Brenz.pl operator decides to push malicious code to the DVR's backend through the hidden iFrame.

UPCOMING WEBINAR 🔐 Mastering API Security: Understanding Your True Attack Surface Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar! Join the Session



Once the CCTV camera's operator accessed that page, the malware would be downloaded and installed, potentially leading to unlawful spying and data theft.





Since the Breza.pl domain was already on the firmware, there might be other nasty malware included in the firmware as well, that does not provide the camera's owner to access the backend.





The malware distributed by the surveillance cameras can have the ability to hijack video feeds or make the customer's cameras part of a DDoS Botnet , something that happened last year.





So be careful what you buy. Check reviews of every product before buying, even if the product brand and the eCommerce platform is trusted.