Hundreds of brands of security cameras, baby monitors, and “smart” doorbells have serious vulnerabilities that allow hackers to hijack devices and spy on their owners.
Affected devices use “peer-to-peer” features (also known as “P2P”) that allow users to connect to their devices the moment they come online. Hackers are able to exploit flaws in these features to rapidly find vulnerable cameras, then launch attacks to access them – all without the owner’s knowledge.
Over 2 million vulnerable devices have been identified on the Internet, including those distributed by HiChip, TENVIS, SV3C, VStarcam, Wanscam, NEO Coolcam, Sricam, Eye Sight, and HVCAM. Affected devices use a component called iLnkP2P. Unfortunately, iLnkP2P is used by hundreds of other brands as well, making identification of vulnerable devices difficult.
Am I affected?
Vulnerable devices will have a special serial number known as a UID, which is typically printed on a label somewhere on the device.
A UID will look like:
In this example,
FFFF is the device’s prefix. Devices with the following prefixes are known to be vulnerable:
What can I do?
Ideally, buy a new device from a reputable vendor. Research suggests that a fix from vendors is unlikely, and these devices are often riddled with other security problems that put their owners at risk.
If disposing of the device is not possible, the P2P functionality may be effectively neutered by blocking outbound traffic to UDP port 32100. This will prevent devices from being accessed from external networks via P2P (though local access will still work).
What is P2P? What is iLnkP2P?
P2P is a feature included in many devices that allows them to be accessed without any manual configuration. By using a special serial number known as a UID, users may instantly connect to their device from their phone or computer. A main selling point of P2P devices is that they do not require port forwarding or dynamic DNS in order to be accessed, and are capable of overcoming NAT and firewall scenarios automatically.
iLnkP2P is one of several P2P solutions utilized by device manufacturers. It was developed by Shenzhen Yunni Technology Company, Inc.
What is CVE-2019-11219?
CVE-2019-11219 refers to an enumeration vulnerability in iLnkP2P that allows attackers to rapidly discover devices that are online. Due to the nature of P2P, attackers are then able to directly connect to arbitrary devices while bypassing firewall restrictions.
What is CVE-2019-11220?
CVE-2019-11220 refers to an authentication vulnerability in iLnkP2P that allows attackers to intercept connections to devices and perform man-in-the-middle attacks. Attackers may use this vulnerability to steal the password to a device and take control of it.
Are all P2P devices vulnerable to these issues?
No. There are several different P2P solutions in use by different vendors. These issues are specific to devices that use iLnkP2P.
Is P2P the same as UPnP?
No. P2P is not related to UPnP in any way, and will function regardless of UPnP configuration.
My device encrypts traffic. Am I safe?
Probably not. Analysis of a wide range of devices has suggested that most devices do not employ encryption at all, or do so in an insecure fashion. Some vendors (notably VStarcam) have gone as far as outright lying about their use of encryption.
I don’t know my UID. Is there another way to determine if I am affected?
Devices that use the following Android apps may be vulnerable:
- HiChip: CamHi, P2PWIFICAM, iMega Cam, WEBVISION, P2PIPCamHi, IPCAM P
- VStarcam: Eye4, EyeCloud, VSCAM, PnPCam
- Wanscam: E View7
- NEO: P2PIPCAM, COOLCAMOP
- Sricam: APCamera
- Various: P2PCam_HD
Who are you?
I am Paul Marrapese, an OSCP-certified security engineer from the Bay Area, California. These vulnerabilities were discovered and reported by me as part of an independent research effort.
|Jan. 15, 2019||Initial advisory issued to device vendors.|
|Jan. 17, 2019||No responses received. 2nd advisory issued to vendors.|
|Jan. 24, 2019||No responses received. 3rd advisory issued to vendors with intent to disclose.|
|Feb. 4, 2019||Developer of iLnkP2P identified. Initial advisory issued to developer with intent to disclose.|
|Feb. 14, 2019||No responses received. 2nd advisory issued to developer.|
|Feb. 19, 2019||No responses received. Vulnerabilities reported to CERT/CC.|
|~Apr. 1, 2019||CERT/CC relays vulnerabilities to CNCERT/CC.|
|Apr. 11, 2019||CVE-2019-11219 and CVE-2019-11220 reserved by MITRE.|
|Apr. 24, 2019||Public disclosure.|