A recent cyber attack compromised over 14,000 Dahua IP cameras across Ukraine and Russia, according to reports by Hunt.io. The operation, known as Operation CameraSwarm, occurred from June 17 to July 22, beginning with global scans targeting Russian, Mexican, and Vietnamese ISP ranges before concentrating on Russian and CIS telecom netblocks.
Details of the CameraSwarm Operation
Hunt.io’s investigation revealed access to the hacker’s servers, which contained 2,616 files spread across 234 subdirectories, amounting to roughly 407 MB of data. This data exposure led to the discovery of 14,530 compromised devices over a 35-day period, with a brute-force engine targeting 12,324 unique addresses.
Furthermore, the attackers installed a persistent backdoor account on 1,923 cameras using Remote Procedure Call (RPC). The backdoor account, utilizing the credentials p2pwn/p2password, was independent of any administrative passwords and could endure password changes or factory resets on most firmware versions.
Technical Aspects of the Attack
The attackers employed a publicly available asyncio framework for brute-forcing credentials, alongside a compiled Go binary to bypass authentication. This binary exploited a series of vulnerabilities, including CVE-2021-33044 and CVE-2021-33045, to implement the backdoor account.
Notably, CVE-2021-33044 involves a flaw where the system unconditionally trusts clients identifying as NetKeyboard hardware controllers, ignoring the password field when clientType is NetKeyboard. Additionally, CVE-2021-33045 takes advantage of the firmware reading the source address from the request body rather than the TCP connection, allowing unauthorized administrative access.
Infrastructure and Motivation
The attackers occasionally exploited Dahua’s cloud relay to access cameras behind NATs using only their serial numbers. Hunt.io discovered that the campaign’s infrastructure had been established at least a year prior, integrating both custom and modified code from four other developers.
While the exact motivations of the threat actors remain unclear, Hunt.io assesses that the toolkit’s design suggests potential third-party access, though there is insufficient evidence to confirm a commercial operation. The broader implications of this breach, including potential surveillance or data theft, remain under scrutiny.
This incident underscores ongoing vulnerabilities in networked devices and the critical need for robust cybersecurity measures to protect sensitive infrastructure.
