Abusing P2P to Hack 3 Million Cameras
Paul Marrapese exposes critical vulnerabilities in the iSmartViewPro P2P protocol, enabling unauthenticated remote hijacking of over 3 million IoT cameras globally.
Summary
The Insecurity of Plug-and-Play IoT P2P Cloud Networks
To facilitate easy remote smartphone access without port forwarding, millions of low-cost IP cameras ship with enabled-by-default Peer-to-Peer (P2P) cloud tunneling protocols.
Reverse Engineering the CS2 Network and iSmartViewPro
Paul Marrapese reverse engineers proprietary UDP-based P2P protocols used by Chinese OEM white-label vendors, mapping out central directory servers and client handshakes.
Unauthenticated Remote Hijacking and MitM Attacks
Flaws in device serial number authentication and unencrypted UDP traffic allow remote attackers to intercept live video feeds, steal credentials, and execute arbitrary commands.
The Challenges of Disclosing Flaws in White-Label Hardware
Marrapese highlights the systemic difficulty of coordinating patches across hundreds of re-branded white-label consumer hardware manufacturers.
Related talks
Main Stage·46 min
Rion Carter
Rion Carter reverse engineers low-cost consumer security cameras, uncovering unauthenticated audio injection flaws and remote firmware takeover vectors.
Main Stage·31 min
Paul Marrapese
Paul Marrapese answers questions regarding P2P IoT protocols, white-label security disclosure obstacles, and consumer camera defense.
Main Stage·42 min
Mark Omo · James Rowley
Reverse engineers electronic gun safes and commercial digital vaults, demonstrating effortless physical and electromagnetic bypasses across leading brands.