Samsung SmartCam can be easily hacked and hijacked, researchers find
(Image: CNET/CBS Interactive)
Security researchers have found a severe vulnerability that could allow hackers to hijack a Samsung SmartCam.
The bug, discovered by the Exploitee.rs (formerly the GTVHacker group), can be easily remotely executed by an unprivileged user -- effectively meaning anyone with the camera's IP address can exploit the bug.
The vulnerability was found in the camera's web server, which runs as root. A flaw in how the code filters out malicious commands allows an attacker to inject their own privileged code.
The group published proof-of-concept code on its wiki.
The researchers say that though the bug was tested on the SNH-1011 mode, the bug is "believed to affect the entire Samsung SmartCam series of devices."
A Samsung spokesperson later told ZDNet that the bug "affects only the SNH-1011 model" and will be fixed in an upcoming firmware update.
It's the second bug that the group has found over the past few years.
The security researchers said it was motivated to look at the SmartCam again after a similar set of bugs were removed instead of fixed.
As a result, Samsung camera owners were forced to use the company's hosted cloud-based service instead.
"This angered a number of users and crippled the device from being used in any DIY monitoring solutions," said the group in its write-up. "So, we decided to audit the device once more to see if there is a way we can give users back access to their cameras while at the same time verifying the security of the devices new firmware."
The flaw may cause a significant security and privacy risk to its owners, but the bug is not said to allow botnet-like activity, such as in the recent Mirai-based attacks that brought much of the US east coast offline late last year, according to one report.