Researchers at Tenable Security discovered several vulnerabilities in products Amazon, which they published in August. The vulnerabilities are primarily found in cameras security Blink XT2 , and according to the researchers, they allow hackers to compromise the cameras.
Now, Amazon is releasing updates to fix the bugs.
According to Tenable Security, all Blink XT2 camera users should check that their firmware is updated to version 2.13.11 or later.
The vulnerabilities are related to the camera’s Sync Module , an additional network device that acts as a hub between the camera and the cloud. This Module allows users to divide the home into zones. Therefore, users can control the cameras that view inside and outside the home and set them to different times.
However, vulnerabilities in the Sync Module could allow an attacker to compromise the account and connected cameras. This means the attacker can control the camera, turn it off, view stored content (videos and photos), etc.
Command -injection vulnerabilities in the Sync Module were found in cloud communication devices for providing updates or receiving network.
“When checking for updates, the device first obtains an update helper script (sm_update) from the web and then immediately runs the contents of that script with zero sanitation,” explained James Sebree, a researcher at Tenable.
A hacker could exploit this issue to carry out a man-in-the-middle attack (MitM)
Researchers also discovered another vulnerability in Amazon cameras that requires physical access to the device. This vulnerability does not pose a serious threat to users.
"The most obvious attack scenario for this bug would be some insider threat - babysitters, petsitters, cleaning staff, or anyone with access to your home," Sebree noted.
All users will need to update their Blink cameras, but Sebree said that identifying devices that have already been compromised is a difficult process.
