Use them as source to remotely login to the Dahua devices Choose whatever admin user, copy the login names and password hashesģ. Remotely download the full user database with all credentials and permissionsĢ. From there, he could add users and install or modify the device’s software. Armed with this information, he could effectively “pass the hash” and the corresponding username right back to the Web server and be admitted access to the device settings page. That server requires the user to enter a username and password, but Bashis found he could force all affected devices to cough up their usernames and a simple hashed value of the password. These devices are designed to be controlled by a local Web server that is accessible via a Web browser. On March 5, a security researcher named Bashis posted to the Full Disclosure security mailing list exploit code for an embarrassingly simple flaw in the way many Dahua security cameras and DVRs handle authentication. Adding urgency to the situation, there is now code available online that allows anyone to exploit this bug and commandeer a large number of IoT devices. The vulnerability allows anyone to bypass the login process for these devices and gain remote, direct control over vulnerable systems. Dahua, the world’s second-largest maker of “Internet of Things” devices like security cameras and digital video recorders (DVRs), has shipped a software update that closes a gaping security hole in a broad swath of its products.

Dahua webplugin linux