Warning Issued Over Hackable ADT’s LifeShield Home Security Cameras

Newly discovered security vulnerabilities in ADT’s Blue
(formerly LifeShield) home security cameras could have been
exploited to hijack both audio and video streams.

The vulnerabilities^[1]
(tracked as CVE-2020-8101) were identified in the video doorbell
camera by Bitdefender researchers in February 2020 before they were
eventually addressed on August 17, 2020.

LifeShield was acquired by Florida-based ADT Inc. in 2019, with
Lifeshield’s DIY home security solutions rebranded as Blue as of
January 2020. The company’s products had a 33.6% market share in
the U.S. last year.

The security issues in the doorbell camera allow an attacker
to

• Obtain the administrator password of the camera by simply
  knowing its MAC address, which is used to identify a device
  uniquely
• Inject commands locally to gain root access, and
• Access audio and video feeds using an unprotected RTSP^[2]
  (Real-Time Streaming Protocol) server

The doorbell is designed to periodically send heartbeat messages
to “cms.lifeshield.com,” containing information such as the MAC
address, SSID, local IP address, and the wireless signal strength.
The server, in return, responds with an authentication message that
can be trivially bypassed by crafting a fake request by using the
device’s MAC address.

“The server seems to ignore the token and checks only the MAC
address when sending a response,” the researchers noted, adding
“the password for the administrator can be obtained by decoding the
base64 authorization header received in this request.”

Armed with this admin access to the camera’s web interface, the
attacker can leverage an HTTP interface that’s vulnerable to
command injection and obtain root access.

Lastly, the researchers also found that an unsecured RTSP server
sans any credentials could be exploited to access the video stream
at “rtsp://10.0.0.108:554/img/media.sav” using any media player
such as VLC.

While patches have been applied to the production servers and
all the 1,500 affected devices, with no easy way to confirm if the
camera users installed the firmware updates, Bitdefender chose to
delay public disclosure by more than five months.

“Customers have security choices when it comes to securing their
smart homes or small businesses,” the researchers said.

“Carefully researching IoT vendors for security update policies
to their products, changing default passwords, separating IoTs into
different subnetworks, and even regularly checking for firmware
updates are only a handful of practical and hands-on security tips
that anyone can adhere to.”