Cybercriminals could access the live feed and conduct remote code execution in a thermal security camera if it was made by FLIR Systems, according to new research.

Threat Actors Can Download Camera Info With Ease

Beyond Security’s SecuriTeam blog presented detailed findings by an independent researcher from Zero Science Lab about the thermal security camera vulnerabilities. The flaws included a way for threat actors to download and read FLIR operating system (OS) files using an API associated with the devices, along with hardcoded credentials and the potential for information disclosure. The post indicated that the researcher notified FLIR Systems, which is now conducting its own investigation.

To show just how serious the dangers are, proof of concepts have been developed with code based around the thermal security camera vulnerabilities. SecurityWeek also reported that FLIR devices numbering in the thousands can be discovered online through a common search tool. Cybercriminals might find it relatively easy to take advantage of the flaws as awareness grows.

Thermal Security Camera Flaws Not Limited to FLIR Systems

The irony is that a thermal-imaging camera is supposed to make a physical environment more secure by offering monitoring capabilities, but that shouldn’t come with a trade-off in data security. Unfortunately, the have also been problems with similar products.

Just last month, F-Secure published some research of its own showing a range of vulnerabilities and flaws in IP security cameras from Foscam. The 18 potential threats ranged from undocumented Telnet functionality and cross-site scripting (XSS) and buffer overflow.

Even more recently, Threatpost wrote about aIR-Jumper, which is malware that sends secret messages by taking over the infrared capabilities of closed-circuit TV cameras. Although aIR-Jumper was a proof of concept developed by a group of Israel-based academics, it demonstrated that a thermal security camera isn’t the only device of its kind that could be turned against its owners.

Although it was reportedly informed back in July, FLIR has yet to offer a patch or other fix for the vulnerabilities. Until one is released, organizations using the FC-Series S, FC-Series ID and PT-Series should look at the research to understand the risks they face.

More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…