www.greynoise.io
Open in
urlscan Pro
35.152.119.144
Public Scan
URL:
https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-th...
Submission: On November 01 via api from TR — Scanned from IT
Submission: On November 01 via api from TR — Scanned from IT
Form analysis 2 forms found in the DOM
POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/4282754/64495932-6892-4568-8bfc-8ff26d504367
<form id="hsForm_64495932-6892-4568-8bfc-8ff26d504367_follow-us-form" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/4282754/64495932-6892-4568-8bfc-8ff26d504367"
class="hs-form-private hsForm_64495932-6892-4568-8bfc-8ff26d504367 hs-form-64495932-6892-4568-8bfc-8ff26d504367 hs-form-64495932-6892-4568-8bfc-8ff26d504367_2de2f668-414b-4d36-b228-1838aaa74619 hs-form stacked"
target="target_iframe_64495932-6892-4568-8bfc-8ff26d504367_follow-us-form" data-instance-id="2de2f668-414b-4d36-b228-1838aaa74619" data-form-id="64495932-6892-4568-8bfc-8ff26d504367" data-portal-id="4282754"
data-test-id="hsForm_64495932-6892-4568-8bfc-8ff26d504367_follow-us-form">
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-64495932-6892-4568-8bfc-8ff26d504367_follow-us-form" class="" placeholder="Enter your Email"
for="email-64495932-6892-4568-8bfc-8ff26d504367_follow-us-form"><span>Email</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-64495932-6892-4568-8bfc-8ff26d504367_follow-us-form" name="email" required="" placeholder="Email address..." type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="SUBSCRIBE"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1730426998103","formDefinitionUpdatedAt":"1729881488120","lang":"en","embedType":"REGULAR","clonedFromForm":"13928cca-437a-4538-b318-8d77f18441bf","notifyHubSpotOwner":"true","renderRawHtml":"true","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","pageTitle":"GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI | GreyNoise Blog","pageUrl":"https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai","isHubSpotCmsGeneratedPage":false,"hutk":"5ffa198430577738bbe8dd366ac4a663","__hsfp":2458269893,"__hssc":"9901034.1.1730426999286","__hstc":"9901034.5ffa198430577738bbe8dd366ac4a663.1730426999286.1730426999286.1730426999286.1","formTarget":"#hbspt-form-2de2f668-414b-4d36-b228-1838aaa74619","formInstanceId":"follow-us-form","rumScriptExecuteTime":416,"rumTotalRequestTime":680.9000005722046,"rumTotalRenderTime":807,"rumServiceResponseTime":264.9000005722046,"rumFormRenderTime":126.09999942779541,"connectionType":"4g","firstContentfulPaint":0,"largestContentfulPaint":0,"locale":"en","timestamp":1730426999294,"originalEmbedContext":{"portalId":"4282754","formId":"64495932-6892-4568-8bfc-8ff26d504367","region":"na1","target":"#hbspt-form-2de2f668-414b-4d36-b228-1838aaa74619","isBuilder":false,"isTestPage":false,"isPreview":false,"formInstanceId":"follow-us-form","isMobileResponsive":true},"correlationId":"2de2f668-414b-4d36-b228-1838aaa74619","renderedFieldsIds":["email"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.6227","sourceName":"forms-embed","sourceVersion":"1.6227","sourceVersionMajor":"1","sourceVersionMinor":"6227","allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1730426998205,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI | GreyNoise Blog\",\"pageUrl\":\"https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai\",\"userAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1730426998207,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"IT\""},{"clientTimestamp":1730426999291,"level":"INFO","message":"Retrieved analytics values from API response which may be overriden by the embed context: {\"hutk\":\"5ffa198430577738bbe8dd366ac4a663\"}"}]}"><iframe
name="target_iframe_64495932-6892-4568-8bfc-8ff26d504367_follow-us-form" style="display: none;"></iframe>
</form>POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/4282754/64495932-6892-4568-8bfc-8ff26d504367
<form id="hsForm_64495932-6892-4568-8bfc-8ff26d504367_subscribe-box-form" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/4282754/64495932-6892-4568-8bfc-8ff26d504367"
class="hs-form-private hsForm_64495932-6892-4568-8bfc-8ff26d504367 hs-form-64495932-6892-4568-8bfc-8ff26d504367 hs-form-64495932-6892-4568-8bfc-8ff26d504367_21e37841-c3b8-4e3a-baf5-b69ff4c00fde hs-form stacked"
target="target_iframe_64495932-6892-4568-8bfc-8ff26d504367_subscribe-box-form" data-instance-id="21e37841-c3b8-4e3a-baf5-b69ff4c00fde" data-form-id="64495932-6892-4568-8bfc-8ff26d504367" data-portal-id="4282754"
data-test-id="hsForm_64495932-6892-4568-8bfc-8ff26d504367_subscribe-box-form">
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-64495932-6892-4568-8bfc-8ff26d504367_subscribe-box-form" class="" placeholder="Enter your Email"
for="email-64495932-6892-4568-8bfc-8ff26d504367_subscribe-box-form"><span>Email</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-64495932-6892-4568-8bfc-8ff26d504367_subscribe-box-form" name="email" required="" placeholder="Email address..." type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="SUBSCRIBE"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1730426998266","formDefinitionUpdatedAt":"1729881488120","lang":"en","embedType":"REGULAR","clonedFromForm":"13928cca-437a-4538-b318-8d77f18441bf","notifyHubSpotOwner":"true","renderRawHtml":"true","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","pageTitle":"GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI | GreyNoise Blog","pageUrl":"https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai","isHubSpotCmsGeneratedPage":false,"hutk":"5ffa198430577738bbe8dd366ac4a663","__hsfp":2458269893,"__hssc":"9901034.1.1730426999286","__hstc":"9901034.5ffa198430577738bbe8dd366ac4a663.1730426999286.1730426999286.1730426999286.1","formTarget":"#hbspt-form-21e37841-c3b8-4e3a-baf5-b69ff4c00fde","formInstanceId":"subscribe-box-form","rumScriptExecuteTime":454.20000076293945,"rumTotalRequestTime":955.7000007629395,"rumTotalRenderTime":1056.5,"rumServiceResponseTime":501.5,"rumFormRenderTime":100.79999923706055,"connectionType":"4g","firstContentfulPaint":0,"largestContentfulPaint":0,"locale":"en","timestamp":1730426999297,"originalEmbedContext":{"portalId":"4282754","formId":"64495932-6892-4568-8bfc-8ff26d504367","region":"na1","target":"#hbspt-form-21e37841-c3b8-4e3a-baf5-b69ff4c00fde","isBuilder":false,"isTestPage":false,"isPreview":false,"formInstanceId":"subscribe-box-form","isMobileResponsive":true},"correlationId":"21e37841-c3b8-4e3a-baf5-b69ff4c00fde","renderedFieldsIds":["email"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.6227","sourceName":"forms-embed","sourceVersion":"1.6227","sourceVersionMajor":"1","sourceVersionMinor":"6227","allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1730426998481,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI | GreyNoise Blog\",\"pageUrl\":\"https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai\",\"userAgent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1730426998482,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"IT\""},{"clientTimestamp":1730426999294,"level":"INFO","message":"Retrieved analytics values from API response which may be overriden by the embed context: {\"hutk\":\"5ffa198430577738bbe8dd366ac4a663\"}"}]}"><iframe
name="target_iframe_64495932-6892-4568-8bfc-8ff26d504367_subscribe-box-form" style="display: none;"></iframe>
</form>Text Content
View exploit activity on the CVEs related to Pacific Rim
View CVEs
* Why GreyNoise
* Products
* For SOC teams
* For Vulnerability Management teams
* For Threat Hunting teams
* Integrations
* Partners
* GreyNoise Partnerships
* Reseller Partners
* MSSPs
* Technical Alliances
* OEM Partners
* Resources
* Blog
* Resource Library
* Storm Watch Podcast
* ROI Calculator
* Tag Request
* Documentation
* Company
* About
* Press Room
* In the News
* Upcoming Events
* Community
* Careers
* GreyNoise Love
Login
Search for free
Get a demo
Get a demo
Login
Search data
* Why GreyNoise
* Products
* For SOC teams
* For Vulnerability Management teams
* For Threat Hunting teams
* Integrations
* Partners
* GreyNoise Partnerships
* Reseller Partners
* MSSPs
* Technical Alliances
* OEM Partners
* Resources
* Blog
* Resource Library
* Storm Watch Podcast
* ROI Calculator
* Tag Request
* Documentation
* Company
* About
* Press Room
* In the News
* Upcoming Events
* Community
* Careers
* GreyNoise Love
Blog
>
Insights
Follow us
Follow us and don’t miss a thing.
Get the latest blog articles delivered right to your inbox.
Email*
Insights
GREYNOISE INTELLIGENCE DISCOVERS ZERO-DAY VULNERABILITIES IN LIVE STREAMING
CAMERAS WITH THE HELP OF AI
Noah Stone
October 31, 2024
GreyNoise has discovered previously undisclosed zero-day vulnerabilities in
IoT-connected live streaming cameras, leveraging AI to catch an attack before it
could escalate. These cameras are reportedly used in sectors such as industrial
operations, healthcare, and other sensitive environments like houses of worship,
highlighting the urgent need for stronger cybersecurity defenses as the threat
landscape continues to evolve.
This discovery was made possible after a GreyNoise honeypot detected an attempt
to execute an exploit against it. An attacker had developed and automated a
zero-day vulnerability exploit, using a broad-spectrum reconnaissance and
targeting strategy to run it across the internet. However, the exploit hit
GreyNoise’s global sensor network, where GreyNoise’s proprietary internal AI
technology flagged the unusual activity. Upon further investigation, GreyNoise
researchers discovered the zero-day vulnerabilities. Once exploited, attackers
could potentially seize complete control of the cameras, view and/or manipulate
video feeds, disable camera operations, and enlist the devices into a botnet to
launch denial-of-service attacks.
This marks one of the first instances where threat detection has been augmented
by AI to discover zero-day vulnerabilities. By surfacing malicious traffic that
traditional tools would have missed, GreyNoise successfully intercepted the
attack, identified the vulnerabilities, and reported them before they could be
widely exploited. The company’s proactive approach, combining AI-powered
detection with expert human analysis, proves that AI can dramatically accelerate
the discovery of vulnerabilities — making the internet safer, one discovery at a
time.
GreyNoise partnered with VulnCheck to responsibly disclose the flaws, tracked as
CVE-2024-8956 and CVE-2024-8957.
View the full technical analysis and register now for GreyNoise’s expert panel
webinar to learn more about the broader implications of these findings for
security professionals.
AFFECTED DEVICES AND COMMON USE-CASES
The vulnerabilities impact NDI-enabled pan-tilt-zoom (PTZ) cameras from multiple
manufacturers. Affected devices use VHD PTZ camera firmware < 6.3.40 used in
PTZOptics, Multicam Systems SAS, and SMTAV Corporation devices based on
Hisilicon Hi3516A V600 SoC V60, V61, and V63. These cameras, which feature an
embedded web server allowing for direct access by web browser, are reportedly
deployed in environments where reliability and privacy are crucial, including:
* Industrial and manufacturing plants for machinery surveillance and quality
control.
Industrial Machinery Surveillance. Source: PTZOptics.com
AI-Driven Manufacturing Camera. Source: PTZOptics.com
* Business conferences for high-definition video streaming and remote
presentations.
Business Streaming Setup. Source: PTZOptics.com
* Healthcare settings for telehealth consultations and surgical live streams.
Surgical Live Stream. Source: PTZOptics.com
Telehealth Camera in Hospital Room. Source: PTZOptics.com
* State and local government environments, including courtrooms.
Courtroom Surveillance Camera. Source: PTZOptics.com
* Houses of worship for live streaming of religious services.
Religious Service Streaming Camera. Source: PTZOptics.com
Affected devices are typically high-cost live streaming cameras, sometimes
exceeding several thousand dollars.
VULNERABILITIES DISCOVERED
CVSS 9.1 (CRITICAL)
INSUFFICIENT AUTHENTICATION: CVE-2024-8956
* Inadequate authentication mechanisms could allow an attacker to access
sensitive information like usernames, MD5 password hashes, and configuration
data. MD5 hashes have long been considered insecure, meaning attackers could
potentially crack them and gain administrative access.
CVSS 7.2 (HIGH)
OS COMMAND INJECTION: CVE-2024-8957
* Chained with CVE-2024-8956, an attacker can execute arbitrary OS commands on
the affected cameras, potentially allowing an attacker to seize full control
of the system.
FULL CAMERA TAKEOVER, UNAUTHORIZED SURVEILLANCE, DATA BREACH, BROADER ATTACKS,
AND MORE
GreyNoise found the affected cameras to be vulnerable to a range of potentially
dangerous attacks. These vulnerabilities, if exploited, could potentially expose
sensitive business meetings, compromise telehealth sessions, and disrupt cameras
deployed in industrial settings, leaving organizations potentially exposed to
data and privacy breaches.
FULL CAMERA TAKEOVER AND UNAUTHORIZED SURVEILLANCE
* By exploiting both CVE-2024-8956 and CVE-2024-8957, an attacker could
potentially seize full control of the camera, view and/or manipulate the
video feeds, and gain unauthorized access to sensitive information. Devices
could also be potentially enlisted into a botnet and used for
denial-of-service attacks.
Attacks like this are not new — in 2021, live feeds of 150,000 cameras inside
schools, hospitals, and more were exposed. Vulnerable IoT devices are prime
targets for attackers looking to add compromised devices to a botnet, like the
infamous Mirai botnet.
BROADER NETWORK ATTACKS AND DATA BREACH
* An attacker could extract network details, including IP addresses, MAC
addresses, and gateway configurations, potentially leveraging this
information to pivot and move laterally into the device’s local network. This
could potentially compromise other systems on the same network, which could
lead to broader data breaches or even the spread of ransomware.
DISABLEMENT OF CAMERA OPERATIONS
* CVE-2024-8956 allows for configuration files to be updated or entirely
overwritten. An attacker could exploit this vulnerability to intentionally
misconfigure or disable the camera, potentially disrupting camera
operations.
HOW GREYNOISE DISCOVERED THESE VULNERABILITIES USING AI
Security teams today face an overwhelming number of alerts, many of which result
from harmless internet activity like routine scans and benign traffic. With
countless alerts pouring in daily, identifying threats becomes incredibly
difficult, and many serious vulnerabilities can go unnoticed amid the noise.
This is where AI steps in. GreyNoise’s Sift, powered by large language models
(LLMs) trained on vast amounts of internet traffic — including traffic targeting
IoT devices — identifies anomalies that traditional systems may miss. Instead of
just reacting to known threats, Sift excels at spotting new anomalies, threats
that haven't been identified yet or don’t fit any known signatures.
WHAT MAKES SIFT DIFFERENT
Sift analyzes real-time internet traffic and enriches that data with GreyNoise’s
proprietary datasets. It then runs the data through advanced AI systems, which
help separate routine activity from potential threats. This process allows
researchers to focus on truly meaningful threats without getting lost in the
noise.
In this case, Sift flagged unrecognized traffic that had not been tagged as a
known threat. This caught the attention of GreyNoise researchers, who further
investigated the unusual traffic. Their investigation led to the discovery of
two previously unknown zero-day vulnerabilities in live streaming cameras —
highlighting how AI can transform the speed and accuracy of cybersecurity
research.
“This isn’t about the specific software or how many people use it — it’s about
how AI helped us catch a zero-day exploit we might have missed otherwise,” said
Andrew Morris, Founder and Chief Architect at GreyNoise Intelligence. “We caught
it before it could be widely exploited, reported it, and got it patched. The
attacker put a lot of effort into developing and automating this exploit, and
they hit our sensors. Today it’s a camera, but tomorrow it could be a zero-day
in critical enterprise software. This discovery proves that AI is becoming
essential for detecting and stopping sophisticated threats at scale.”
HUMAN RESEARCHERS + AI: A POWERFUL COMBINATION
By rapidly filtering out irrelevant traffic, Sift gives human researchers a
clear head start. Capable of sifting through millions of data points, it enables
researchers to focus on critical threats in real-time. This combination of
AI-driven anomaly detection and human-led investigation is essential in today’s
fast-paced cybersecurity landscape, where attackers are constantly evolving
their tactics. Without Sift’s machine learning capabilities, these
vulnerabilities might have remained hidden.
THE BROADER IOT CHALLENGE: PROLIFERATION AND INTERNET NOISE
GreyNoise’s discoveries shed light on a larger issue facing the rapidly growing
IoT landscape. With nearly 19 billion IoT devices in operation globally,
industrial and critical infrastructure sectors rely on these devices for
operational efficiency and real-time monitoring. However, the sheer volume of
data generated makes it challenging for traditional tools to discern genuine
threats from routine network traffic, leaving systems vulnerable to
sophisticated attacks. Last month, U.S. authorities dismantled a botnet that
leveraged a variety of IoT devices, including IP cameras. IoT devices remain a
prime target for attackers looking to exploit insecure design and
functionality.
RECOMMENDATIONS TO PROTECT YOUR ORGANIZATION
Organizations using VHD PTZ camera firmware < 6.3.40 used in PTZOptics, Multicam
Systems SAS, and SMTAV Corporation devices based on Hisilicon Hi3516A V600 SoC
V60, V61, and V63 should take immediate action to patch the discovered
vulnerabilities and secure their systems.
VulnCheck alerted affected manufacturers to the flaws, only receiving a response
from PTZOptics. The manufacturer released firmware updates addressing these
flaws.
Read the GreyNoise Labs blog for technical analysis and deeper insight into how
Sift helped discover these zero-day vulnerabilities.
DON’T MISS THE WEBINAR!
Join our expert panel for an exclusive webinar where we dive deep into the
technical details and strategic implications of this discovery to provide the
context you need to better protect your organization.
Register now to reserve your spot today and learn how AI-driven cybersecurity is
changing the status quo and how it can transform your security strategy.
This article is a summary of the full, in-depth version on the GreyNoise Labs
blog.
Read the full report
Like or share:
GET THE LATEST BLOG ARTICLES DELIVERED RIGHT TO YOUR INBOX.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Email*
Be part of the conversation in our Community Slack group.
Join us on Slack
Follow us and don’t miss a thing.
RELATED CONTENT
View all related articles
Insights
GREYNOISE INTELLIGENCE DISCOVERS ZERO-DAY VULNERABILITIES IN LIVE STREAMING
CAMERAS WITH THE HELP OF AI
Noah Stone
Oct 31, 2024
Insights
U.S. AND UK WARN OF RUSSIAN CYBER THREATS: 9 OF 12 GREYNOISE-TRACKED
VULNERABILITIES IN THE ADVISORY ARE BEING PROBED RIGHT NOW
Noah Stone
Oct 17, 2024
Insights
PROTECTING DEMOCRACY FROM THE GROWING THREAT OF DEEPFAKES AND DISINFORMATION
boB Rudis
Oct 9, 2024
Insights
Products
* SOC teams
* Vulnerability Management teams
* Threat Hunting teams
* Integrations
Partners
* GreyNoise Partnerships
* Reseller Partners
* MSSPs
* Technical Alliances
* OEM Partners
Resources
* Blog
* Resources Library
* Storm Watch Podcast
* ROI Calculator
* Tag Request
* Documentation
Company
* About
* Press Room
* In the News
* Upcoming Events
* Community
* Careers
* GreyNoise Love
© 2024 GreyNoise, Inc. All rights reserved.
* Terms
* Privacy
* Security
* Cookies
* Patents
* Principles
Cookie Settings
We use cookies to ensure you get the best experience on our website. Learn more
Got it