Millions of IoT devices are vulnerable to widespread bug

Researchers have found that security cameras using an open-source code called gSOAP could be easily hacked and that attackers can send commands remotely. This allowed the researchers at Senrio, a security firm focused on the internet of things, to take over a video feed, pause the recording and turn the camera off.

Senrio was able to take full control of the hacked cameras, the company said. Researchers are naming the zero-day exploit Devils Ivy, because, like the plant, it is hard to kill and it spreads quickly. 

The company said Tuesday that it discovered the vulnerability while researching Axis security cameras, one of the largest makers of connected cameras. Axis provides surveillance globally, including for every security camera at the Los Angeles airport.

IoT devices provide convenience for device owners because online connections bring new uses to old gadgets, but they are still iffy on security. On Tuesday, the FBI issued a warning for connected toys, citing concerns about hacks.

The flaw is found in 249 camera models for Axis and affects 34 other companies, Senrio said. Because the flaw is from an open-source code, it could be present on millions of other devices, the researchers said.

Genivia, the company behind gSOAP, said it has had more than 1 million downloads, including from companies like IBM, Microsoft and Adobe Systems. Genivia has released a patch for this flaw. Axis did not respond to a request for comment.

You can see the original Senrio hack in action here:  https://player.vimeo.com/video/225922694/