[SECURITY] Lorex ECO DVR Hard coded password

andrew.hofmans@xxxxxxxxx · Mon, 30 May 2016 18:18:06 GMT

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

1. ADVISORY INFORMATION
=======================
Product: Lorex ECO DVR
Vendor URL: https://www.lorextechnology.com/
Type: Hard coded password [CWE-259]
Date found: 2016-05-04
Date published: 2016-05-30
CVE: -

2. CREDITS
==========
This vulnerability was discovered and researched by Andrew Hofmans. https://www.andrewhofmans.com

3. VERSIONS AFFECTED
====================
Vulnerability successfully tested on Lorex LH162400 DVR firmware (V5.2.0-20141008) using Lorex Stratus Client and Lorex ECO Stratus Android app. Vulnerability may be present on other DVRs that are able to be accessed via Lorex's Stratus Client, and Lorex ECO Stratus Android app. Affected DVRs likely include the vendors and versions listed specifically in the code.

4. INTRODUCTION
===============
LOREX provides businesses and consumers with professional-grade DIY video surveillance systems and plug and play wireless video monitoring solutions.

(from the vendor's homepage)

5. VULNERABILITY DETAILS
========================
Remote access to the device is possible using Lorex's Stratus Client which is downloadable from the vendor. User is prompted for IP, username/password, and port. DVRs are easily identified on a LAN using normal port scanning and enumeration. Default username and password is admin:000000 (from manufacturer manual). On first login admin user is prompted to change password. No matter what the password is or what it is changed to the "SuperPassword" grants admin access to the device. 

The following Proof-of-Concept is found in plaintext in the [installation directory]\new-trunk\js\main.js :

function CheckPassword(){};
$(function(){
	$("#btn_reboot_ok").click(function(){
		var SuperPassword;
		if(gDvr.nMainType == 0x52530003 || (gDvr.nMainType == 0x52530002 && gDvr.nSubType == 0x50100) || (gDvr.nMainType == 0x52530000 && gDvr.nSubType == 0x60300)){
			SuperPassword = "130901";
		}else{
			SuperPassword = "070901";
		}
		if(lgCls.version == "SWANN"){
			SuperPassword = "479266";
		}else if(lgCls.version == "PROTECTRON"){
			SuperPassword = "Ab9842";
		}
		if($("#reboot_input").val() == gVar.passwd || $("#reboot_input").val() == SuperPassword){
			MasklayerHide();
			$("#reboot_prompt").css("display","none");
			CheckPassword();
		}

6. RISK
=======
To successfully exploit this vulnerability an attacker must have remote access to the DVR over port 9000. Attacker can use Lorex's Stratus Client and use the hardcoded admin password for specific vendor and model.

The vulnerability allows remote attackers full administrative access to the device.

7. SOLUTION
===========
Prevent remote access to port 9000 at the firewall. Segregate DVR from normal LAN to limited access internal LAN segment / VLAN.

8. REPORT TIMELINE
==================
2016-05-04: Discovery of the vulnerability
2016-05-05: Informed applicable Vendors
2016-05-05: Submitted vulnerability to US-CERT
2016-05-05: Response from US-CERT informing similar vulnerability was previously reported which vendor ignored. No further attempts will be made.
2016-05-16: Response from Swann
2016-05-30: Advisory released