43. IoT and OT Security – Cameras, Smart Devices, Plant Networks
43.2 Attack Surface – Defaults, Telnet, HTTP, UPnP, Dashboards
IoT reality check (SME godown):
- Factory admin/admin or printed sticker password still on camera
- Telnet or plain HTTP management UI on the LAN (sometimes on the internet via bad NAT/UPnP)
- UPnP opens ports without Raja knowing
- Cloud "dashboard" with shared vendor support accounts
- Old BusyBox / abandoned firmware; no auto-update
Blue hardening (lab + production idea – same spirit):
- Change every default password before the device leaves the box
- Disable Telnet; prefer SSH/HTTPS if the device supports it – else VLAN-only + jump host
- Turn UPnP off on the router that faces the ISP
- Management plane only from admin VLAN / VPN
- Inventory: MAC, firmware version, who owns the asset
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Tries vendor default list on port 23/80/554 | Disable Telnet; unique passwords; fail2ban-class / lockout on UI |
| Finds UPnP-mapped camera on WAN | UPnP off; WAN port check from own phone on mobile data |
| Uses shared "support" cloud login | SSO, MFA, least privilege, revoke vendor standing access |
Ravindra Bagale's Tip
Students say "password changed = done" and leave UPnP on. Password + no WAN exposure + VLAN. Interview: "Default credentials and UPnP are still the SME camera story." Keep this in mind.
Ravindra Bagale's Tip – मराठी
Students "password change = done" म्हणतात आणि UPnP चालू ठेवतात. Password + no WAN exposure + VLAN. Interview: "Default credentials and UPnP are still the SME camera story." लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
Students कहते हैं "password change = done" और UPnP चालू छोड़ देते हैं. Password + no WAN exposure + VLAN. Interview: "Default credentials and UPnP are still the SME camera story." ध्यान रखो.
Lab
On paper: list 5 default-cred mistakes for a fake DVR (admin/12345, Telnet on, UPnP on, HTTP only, no inventory). For each, one Blue fix. Pair with Zoya – she plays "new camera unboxing checklist".
Real incident: Verkada camera platform access (2021)
In March 2021, attackers accessed Verkada's support / admin tooling and, as reported by the company and covered widely (Bloomberg and others), viewed video for a subset of customers; Verkada's own incident report later described 97 customers with camera access among roughly 6,000 customers (verify their published figures). Public reporting described how exposed super-admin style credentials on an internet-reachable internal system (Jenkins / support tooling) let attackers bypass normal authorization, including MFA on the customer path. Lesson for this section: camera risk is not only "default password on the lens" – cloud and support planes are attack surface too. Defence: no secrets on public CI, MFA that cannot be skipped via support backdoors, customer-side network isolation, vendor risk review. Source: Verkada Security Update / incident report (2021); Cloudflare blog on the same event (verify; say "reported" for camera counts).