A popular smart security system maker has ignored warnings from security researchers that its flagship device has several serious vulnerabilities, including allowing anyone access to the company’s central store of customer-uploaded video recordings.
The researchers at 0DayAllDay found that Guardzilla’s top-selling indoor wireless security system contains a set of hardcoded keys that can be easily extracted, because the device’s root password was protected using a decade-old algorithm that’s nowadays easily crackable. Each device uses the same set of keys to upload video recordings to the company’s Amazon Web Services’ storage servers. Anyone can use these keys to log in and gain full access to the company’s cloud storage — and customer data uploaded from the device.
But the storage servers remain vulnerable — even at the time of publication, TechCrunch can confirm — despite the researchers privately emailing the company detailing the vulnerabilities in September.
“We’ve tried several avenues to get in touch with Guardzilla, but they have not acknowledged the report,” said Tod Beardsley, Rapid7’s research director, who helped coordinate the release of the researchers’ findings.
The team of five researchers said in their report that it took two off-the-shelf consumer graphics cards just three hours to decrypt the eight-letter password protecting the affected Guardzilla device’s firmware that ships with each device. Because the keys were buried in the code, anyone with a Guardzilla device could obtain the keys and gain unfettered access to the company’s 13 storage buckets hosted on Amazon’s servers. The researchers tested the keys but did not use them to access the buckets, they said, to prevent unintentional access to Guardzilla customer data.
TechCrunch confirmed that the keys were still active and linked to the listed buckets as of Wednesday. (We could not verify the contents of the buckets as that would be unlawful.)
Hardcoding keys isn’t an uncommon practice in cheaply manufactured internet-connected devices, but is considered one of the worst security practices for a hardware maker to commit as it’s easy for a hacker to break into a central server storing user data. Hardcoding keys has become such an acute problem that a recently passed California law will soon ban consumer electronics using default and hardcoded credentials from 2020 on.
Fixing the vulnerability not only requires the keys to be changed on the server, but also a software patch to be rolled out on each affected device.
“They could update the keys and update the firmware, but that just means they’ll be rediscovered again by the same techniques,” said Beardsley. “The only way I can think of to fix this completely is to change the keys, stand up a proxying service and update the firmware to use this proxying service with unique-per-device accounts.”
“That’s a pretty significant change, but it’s just about the only way to avoid this kind of problem,” he said.
Guardzilla were given three months to fix the security lapse and roll out new firmware to affected devices after the researchers privately reached out, but the company neither acknowledged nor patched the issue, prompting the researchers to go public with their findings.
The researchers also disclosed the vulnerabilities to Carnegie Mellon University’s public vulnerability database, CERT, which is set to issue an advisory Thursday, but received no response from the company.
TechCrunch sent several emails to Guardzilla prior to publication, to no avail. It was only after we contacted the company’s registered agent, a law firm in St. Louis, Missouri, when chief executive Greg Siwak responded to our request for comment — hours before publication. In his email, Siwak denied that the company received any correspondence. We asked several questions to clarify the company’s position, which we will include here if and when they come in. Siwak was adamant that the “accusations are false,” but did not say why.
When reached, former Guardzilla president Ted Siebenman told TechCrunch that he left the company in February but claimed he was “not aware” of the security issues in the device, including the use of hardcoded keys.
The security researchers found two more vulnerabilities — including several known bugs affecting the device’s continued use of a since-deprecated OpenSSL encryption library from more than two years ago. The researchers also disclosed in their write-up their discovery “large amounts” of traffic sent from an open port on the device to Guardzilla’s Amazon server, but could not explain why.
Guardzilla doesn’t say how many devices it’s sold or how many customers it has, but touts its hardware selling in several major U.S. retailers, including Amazon, Best Buy, Target, Walmart and Staples.
For now, your safest bet is to unplug your Guardzilla from the wall and stop using it.