Flaw in Guardzilla home security devices allows outsiders to view stored video, researchers say

Guardzilla’s indoor wireless security system, the GZ501W, contains hardcoded security keys rendered vulnerable by an outdated algorithm that researchers say is easy to crack.

A popular home security device made by Guardzilla contains a security vulnerability that could make it possible for outsiders to access video recordings, according to research published Thursday.

Guardzilla’s indoor wireless security system, the GZ501W, contains hardcoded security keys rendered vulnerable by an outdated algorithm that TechCrunch reports is easy to crack. Hackers can use those keys to log on to Guardzilla’s storage servers at Amazon Web Services to access data uploaded by customers, according to the new findings. Researchers from 0DayAllDay released their findings Thursday after notifying Guardzilla to the vulnerabilities in September and receiving no response.

[W]e’re publishing this [Thursday], which happens to be right about 60 days after our first disclosure to the vendor of this video camera,” Tod Beardlsey, research director at Rapid7, explained in blog post. Rapid7 was involved in the research.

“Unfortunately, despite multiple efforts at coordination with the vendor, we haven’t heard back from them at all,” the blog reads.

Guardzilla did not respond to a request for comment from CyberScoop.

TechCrunch reported that a representative for Guardzilla’s registered agent said the “accusations are false” without providing detail or answering follow-up questions.

Researchers advised users to wait for a security a patch that will fix the flaw. Without a patch, device-owners should ensure that the cloud-based data storage functions of the devices are not enabled.

Hardcoded passwords remain a problem in many inexpensive connected devices. Hackers have programmed malicious software to automatically guess hardcoded passwords to infiltrate and take control of devices without the owner’s knowledge or permission. Such passwords allow cybercriminals to launch distributed denial-of-service attacks, which have knocked websites as popular as Spotify and Netflix offline in recent years.

The flaw allowing unauthorized access to data stored in the cloud is not the only Guardzilla vulnerability reported Thursday. Among the other issues were several known security bugs regarding the company’s ongoing use of an OpenSSL encryption library that was widely abandoned years ago, according to TechCrunch.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure