Hello, welcome to the Monday, July 11th, 2016 edition of the Santernet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

A couple weeks ago, I talked about how security cameras are being used to launch DDoS attacks.

Back then, the story was somewhat raw and not a lot of details. Rob now has

an interesting story looking at the web server being used by many of these security cameras.

Turns out this is the Boa web server. Small web server seems to be very popular with these security

cameras even though

the last update was released over 10 years ago on February 2005. Since then, vulnerabilities have

been discovered in this web server, but the web server itself has not been updated, despite that several of these camera vendors continue to use this outdated version of the Boa web server.

So Rob took a look at these vulnerabilities which are pretty easily exploited and also gives you some hints as to how to find this web server on your

network because well it's just a time bomb ticking there waiting to be exploited.

Outdated code like this that cannot be patched and default passwords and insecure protocols like

Telnet. All of this is really the domain of industrial control systems.

Kevin Liston recently took the industrial control system security class or ICS security class and he summarized in a diary some of the lessons he learned, like for example, network isolation and how

applicability they are for other networks as well. Interesting diary, if you wonder about the

lessons he learned, well, take a look at it. And let's stick with devices here for another

story and that's, well, cars. haven't heard about car hacking in a while this

latest story is about the bmw connected car portal in this portal you can essentially manage

and remote control some features of your car and apparently they don't validate Vince correctly when you add them.

With that, you can then essentially add arbitrary cars to your account and gain control over these cars.

In addition, there is also a cross-site scripting vulnerability in that portal that could be exploited in order to

inject JavaScript and control a user's browser.

...