Hello and welcome to the Monday, July 20th, 20th, 2006 edition of the Sands Internet Storms Centers, Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sandsdddu graduate certificate program

in penetration testing and ethical hacking well today's internet storm center diaries from our good old

friend hickvision and some new scans that we're seeing for the Hickvision Open Intelligent Security API.

This API, often abbreviated as ISAPI, is used essentially to remote control these cameras and

configure them. It's a fairly straightforward rest API using basic or digest authentication. Now, the scans we are seeing,

they're looking for the system slash status endpoint. That particular endpoint essentially

sort of fingerprints the camera or the DVR that the cameras are connected to. I believe this is

really more sort of a reconnaissance scan we are seeing here, not an actual attack yet.

But I haven't really seen sort of scans for this particular URL before.

So I figure that maybe someone found something new here could be used for brute forcing because

this particular endpoint is always

available on these cameras

and as a result

could for example look for

400 errors whether or not

it doesn't exist like a 404

or maybe a 401 or 403

error if all if authentication fails.

And late last week, we had multiple news outlets report about LG monitors installing AdWare

and, well, also spyware on users' systems.

...