Scenario

Many cameras (broadly exposed on the net) connected to a centralized server, the data stream can be seen only by clients connected to the server via internal network.

Objective

• Redirect data stream
• Take control of all cameras
• Add new cameras
• Get access to the central server as root

Attack

• Dos with Syn flooding to crash a camera. Then Social engeneering phishing to get IP Address and user credentials (playing the "Camera installer" role)
• Cameras exploits
• Theft of SSH keys
• Access to the main server with the stolen keys
• Priviledge escalation via kernel vulnerability (server cannot be easly restarted)
• Post exploiting

Defense

• Use a system where it's necessary sending email or calling the Supervisor (however bypassable)
• Use a better Firewall configuration
• Use NIPS and HIPS on camera network
• Use SeLinux or Apparmor to limit attacks and give more protection to the keys
• Use SeLinux or Apparmor on the server (priviledge escalation go out of context)
• Use a Livepatching system on the server (expensive)
• Use a minimal Docker container, such as Alpine Linux, without exposed services, just with a minimal mapping to have a working communication.