Security Experts:

Connect with us

Hi, what are you looking for?


Security Infrastructure

Thousands of CCTV Devices Abused for DDoS Attacks

A botnet powered by tens of thousands of compromised CCTV devices located all around the world has been observed launching distributed denial-of-service (DDoS) attacks against websites.

A botnet powered by tens of thousands of compromised CCTV devices located all around the world has been observed launching distributed denial-of-service (DDoS) attacks against websites.

Web security firm Sucuri was recently called in to mitigate a DDoS attack aimed at the website of a small jewelry shop. The layer 7 attack peaked at nearly 50,000 HTTP requests per second and lasted for days, even after Sucuri stepped in.

An analysis of the attack source revealed that the attackers had been leveraging compromised CCTV devices to generate the large volume of requests. Researchers identified over 25,000 unique IP addresses located in Taiwan (24%), the United States (12%), Indonesia (9%), Mexico (8%) and Malaysia (6%). While 75% of the bots were located in the top ten most affected countries, the rest were spread out across 95 other countries.

The IP addresses showed that nearly half of the affected devices had generic H.264 DVR logos. The devices whose brands could be identified came mostly from Provision ISR, Q-See, QuesTek, TechnoMate, LCT, Capture, Elvox, Novus and Magtec.

Another noteworthy aspect of the attack was that nearly 5% of the IPs came from IPv6. “That’s a change we expect to keep happening as IPv6 becomes more popular,” said Sucuri’s founder and CTO, Daniel Cid.

It’s not uncommon for malicious actors to leverage Internet of Things (IoT) devices for DDoS attacks, but Sucuri said this was the first time it had observed an attack powered solely by CCTV devices.

While the security firm could not confirm exactly how all these CCTV devices got compromised, one theory is that attackers exploited a remote code execution vulnerability disclosed recently by security researcher Rotem Kerner.

The expert reported in March that he had identified a remote code execution flaw affecting surveillance cameras sold by more than 70 vendors. Kerner conducted a Shodan search and identified more than 30,000 vulnerable devices, but noted that the actual number was likely much higher.

While it’s unclear if attackers exploited the vulnerability found by Kerner, the affected brands named by Sucuri are among the 70 vendors listed by the researcher in March.

Related: Surveillance Video Recorders Exposed by Hardcoded Passwords

Related: Malware Found in IoT Cameras Sold by Amazon

Related: Serious Flaw Found in Popular D-Link Wi-Fi Camera

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Security Infrastructure

Comcast jumps into the enterprise cybersecurity business, betting that its internal security tools and inventions can find traction in an expanding marketplace.


Identity and access governance vendor Saviynt has closed a $205 million financing round.

Security Infrastructure

XDR's fully loaded value to threat detection, investigation and response will only be realized when it is viewed as an architecture


Security orchestration, automation and response (SOAR) provider Swimlane on Monday announced the launch of a security automation solution ecosystem for operational technology (OT) environments.

Incident Response

Created and maintained by MITRE, MITRE D3FEND is a framework that provides a library of defensive cybersecurity countermeasures and technical components to help organizations...

Cloud Security

The term ‘zero trust’ is now used so much and so widely that it has almost lost its meaning.