iVideon Russian-based video surveillance solution leaked data, hundreds of thousands of records exposed

Security researchers from Kromtech Security discovered a MongoDB install belonging to the Russian-based video surveillance firm Did iVideon open online.

The database included personal information for over 825,000 subscribers and partners.

Leaked records include logins, email addresses, password hashes, server names, domain names, IP addresses, sub accounts, software settings, and payment settings information (we did not see any credit card data) for both individual subscribers and partners.

iVideon is a multi-platform solution that allows subscribers to aggregate, access, view over the Internet, and record locally or to iVideon’s secure cloud storage, nearly any Internet capable CCTV camera, DVR system, baby monitor, web cam, nanny cam, or even phone, computer, and tablet cameras.

Below the tables included in the MongoDB archive:

• servers.info: 12533 records
• ivideon.servers: 810871 records
• ivideon.partners: 132 records
• ivideon.users: 825388 records

The experts reported their discovery to firm that promptly took the archive down.

According to iVideon the server was used for load testing of our auth APIs in Feb 2016, in 2017 the testing policy has been revised, so that such kind of security issues won’t happen again.

The Russian firm added that the archive included password hashes using the Bcrypt algorithm that is considered secure.

“The DB was populated with accounts & devices of several hundreds of Ivideon users marked for participation in beta-testing (Ivideon employees & external early adopters, mostly from Russia), copied multiple times to simulate some growth scenarios.” states the reply from iVideon shared by Kromtech Security.

“User info only included email, IP address and password hashes produced by a strong Bcrypt algorithm. No information related to payments, usage stats or means of getting access to user’s private data was present in the compromised DB. Partner data seen in the DB was real, containing only partner companies’ names and UI settings for their apps.”

The company was also the victim of an attack, hackers tried to blackmail it, unfortunately, attackers have left no info in the logs. Crooks demanded a .2 bitcoin ransom, the wallet they used received two payments probably made by other victims of the gang.

iVideon believes that exposed data do not pose a threat to its users or partners and downplayed the incident.

Kromtech Security applauded the company for its rapid response to the incident.

“We also definitely agree that one should not pay ransom in cases such as this, we’ve seen that it’s nothing but a scam. Their ability to quickly ascertain that only some of the deleted data was real and that aggregate traffic statistics on a  router prove to them that it was not stolen will come as a relief to those who had real data in that database.” concluded Kromtech Security.

 “Those users should also be pleased to know that they solved this issue in 2017 so that the data we found this year won’t be found again.”

Kromtech experts confirmed that data included in the archive appeared to be legitimate.

The researchers noticed that after they discovered and reported it to iVideon, and prior to the company taking it down, this database was compromised in the same fashion.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – privacy, data leak)

[adrotate banner=”5″]

[adrotate banner=”13″]