Hackers Once Again Hijack Samsung’s SmartCam With iWatch Root Exploit

As we've discussed multiple times before here at HotHardware, IoT device makers have largely been unconcerned about security up until this point, which means that way too many devices in use out there in the wild are sitting there unsecured. Samsung's Smartcam is one such device.

After Smartcam's launch, hackers discovered a couple of huge vulnerabilities, which Samsung acknowledged immediately. However, instead of actually fixing the issues, Samsung crippled the device, removing the entire Web admin interface that customers would use to configure their camera. Instead, customers were shifted to use a cloud-based service for tackling the same operations instead.

Well, as if that crippling of functionality wasn't bad enough, it appears that Smartcam still has issues. According to website Exploitee, a script used for firmware updates was left intact even after the Web interface was pulled, and it happens to suffer a command injection bug that can escalate a remote user to become root. Ouch.

In the video above, the entire exploit is carried out from start to finish. With a special command, the Smartcam is tricked into instantly exploiting the bug, at which point the device becomes accessible to via a telnet login. The cool thing is that this exploit would allow someone to reenable the Web interface that Samsung decided to disable. However, with this new exploit being revealed, we can imagine that Samsung won't waste much time patching it as well. Maybe the company should be a little more thorough in its security audit this time around?