I wrote these texts for a security company I applied to. The brief was to write a media release about the outcome of security research conducted by the company. The hypothetical research concerned a vulnerability in IoT security cameras.
I have replaced the company's name with "Beta".
Beta security researchers have discovered traces of source code for malware dubbed "Kismet" in a popular, networked security camera range running Linux called AcmeCam.
Roughly two million AcmeCam cameras were sold in 2016, alone, and are available in homes and businesses worldwide.
In Beta's tests, AcmeCam cameras are typically compromised in less than 75 seconds after being connected to a network. The cameras are quickly attacked by a Kismet-based worm and infected by downloading an unsigned malware update over the unsecured http protocol.
When triggered, a Kismet can penetrate any device that shares a network with its host AcmeCam by tunneling through network level security safeguards. Kismet is specifically designed to seek out sensitive personal data and financial information and distribute it to a series of local nodes.
The attack vector is through AcmeCam firmware updates that are inadequately secured with default usernames and passwords that are, in turn, hard coded into all AcmeCam cameras.
Poor security in a popular brand of networked security camera could soon be responsible for one of the biggest data leaks in history. Beta's security researchers have discovered code for a new generation of malware that is likely already present in millions of devices already.
Source code for malware dubbed "Kismet" was released on Hackforums, the same forum the Mirai source code was published on. Similar to Mirai which infected Linux-based IoT devices, Beta's researchers have found Kismet code in a popular, networked security camera range running Linux called AcmeCam.
Roughly two million AcmeCam cameras were sold in 2016, alone, and are available in homes and businesses worldwide. In Beta's tests, AcmeCam cameras are typically compromised in less than 75 seconds after being connected to a network. The cameras are quickly attacked by a Kismet-based worm and infected by downloading an unsigned malware update that slaves the camera to a local node.
When triggered, a Kismet can penetrate any device that shares a network with its host AcmeCam by tunneling through network level security safeguards. Kismet is specifically designed to seek out sensitive personal data and financial information and distribute it to a series of local nodes.
The attack vector is through AcmeCam firmware updates that are inadequately secured with default usernames and passwords that are, in turn, hard coded into all AcmeCam cameras. The AcmeCam update service ignores industry standard authentication best practices and accepts new, unsigned firmware updates over the unsecured http protocol.
According to Beta's lead researcher, Yoni Bloggs, "the prevalence of cheap, networked security cameras continues to present a serious risk to commercial and personal data security for as long as their manufacturers continue to implement sub-standard security to safeguard firmware updates for the sake of expediency and cost savings".
Beta notified AcmeCamCo shortly after discovering the vulnerability in March 2017. AcmeCamCo failed to respond to our notification or take any of our recommended remedial steps. Given the prevalence of AcmeCam cameras, the only responsible course of action was for Beta to release the security team's findings so AcmeCam customers can take steps to mitigate the risk infected camera pose to them.
Beta's full report is available on the Beta website.
Note: I was also asked to outline how I would distribute this hypothetical media release in a format that could be adapted to a presentation
- Edit the content to ensure it reads clearly in English
- Identify key journalists/columnists dealing with infosec themes and reach out to them with a copy of the research and the research abstract
- The Hacker News
- TechCrunch
- Ars Technica
- Brian Krebs
- CSO (IDG)
- Etc …
- Prepare a blog post summarizing the research findings to be published on the Beta blog based on the media abstract
- Create an infographic with key data-points from the research and share on Twitter and LinkedIn with a link back to a blog post (incorporate the infographic into the blog) - if possible make the infographic embeddable so journalists and commentators can embed the infographic in their articles and link back to the blog post
- Share the core findings of the report in newsletter to clients with social sharing links