How to remediate – Open Network Video Interface Forum (ONVIF) Protocol Detection

1. Introduction

The Open Network Video Interface Forum (ONVIF) Protocol Detection vulnerability means a device responds to ONVIF requests, indicating it supports this network protocol for IP cameras and video management systems. This matters because ONVIF devices can be targeted by attackers seeking unauthorised access or control of surveillance systems. Affected systems are typically IP cameras, network video recorders, and related video security equipment. A successful exploit could lead to loss of confidentiality, integrity, and availability of video feeds and device settings.

2. Technical Explanation

The vulnerability occurs because the remote device answers a NetworkVideoTransmitter WS-Discovery request, confirming ONVIF support. This isn’t a fault in itself but reveals information about the system’s capabilities to potential attackers. An attacker could use this knowledge to attempt further exploitation of known ONVIF vulnerabilities or misconfigurations. There is no specific CVE currently associated with simply detecting ONVIF support; however, numerous exploits target ONVIF implementations. For example, an attacker might try default credentials or known command injection flaws in the ONVIF service.

• Root cause: The device responds to a standard WS-Discovery request used by ONVIF.
• Exploit mechanism: An attacker identifies the presence of ONVIF and attempts to exploit weaknesses within the protocol implementation, such as default credentials or command injection vulnerabilities.
• Scope: IP cameras, network video recorders (NVRs), and other devices supporting the ONVIF standard are affected. Specific versions depend on the device manufacturer.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking for an ONVIF response to a WS-Discovery request, or by reviewing the device’s documentation. A thorough method involves network traffic analysis.

• Quick checks: Check the device’s web interface for settings related to ONVIF configuration and status.
• Scanning: Nmap can detect ONVIF services using script `onvif-get-device-info`. Example: nmap -p 80 --script onvif-get-device-info
• Logs and evidence: Device logs may show responses to WS-Discovery requests. Look for entries related to ONVIF or UPnP services.

ping -c 1 ; nmap -p 80 --script onvif-get-device-info 

4. Solution / Remediation Steps

The primary solution is to filter access to the port used by ONVIF if it’s not required. This reduces the attack surface.

4.1 Preparation

• Ensure you have access to restore the original configuration if needed. A roll back plan is to revert the firewall rule or service settings.
• A change window may be required depending on your network environment and security policies. Approval from a senior IT administrator might be needed.

4.2 Implementation

1. Step 1: Block incoming traffic on port 80 (or the relevant ONVIF port) using your firewall.
2. Step 2: If ONVIF is required, restrict access to trusted IP addresses only.

4.3 Config or Code Example

Before

# Allow all traffic on port 80 (example firewall rule)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

After

# Block all traffic on port 80, then allow from trusted IPs only.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s  -p tcp --dport 80 -j ACCEPT

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help mitigate this vulnerability type. Least privilege reduces the impact of a successful exploit, while network segmentation limits lateral movement.

• Practice 1: Apply least privilege principles, granting only necessary access to devices and services.
• Practice 2: Implement network segmentation to isolate sensitive systems like IP cameras from critical networks.

4.5 Automation (Optional)

# Example Ansible playbook snippet to block port 80 on firewalld
- name: Block ONVIF port (port 80)
  firewalld:
    port: 80/tcp
    permanent: true
    state: disabled
    immediate: yes

5. Verification / Validation

Confirm the fix by checking that the device no longer responds to ONVIF requests, or by re-running the Nmap scan. A smoke test should verify basic camera functionality.

• Post-fix check: Run nmap -p 80 --script onvif-get-device-info and confirm no ONVIF information is returned.
• Re-test: Re-run the Nmap scan from section 3 to verify that the device is no longer detectable via ONVIF.
• Smoke test: Verify you can still access the camera’s live video feed through its web interface or viewing software.
• Monitoring: Monitor firewall logs for blocked connections on port 80, indicating attempts to connect to the ONVIF service.

nmap -p 80 --script onvif-get-device-info 

6. Preventive Measures and Monitoring

Update security baselines with firewall rules blocking unnecessary ports, and include checks in deployment pipelines to prevent similar misconfigurations. A regular patch cycle is also important.

• Baselines: Update your network device baseline configuration to block unused ports like 80 by default.
• Pipelines: Add a check in your CI/CD pipeline to ensure that new devices are not configured with open ONVIF ports unless explicitly required.
• Asset and patch process: Implement a regular review cycle for device configurations, checking for unnecessary services or open ports.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Blocking port 80 could affect web-based applications using the same port.
• Risk or side effect 2: Incorrect firewall rules may block legitimate traffic.
• Roll back: Step 1: Revert the firewall rule to allow incoming traffic on port 80. Step 2: Verify that affected services are functioning correctly.

8. References and Resources

• Vendor advisory or bulletin: Check your device manufacturer’s website for specific ONVIF security recommendations.
• NVD or CVE entry: No specific CVE exists for simply detecting ONVIF support, but search NVD for vulnerabilities related to ONVIF implementations.
• Product or platform documentation relevant to the fix: Refer to your camera’s user manual for details on configuring ONVIF settings and firewall rules.