"Backdoors," or ways to access devices that have been cemented into the firmware's code, were also prevalent. It's a bad security practice, but developers often forget to remove backdoors before code is released or underestimate the ability of a hackers to find them.
The researchers searched the firmware images for terms that could indicate the presence of a backdoor, and they found 326 instances.
One of those instances, a backdoor in some Linux-based firmware, could allow a hacker to take control of a home automation device and potentially turn someone's lights off remotely, they discovered.
What was interesting is that they then found the exact same backdoor in 44 CCTV cameras from a different vendor, and in home routers from an unnamed "major networking equipment vendor." But it turned out the weakness wasn't really the fault of those vendors.
All the devices, it turned out, used a networking chip from another manufacturer, who had apparently left the backdoor in the firmware for de-bugging purposes. They weren't sure who the chip vendor was, but they planned to acquire some of the devices and do more research.
The study was also co-authored by Andrei Costin[cq], Jonas Zaddach[cq] and Davide Balzarotti[cq], all of Eurecom.
Sign up for CIO Asia eNewsletters.