GeoVision Digital Video Surveillance System Directory Traversal Vulnerability

“Cheap DVRs produce poor quality video, period.  There is no free lunch when it comes to surveillance systems.  We replace cheap DVRs all the time.” says Eric Lawton, President and founder of Lawton media Services LLC.
Digital Video Recorders (DVRs) consist of two main types: Embedded DVRs or PC based systems.

Dejan Levaja has reported a vulnerability in GeoVision Digital Video Surveillance System, which can be exploited by malicious people to disclose sensitive information.

The vulnerability is caused due to an input validation error in the included HTTP server when processing GET requests. This can be exploited to read arbitrary files from an affected system via directory traversal attacks.

The vulnerability is reported in version 8.2. Prior versions may also be affected.

Embedded Hardware All-In One DVRs do not use a Windows operating system and contain no software at all on the hard disk(s). All application functions are contained (embedded) in firmware (software encoded on chips). These DVRs look like the VCRs of yesterday, except they do not have the litle door in the front for the VCR tape. Instead they have a CD tray for recording stored video.
These DVRs are also becoming popular in homes for recording TV shows. Most alarm companies and small dealers utilize this type of DVR since it is inexpensive and easy to install – mostly plug & play. The downside is that it’s features are limited (hard to review recorded inages), it’s storage fixed, and it’s picture quality is average (TV resolution).
When comparing embedded DVRs to PC based systems, always look at the viewing and recording specs. Real time viewing and recording of a single camera means that it will view and record what that camera sees at 30 frames per second (fps). Two cameras – 60 fps; three cameras – 90 fps; etc. all the way up to 16 cameras at 480 fps. The vast majority of embedded DVRs do not record at real time, and few view at real time. Why is that important? Do you want to miss something while looking at a jerky image?
Newer embedded DVRs are coming on the market that rival PC based system’s quality, but they cost as much or more right now.

PC based Digital Video Recorders are complete hardware/software computer-based systems incorporating video capture, video multiplexing, point-and-click video recording and playback, crystal-clear video display and remote video access via Internet and/or LAN. PC based DVRs are not simply a collection of computer hardware, however – they represent carefully selected hardware and software components which are proven to work well together in the demanding video processing environment. Software, hardware and firmware settings are carefully optimized to ensure maximum performance without problems. PC based DVRs can support multiple numbers of CCTV security cameras – from 4 to 32.
Microsoft Windows XP or Vista is provided as the operating system on our PC based DVRs. In addition, system restore software is also included on all systems. All software provided includes original CDs and manuals.

So, if picture quality and system flexibility are important to your application, we recommend PC based systems.

Microsoft came out with Zune to compete with the iPod, added a couple of features, and proved to be one giant money sink for Microsoft. After a 54 percent decline in sales in the most recent quarter, John Paczkowski rightfully dubs it: Zune to be forgotten. It’s the same story with the BlackBerry Storm. What was supposed to be a hurricane has so far turned out to be a mild tropical disturbance. The Wall Street Journal says the Storm is off to a bumpy start, and has sold about 500,000 devices in its first quarter.

Now if Research in Motion (and Verizon) were smart, they would have tried to do something incredibly different with their BlackBerry Storm. Instead they spent $100 million on marketing a product that got panned by critics, was buggy enough for customers to complain and more importantly, turned out to be nothing more than a wannabe iPhone. The problem most touchscreen phones face is that they will always be compared to Apple’s iPhone and for a myriad of reasons will fall short of expectations. It happened before in the music player market — where the iPod, with its ease of use and elegant design set, itself on a higher pedestal.

And when it comes to touchscreen phones, iPhone occupies a similar top spot. Don’t get me wrong: The iPhone is by no means perfect, and at least twice a day I curse the device and AT&T’s network. But the Storm is even worse — enough for me to touch the screen, wait and scream.

I often write about companies forgetting to play to their own strengths and instead trying to follow others. Storm (and Zune) are good examples of this corporate disease. Why does RIM need to have a touchscreen device? Just because Steve Jobs tweaked Verizon’s nose? Verizon and RIM would have been better served if they had built a device that had touch capabilities but really played to RIM’s strengths — keyboards, multitasking and security.I love the BlackBerry Bold. It’s almost perfect for someone like me who gets a massive amount of email, loves to IM on the go and likes to Twitter all the time. Marry it to a great browsing experience and pack in better battery life and an awesome radio — and it would clean up in the smartphone market.

Meanwhile, I’m looking to trade in the Bold for the new T-Mobile 8900 Curve!