312-50 Question 411
Single answer▪ IoT AttacksDuring an authorized assessment of a smart building, you discover several IP cameras exposed on the internal network. The cameras run an embedded Linux-based web interface and stream video over RTSP. The client is concerned that an attacker who gains a foothold on the network could take over the cameras at scale and use them in a botnet-driven DDoS attack similar to past IoT incidents. Which action would BEST demonstrate a realistic IoT attack path that could enable mass compromise of these cameras?
- A
Test the cameras for default or weak administrative credentials and attempt authenticated access to the management interface
- B
Perform an SQL injection attack against the RTSP video stream to extract administrator passwords from the camera firmware
- C
Use Bluetooth pairing attacks to compromise the cameras because most IP cameras expose administrative services over Bluetooth by default
- D
Exploit WPA3 downgrade attacks directly against each camera's web interface, even though the devices are already reachable on the wired internal network
Show answer and explanation
Correct answer: A
Explanation
The best answer is testing for default or weak administrative credentials. In real-world IoT attacks, especially against cameras, DVRs, and similar embedded devices, credential abuse is one of the most practical and scalable compromise methods. Botnets such as Mirai became notable for leveraging default credentials on IoT systems to conscript devices for DDoS operations. In a CEH-style scenario, the candidate should identify the most operationally realistic path rather than a theoretically possible but poorly matched technique. Security best practices from organizations such as NIST emphasize changing default passwords, reducing exposed management services, segmenting IoT networks, and keeping firmware updated. For camera ecosystems, assessors should also review exposed services such as HTTP/HTTPS, Telnet, SSH, RTSP, and ONVIF, but among the listed choices, credential testing against the management interface is the strongest demonstration of a realistic mass-compromise path.
- A. Correct.
Correct. Weak or default credentials remain one of the most common and practical attack paths for IoT device compromise, especially for IP cameras and DVR/NVR ecosystems. Large-scale IoT botnets such as Mirai historically spread by scanning for exposed services and attempting known default credentials over management interfaces such as Telnet, SSH, or HTTP/HTTPS. In a realistic internal-network scenario, validating whether the cameras still use default or weak passwords is a strong demonstration of how an attacker could gain control of many devices quickly and potentially repurpose them for botnet activity.
- B. Incorrect.
Incorrect. RTSP is a streaming/control protocol for media sessions, not a database-backed application interface where SQL injection would typically apply. While a camera web application could theoretically have injection flaws elsewhere, an 'SQL injection against the RTSP stream' is not a realistic or technically sound primary path here. This option reflects a common misconception of applying web attack categories to protocols that do not process SQL queries.
- C. Incorrect.
Incorrect. Standard enterprise IP cameras are commonly administered over web, SSH, Telnet, ONVIF, or vendor-specific network services, not Bluetooth by default. Some consumer IoT devices may support Bluetooth for onboarding, but assuming most IP cameras expose admin services over Bluetooth is inaccurate. This distractor targets the misconception that any IoT device is equally likely to be attacked through short-range wireless protocols.
- D. Incorrect.
Incorrect. WPA3 downgrade issues relate to wireless network security negotiations, not to attacking a web interface on devices that are already accessible from the wired internal network. If the cameras are reachable on the internal LAN, the more direct and realistic attack path is through their exposed management services and credentials. This option confuses wireless access-layer attacks with application or device management compromise.