Cybersecurity Videos

Black Hat USA 2025 | Turning Camera Surveillance on Its Axis

At Black Hat USA 2025, Noam Moshe of Claroty Team82 exposed a critical flaw in Axis Communications’ Access Remoting protocol, the encrypted channel used by enterprises to manage fleets of IP cameras remotely. The protocol, built on MTLS and NLMSSP authentication, wraps a JSON‑based RPC layer. Moshe discovered that Axis enabled Newtonsoft.Json’s TypeNameHandling=Auto, allowing a client to dictate the .NET type instantiated on the server. By injecting a specially crafted JSON payload, an attacker can trigger arbitrary object creation, leading to remote code execution. Although the service requires valid credentials, the researcher demonstrated a pass‑the‑hash attack against the NLMSSP handshake and a man‑in‑the‑middle setup to inject the payload. In practice Moshe generated a malicious payload with YSOSerial, obtained a reverse shell on the Access Device Manager, and then leveraged Axis’s modular SDK to push a custom package to every camera under the compromised manager, achieving code execution on the client, server, and all connected cameras. He highlighted the “type name handling auto” setting as the root cause and showed how the fallback HTTP‑like channel could be reverse‑engineered to bypass standard checks. The vulnerability gives threat actors full control over surveillance infrastructure, exposing live feeds and enabling persistent footholds in corporate networks. Organizations that expose Access Remoting to the internet or rely on Axis’s cloud‑less remote access must urgently patch or disable the feature, and vendors need to reconsider unsafe deserialization defaults across IoT products.