Devil’s Ivy

Devil’s Ivy is a security vulnerability that when exploited enables an attacker to remotely access a video feed and deny the owner access to the feed. In July 2017 the security firm Senrio uncovered a stack buffer overflow vulnerability in the open source third-party toolkit gSOAP, which is used in millions of Internet of Things (IoT) devices, including security cameras from numerous vendors.

Senrio dubbed the vulnerability “Devil’s Ivy” because, like the Devil’s Ivy plant, the attack is able to spread quickly and is nearly impossible to completely eradicate once it has started to spread. This is due in part to gSOAP being included in a toolkit that has been downloaded millions of times and is currently present in thousands of devices.

As an example, the Devil’s Ivy vulnerability was found to be present on 249 video cameras sold by manufacturer Axis, which is the company Senrio first discovered the Devil’s Ivy flaw on.

How Attackers Can Exploit the Devil’s Ivy Flaw

To initiate an attack on the Devil’s Ivy vulnerability, a hacker sends a malicious payload to port 80, at which point the camera or IoT device triggers the buffer stack overflow and initiates code execution at the attacker’s discretion.

In a worst-case scenario, an attacker could prey on the Devil’s Ivy exploit to spy on and gather sensitive video information or prevent video of criminal events like a robbery from being observed or recorded.

The developer of the gSOAP software, Genivia, has released a software update with a patch for the Devil’s Ivy vulnerability, but video cameras and other Internet of Things devices are seldom updated with new software releases in most cases. As a result, the vulnerability is likely to remain an issue in millions of devices for the foreseeable future.

Forrest Stroud
Forrest Stroud
Forrest is an experienced, entrepreneurial and well-rounded professional with 15+ years covering technology, business software, website design, programming and more.

Top Articles

The Complete List of 1500+ Common Text Abbreviations & Acronyms

UPDATED: This article was updated April 6, 2021 by Web Webster   From A3 to ZZZ we list 1,559 text message and online chat abbreviations to...

How to Create a Website Shortcut on Your Desktop

UPDATED: This article was updated April 6, 2021 by Web Webster   This Webopedia guide will show you how to create a desktop shortcut to a...

Windows Operating System History & Versions

The Windows operating system (Windows OS) refers to a family of operating systems developed by Microsoft Corporation. We look at the history of Windows...

What are the 5 Generations of Computers?

UPDATED: This article was updated on April 6, 2021 by Web Webster   Learn about each of the 5 generations of computers and major technology developments...

Random Access Memory (RAM)...

UPDATED: This article Updated April 6, 2021 by Web Webster   Random Access Memory (RAM)...

OEM – original equipment...

UPDATED: This article was updated April 6, 2021 by Web Webster OEM (pronounced as...

Best ERP Software for...

UPDATED: This page was updated April 6, 2021 by Web Webster   Enterprise resource planning...