Canon DSLRs are Vulnerable to Ransomware

https://petapixel.com …somware-update-yours-now/

Thoughts?

Saw that article as well. Pretty scary. But I never tether and rarely use the WiFi feature. I have a Lightning SD card reader for those days I want to transfer to my iPhone.

I suppose we should be grateful that some white hat guys found the vulnerability first. In looking at the code snippets, I wonder if a better validation check would be something other than block size. The positive thing is that at least they were checking something. So one can't blame Canon for sloppy programming. In this day and age, the bad guys are more highly motivated (by greed) than the good guys and they're hiring good programmers to do their dirty work. So extreme caution and vigilance are needed.

While I commend Check Point Research for discovering this vulnerability and I can understand why they would want to publicize it for glory, I wonder if it might clue the bad guys in to the reality that there's low hanging fruit in other brands that could be exploited.

What a world! There are days when I think that there is no hope for our species.

kenwood33 wrote in post #18909506
Thoughts?

Definitely a problem, but probably not one that would be a used on anything but the tinyest scale.

https://research.check​point.com …omware-ing-a-dslr-camera/

^^^ the original technical write up on the issue

Anyone that has used Canon's wifi tethered knows that it tears through batteries like a teenage boy tears through a pepperoni pizza. When I use it, i turn it on, directly connect to my phone and then turn it off. No one should be walking around with it on.

I have connected the camera to exactly one wifi network and that was my own when I first got the camera. I use USB tethering with my laptop 99 percent of the time because it is a much better experience. Hard for me to imagine a time where I would connect the camera to a random wifi network.

I don't know about other cameras, but my 6D's range is pretty tiny. An attacker would have to do a good bit of work and then be within a short range of a potential target who had their camera set up to automatically join a network.

This whole thing can be done over USB from an already compromised computer, but that seems like an even more remote possibility.

Reformat flash card, re-apply firmware.

But it is good on Canon to collaborate and provide security check.