Skip to main content

Directory disclosure vulnerability in facial recognition software

There are at least a dozen, most likely many more, Embedded Facial Recognition Systems online on the World Wide Web with a basic software flaw that allows anyone without credentials to browse the /images directory, download log files, and view enrolled images.

I was able to locate the systems on Shodan searching for - html:facial html:recognition html:embedded country:"US" - and once on the log-in pages, simply inspecting the page source revealed the path to the background image.








Navigating one directory up revealed the directory listing, and I was able to navigate to the folder "logs" and download .bmp files of faces enrolled in the system, as well as system files.



Many of the systems seem to be on dedicated IP blocks (inferred from searching Shodan for the IP's ASN, net:"xx.xx.xx.0/24"), and the owner of some systems can be gleaned from other devices on the network. These are not law enforcement systems, from what I can discern, rather access control devices at commercial and industrial sites.

I've been able to identify the system just by searching for "embedded facial recognition" software (embedded in this case means the sensor and the analytics are combined, as opposed to the alternative of a system that conducts analysis of user-submitted probe images taken by independent cameras). It's AccuFACE by PSPSecurity, and believe it or not, PSP's website is down.


Log in screen I found through Shodan
AccuFACE software design, with the same background graphic.

At least a dozen, probably many more, such systems using the same software have this common flaw, so it's a good example of what's really a general exposure of this kind of surveillance technology to dilettantes like myself browsing Shodan.

With inexpert trawling of I've been able to access recorded drone footage, a Highway Patrol surveillance trailer, dialed number recorders, many automated license plate reader servers, as well as more facial recognition portals than I've been able to check for possible access.

Just from the few facial recognition servers I've tried so far, I've been able to view and download footage and its metadata.



But it gets much worse.


They're still looking for Hitler.

Comments

  1. This comment has been removed by a blog administrator.

    ReplyDelete
  2. This comment has been removed by a blog administrator.

    ReplyDelete
  3. This comment has been removed by a blog administrator.

    ReplyDelete
  4. This comment has been removed by a blog administrator.

    ReplyDelete
  5. In conclusion, discover an http://www.top10spyapps.es/ that is inside your buying power. Numerous incredible apps can work well for you at financially savvy rates despite the fact that they don't make it to the best five.

    ReplyDelete

  6. Very Good Information...

    SAS Training in Pune

    Thank You Very Much For Sharing These Nice Tips..

    ReplyDelete

  7. Your very own commitment to getting the message throughout came to be rather powerful and have consistently enabled employees just like me to arrive at their desired goals.

    Best Angularjs Training in Chennai
    Best Java Training in Chennai
    Best Bigdata Hadoop Training in Chennai
    Best SAS Training in Chennai
    Best Python Training in Chennai
    Best Software Testing Training in Chennai

    ReplyDelete
  8. I came to this blog and it helped me to add few new points to my knowledge. Actually, I am trying to learn new thing wherever I find. Impressive written blog and valuable information shared here. Oxygen Facial Treatment

    ReplyDelete
  9. simplest your non-stop work lets you get specification on your writing capability. hold eyes to your errors and take corrective activation right away. decorate yourself on every occasion you discover any mistakes for your written essay whether or not it's far a minor mistake. Skin Rejuvenation Treatment

    ReplyDelete
  10. I like the helpful info you provide in your articles. I’ll bookmark your weblog and check again here regularly. I am quite sure I will learn much new stuff right here! Good luck for the next!





    Dot Net Training in Chennai | Dot Net Training in anna nagar | Dot Net Training in omr | Dot Net Training in porur | Dot Net Training in tambaram | Dot Net Training in velachery






    ReplyDelete
  11. Freelance maintenance technicians also benefit from establishing relationships with multiple clients. Working as a freelancer, you’ll gain employment experience with a variety of businesses, boosting your overall skill set and providing you with more work opportunities in the future.

    maintenance technician

    ReplyDelete
  12. Very interesting blog. Many blogs I see these days do not really provide anything that attracts others, but believe me the way you interact is literally awesome.You can also check my articles as well.

    Security Guard License
    Ontario Security License
    Security License Ontario
    Security License

    Thank you..

    ReplyDelete
  13. With so many books and articles appearing to usher in the field of making money online and further confusing the reader on the real way to make money.

    Business Analytics Course in Bangalore

    ReplyDelete
  14. I am sure it will help many people. Keep up the good work. It's very compelling and I enjoyed browsing the entire blog.

    Data Analytics Course in Bangalore

    ReplyDelete
  15. Businesses should find a Salesforce Consulting Partner whom they trust and are confident about the performance they are about to deliver. Salesforce interview questions and answers

    ReplyDelete
  16. Incredibly all around intriguing post. I was searching for such a data and completely appreciated inspecting this one. Continue posting. A commitment of gratefulness is all together for sharing.data science course in Hyderabad

    ReplyDelete
  17. It's really nice and meanful. it's really cool blog. Linking is very useful thing.you have really helped lots of people who visit blog and provide them usefull information.
    Digital Marketing Training Institutes in Hyderabad

    ReplyDelete
  18. Truly overall quite fascinating post. I was searching for this sort of data and delighted in perusing this one. Continue posting. Much obliged for sharing.data analytics course

    ReplyDelete
  19. Attend The Data Analyst Course From ExcelR. Practical Data Analyst Course Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Analyst Course.
    Data Analyst Course

    ReplyDelete
  20. wonderful article contains lot of valuable information. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.
    This article resolved my all queries.good luck an best wishes to the team members.continue posting.learn digital marketing use these following link
    Digital Marketing Course in Chennai

    ReplyDelete
  21. McAfee software has several features like protection against viruses and malware, permanently delete the damaged data, protection for many devices, etc.
    Mcafee.com/activate

    Microsoft Office is client software available for data collection
    Office.com/setup

    Visit to create your Webrootaccount. Install Webroot on your device from webroot.com/safe to remove viruses and bugs
    webroot.com/safe

    ReplyDelete
  22. Managed Network Services gives you access to a wider pool of experts to help manage your growing business network needs. It provides proactive support to ensure issues are fixed in a timely manner and offers improved IT security to help protect your customers and employees. It also simplifies your cost management, resulting in a more productive and cost-effective business.

    ReplyDelete
  23. Thanks for posting the best information and the blog is very informative.Data science course in Faridabad

    ReplyDelete
  24. I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
    Data Science Training in Chennai

    ReplyDelete
  25. Online football betting i99club, one of the world's leading online gambling sites, provides the best prices in football betting เว็บแทงบอล


    Ufabet1688 online betting website UEFA Bet is a 100% legal website with all licenses. ufabet


    UEFA football betting, casino, slots, lottery, direct website 1688, stable financial, 100% UFABET168. ufa


    Fan wreath shop with free delivery, with pictures before-after sending with receipt. พวงหรีด


    Sticking to the COVID-19 situation: Arekorenavi.info. โควิด


    Online Baccarat FOXZ24 Easy to apply, fast, deposit-withdraw 10 seconds with the system. บาคาร่า

    ReplyDelete
  26. FOXZ88.NET online casino website Global standard 2020-2021. คาสิโนออนไลน์


    Betting online gambling reminiscent of UFASCR.COM Baccarat. ufabet


    UFABET football betting website, the big brother of all UEFA networks, UFADNA, with an update The first modern system in 2021. ufa


    Web football i99PRO online lottery casino apply today for free 5000 bonus. เว็บบอล


    Kardinal Stick Siam - Relx a great promotion. Express delivery in 3 hours. relx


    Online Marketing Company By the way we can make your website. Reach more customers directly to your business group. Grow your sales. SEO

    ReplyDelete
  27. What a really awesome post this is. Truly, one of the best posts I've ever witnessed to see in my whole life. Wow, just keep it up.
    Best Data Science courses in Hyderabad

    ReplyDelete
  28. Movie-watching websites that are more than movie-watching websites Because we are the number 1 free movie site in Thailand for a long time, including new movies, Thai movies, Western movies, Asian movies, we have all kinds of ways for you Including new series Full of all stories without interstitial ads to keep annoying anymore. One place sa-movie.com.

    Android and IOS operating systems. Watch online movies, Thai movies, Western movies, Asian movies, Cartoon movies, Netflix Movie, Action Movies, Comedy Movies, Crime Movies, Drama Movies, Horror Movies, Adventure Movies, Crash Movies and still have many new movies to watch. You can watch for free anytime, anywhere 24 hours a day at see4k.com.


    GangManga read manga, read manga, read manga online for free, fast loading, clear images in HD quality, all titles, anywhere, anytime, on mobile, tablet, computer. Android and IOS operating systems. Read top comics, action dramas, comedy, adventure, horror and manga. New coming every day to watch many more. Can be read for free anytime anywhere 24 hours a day at gangmanga.com..

    It is no secret that football is among the most popular and widely watched sports. Everybody who likes football tries to find the best platform for free soccer streaming. So, what are the best free sports streaming sites? We are going to answer this question. On this page, you can find a detailed overview of the most widespread soccer streaming websites. Keep on reading and make the best choice for you live24th.me.

    ReplyDelete
  29. I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
    data analytics courses in bangalore

    ReplyDelete
  30. I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
    data analytics courses in bangalore

    ReplyDelete
  31. Duball24hrs.com is an easy to use streaming service with live streams and replays in ดูบอลฟรี a wide range of European and American sports. Fans rave about the graphics and visuals available on Duball24hrs.com, which provides a great viewing experience

    ReplyDelete
  32. Thanks for posting the best information and the blog is very helpfuldigital marketing institute in hyderabad

    ReplyDelete
  33. Informative blog,
    Digital Marketing is the process of marketing products or services using digital technologies on the internet through computers, mobile apps ,display advertising etc. According to our research these are the companies offering best digital marketing and advertising agencies in Hyderabad.
    Best Digital Marketing companies in Hyderabad

    ReplyDelete
  34. i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
    cyber security training in bangalore

    ReplyDelete
  35. I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging endeavours.
    data science institute in bangalore

    ReplyDelete
  36. I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging endeavours.
    data science course in bangalore with placement

    ReplyDelete
  37. I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
    data analytics courses in bangalore

    ReplyDelete
  38. I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
    Data Science Training in Chennai

    ReplyDelete
  39. A good blog always comes-up with new and exciting information and while reading I have felt that this blog really has all those qualities that qualify a blog to be a one.


    business analytics course

    ReplyDelete
  40. I really enjoyed reading your blog. It was very well written and easy to understand. Unlike other blogs that I have read which are actually not very good. Thank you so much!

    Data Science Training in Bangalore

    ReplyDelete
  41. Wonderful blog found to be very impressive to come across such an awesome blog. I should really appreciate the blogger for the efforts they have put in to develop such amazing content for all the curious readers who are very keen on being updated across every corner. Ultimately, this is an awesome experience for the readers. Anyways, thanks a lot and keep sharing the content in the future too.

    Digital Marketing Training in Bangalore

    ReplyDelete
  42. I will very much appreciate the writer's choice for choosing this excellent article suitable for my topic. Here is a detailed description of the topic of the article that helped me the most.

    Artificial Intelligence Training in Bangalore

    ReplyDelete
  43. The Extraordinary blog went amazed with the content that they have developed in a very descriptive manner. This type of content surely ensures the participants explore themselves. Hope you deliver the same near the future as well. Gratitude to the blogger for the efforts.

    Machine Learning Course in Bangalore

    ReplyDelete
  44. It's really nice and meaningful. it's a really cool blog.you have really helped lots of people who visit blogs and provide them useful information.

    Best Data Science courses in Hyderabad

    ReplyDelete
  45. Thanks for posting the best information and the blog is very important.data science institutes in hyderabad

    ReplyDelete
  46. I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.
    Best Data Science courses in Hyderabad

    ReplyDelete
  47. Nice blog post,
    Digital Marketing Course with Internship the demand for digital marketing and the job openings that are expected to open in the coming days in mind, we make sure that our Digital Marketing course comes with an internship that focuses on making you work on real-time live projects.

    ReplyDelete
  48. This website and I conceive this internet site is really informative ! Keep on putting up!
    ai course

    ReplyDelete
  49. Amazing information providing by your article, thank you so much for taking the time to share a wonderful article. Kindly visit the Need Assignment Help website we providing the best assignment help services in Australia. ยูฟ่าสล็อต

    ReplyDelete
  50. Fantastic article I ought to say and thanks to the info. Instruction is absolutely a sticky topic. But remains one of the top issues of the time. I love your article and look forward to more.
    Data Science Course in Bangalore

    ReplyDelete
  51. I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
    Data Science Training in Chennai

    ReplyDelete
  52. I truly like your composing style, incredible data, thank you for posting.
    Best Data Science courses in Hyderabad

    ReplyDelete
  53. Thank you quite much for discussing this type of helpful informative article. Will certainly stored and reevaluate your Website.
    Data Analytics Course in Bangalore

    ReplyDelete
  54. Very wonderful informative article. I appreciated looking at your article. Very wonderful reveal. I would like to twit this on my followers. Many thanks! .
    Data Analytics training in Bangalore

    ReplyDelete
  55. Nice to be seeing your site once again, it's been weeks for me. This article which ive been waited for so long. I need this guide to complete my mission inside the school, and it's same issue together along with your essay. Thanks, pleasant share.
    Data Science training in Bangalore

    ReplyDelete
  56. Thanks for sharing this information. This was really awesome. Keep continuing on updating the post regularly.
    AWS Training in Hyderabad
    AWS Course in Hyderabad

    ReplyDelete
  57. i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
    artificial intelligence training in chennai

    ReplyDelete
  58. I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
    Data Science Course Syllabus

    ReplyDelete
  59. Tremendous blog quite easy to grasp the subject since the content is very simple to understand. Obviously, this helps the participants to engage themselves in to the subject without much difficulty. Hope you further educate the readers in the same manner and keep sharing the content as always you do.

    data science course in faridabad

    ReplyDelete
  60. What a really awesome post this is. Truly, one of the best posts I've ever witnessed to see in my whole life. Wow, just keep it up.
    digital marketing courses in hyderabad with placement

    ReplyDelete
  61. I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
    aws training in hyderabad

    ReplyDelete
  62. Extremely overall quite fascinating post. I was searching for this sort of data and delighted in perusing this one. Continue posting. A debt of gratitude is in order for sharing. data analytics course in delhi

    ReplyDelete
  63. I was just examining through the web looking for certain information and ran over your blog.It shows how well you understand this subject. Bookmarked this page, will return for extra. data science course in vadodara

    ReplyDelete
  64. All of these posts were incredibly perfect. It would be great if you’ll post more updates.
    data scientist training and placement

    ReplyDelete
  65. It is extremely nice to see the greatest details presented in an easy and understanding manner. Get Digital Marketing Services At Affordable Price At JeewanGarg.Com (SEO Company in Delhi)

    ReplyDelete
  66. Experience the thrill with the exotic luxury camp Jaisalmer. The luxury tented accommodations, camel safaris and memorable adventures in the golden sand dunes located just 35 km on the suburb of the Jaisalmer, is the world -renowned golden city. Hence, book Jaisalmer desert camp or Jaisalmer tour package with the Exotic Luxury Camps and experience the feeling of comprehensive solitude and escapism from the maddening crowd of the city life. desert festival jaisalmer.

    ReplyDelete
  67. Matrimonials India is one of the most reliable and trusted Australia Muslim Matrimony
    that provides services for millions of Indian worldwide. This portal is the largest Australia Muslim Matrimony with several successful marriages and that comprises an extensive database of NRI Muslims from Australia. Matrimonials India has already helped several people in finding their Australia Muslim life partners.

    ReplyDelete
  68. cutting corrugated plastic not only have these wonderful qualities but also are super easy to cut. With the right kind of tools, You can quickly cut these sheets using the following Corrugated Plastic sheets comprise of three layers- two flat plastic sheets with a wave-like ribbed center layer. The two flat plastic sheets are generally referred to as twinwall plastic. The Corrugated Plastic sheets may also be like sheets of plastic that have a wave-like structure that might have chopped glass fiber reinforced in it

    ReplyDelete
  69. Thanks for posting the best information and the blog is very good.data science course in Lucknow

    ReplyDelete
  70. It is late to find this act. At least one should be familiar with the fact that such events exist. I agree with your blog and will come back to inspect it further in the future, so keep your performance going.

    Digital Marketing Training in Bangalore

    ReplyDelete
  71. A good blog always contains new and exciting information, and reading it I feel like this blog really has all of these qualities that make it a blog.

    Artificial Intelligence Training in Bangalore

    ReplyDelete
  72. Thanks a lot. You have done an excellent job. I enjoyed your blog . Nice efforts
    data scientist training in hyderabad

    ReplyDelete
  73. Happy to chat on your blog, I feel like I can't wait to read more reliable posts and think we all want to thank many blog posts to share with us.

    Machine Learning Course in Bangalore

    ReplyDelete
  74. I wanted to leave a little comment to support you and wish you the best of luck. We wish you the best of luck in all of your blogging endeavors.

    Data Science Training in Bangalore

    ReplyDelete
  75. This is additionally a generally excellent post which I truly delighted in perusing. It isn't each day that I have the likelihood to see something like this.. data science course in chennai

    ReplyDelete

Post a Comment