Skip to main content

Directory disclosure vulnerability in facial recognition software

There are at least a dozen, most likely many more, Embedded Facial Recognition Systems online on the World Wide Web with a basic software flaw that allows anyone without credentials to browse the /images directory, download log files, and view enrolled images.

I was able to locate the systems on Shodan searching for - html:facial html:recognition html:embedded country:"US" - and once on the log-in pages, simply inspecting the page source revealed the path to the background image.








Navigating one directory up revealed the directory listing, and I was able to navigate to the folder "logs" and download .bmp files of faces enrolled in the system, as well as system files.



Many of the systems seem to be on dedicated IP blocks (inferred from searching Shodan for the IP's ASN, net:"xx.xx.xx.0/24"), and the owner of some systems can be gleaned from other devices on the network. These are not law enforcement systems, from what I can discern, rather access control devices at commercial and industrial sites.

I've been able to identify the system just by searching for "embedded facial recognition" software (embedded in this case means the sensor and the analytics are combined, as opposed to the alternative of a system that conducts analysis of user-submitted probe images taken by independent cameras). It's AccuFACE by PSPSecurity, and believe it or not, PSP's website is down.


Log in screen I found through Shodan
AccuFACE software design, with the same background graphic.

At least a dozen, probably many more, such systems using the same software have this common flaw, so it's a good example of what's really a general exposure of this kind of surveillance technology to dilettantes like myself browsing Shodan.

With inexpert trawling of I've been able to access recorded drone footage, a Highway Patrol surveillance trailer, dialed number recorders, many automated license plate reader servers, as well as more facial recognition portals than I've been able to check for possible access.

Just from the few facial recognition servers I've tried so far, I've been able to view and download footage and its metadata.



But it gets much worse.


They're still looking for Hitler.

Comments

  1. This comment has been removed by a blog administrator.

    ReplyDelete
  2. This comment has been removed by a blog administrator.

    ReplyDelete
  3. This comment has been removed by a blog administrator.

    ReplyDelete
  4. This comment has been removed by a blog administrator.

    ReplyDelete
  5. In conclusion, discover an http://www.top10spyapps.es/ that is inside your buying power. Numerous incredible apps can work well for you at financially savvy rates despite the fact that they don't make it to the best five.

    ReplyDelete

  6. Very Good Information...

    SAS Training in Pune

    Thank You Very Much For Sharing These Nice Tips..

    ReplyDelete

  7. Your very own commitment to getting the message throughout came to be rather powerful and have consistently enabled employees just like me to arrive at their desired goals.

    Best Angularjs Training in Chennai
    Best Java Training in Chennai
    Best Bigdata Hadoop Training in Chennai
    Best SAS Training in Chennai
    Best Python Training in Chennai
    Best Software Testing Training in Chennai

    ReplyDelete
  8. I came to this blog and it helped me to add few new points to my knowledge. Actually, I am trying to learn new thing wherever I find. Impressive written blog and valuable information shared here. Oxygen Facial Treatment

    ReplyDelete
  9. simplest your non-stop work lets you get specification on your writing capability. hold eyes to your errors and take corrective activation right away. decorate yourself on every occasion you discover any mistakes for your written essay whether or not it's far a minor mistake. Skin Rejuvenation Treatment

    ReplyDelete
  10. I like the helpful info you provide in your articles. I’ll bookmark your weblog and check again here regularly. I am quite sure I will learn much new stuff right here! Good luck for the next!





    Dot Net Training in Chennai | Dot Net Training in anna nagar | Dot Net Training in omr | Dot Net Training in porur | Dot Net Training in tambaram | Dot Net Training in velachery






    ReplyDelete
  11. Freelance maintenance technicians also benefit from establishing relationships with multiple clients. Working as a freelancer, you’ll gain employment experience with a variety of businesses, boosting your overall skill set and providing you with more work opportunities in the future.

    maintenance technician

    ReplyDelete
  12. Very interesting blog. Many blogs I see these days do not really provide anything that attracts others, but believe me the way you interact is literally awesome.You can also check my articles as well.

    Security Guard License
    Ontario Security License
    Security License Ontario
    Security License

    Thank you..

    ReplyDelete
  13. With so many books and articles appearing to usher in the field of making money online and further confusing the reader on the real way to make money.

    Business Analytics Course in Bangalore

    ReplyDelete
  14. I am sure it will help many people. Keep up the good work. It's very compelling and I enjoyed browsing the entire blog.

    Data Analytics Course in Bangalore

    ReplyDelete
  15. Businesses should find a Salesforce Consulting Partner whom they trust and are confident about the performance they are about to deliver. Salesforce interview questions and answers

    ReplyDelete
  16. Incredibly all around intriguing post. I was searching for such a data and completely appreciated inspecting this one. Continue posting. A commitment of gratefulness is all together for sharing.data science course in Hyderabad

    ReplyDelete
  17. It's really nice and meanful. it's really cool blog. Linking is very useful thing.you have really helped lots of people who visit blog and provide them usefull information.
    Digital Marketing Training Institutes in Hyderabad

    ReplyDelete
  18. Truly overall quite fascinating post. I was searching for this sort of data and delighted in perusing this one. Continue posting. Much obliged for sharing.data analytics course

    ReplyDelete
  19. Attend The Data Analyst Course From ExcelR. Practical Data Analyst Course Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Analyst Course.
    Data Analyst Course

    ReplyDelete
  20. wonderful article contains lot of valuable information. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.
    This article resolved my all queries.good luck an best wishes to the team members.continue posting.learn digital marketing use these following link
    Digital Marketing Course in Chennai

    ReplyDelete
  21. McAfee software has several features like protection against viruses and malware, permanently delete the damaged data, protection for many devices, etc.
    Mcafee.com/activate

    Microsoft Office is client software available for data collection
    Office.com/setup

    Visit to create your Webrootaccount. Install Webroot on your device from webroot.com/safe to remove viruses and bugs
    webroot.com/safe

    ReplyDelete
  22. Managed Network Services gives you access to a wider pool of experts to help manage your growing business network needs. It provides proactive support to ensure issues are fixed in a timely manner and offers improved IT security to help protect your customers and employees. It also simplifies your cost management, resulting in a more productive and cost-effective business.

    ReplyDelete
  23. Thanks for posting the best information and the blog is very informative.Data science course in Faridabad

    ReplyDelete
  24. I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
    Data Science Training in Chennai

    ReplyDelete
  25. Online football betting i99club, one of the world's leading online gambling sites, provides the best prices in football betting เว็บแทงบอล


    Ufabet1688 online betting website UEFA Bet is a 100% legal website with all licenses. ufabet


    UEFA football betting, casino, slots, lottery, direct website 1688, stable financial, 100% UFABET168. ufa


    Fan wreath shop with free delivery, with pictures before-after sending with receipt. พวงหรีด


    Sticking to the COVID-19 situation: Arekorenavi.info. โควิด


    Online Baccarat FOXZ24 Easy to apply, fast, deposit-withdraw 10 seconds with the system. บาคาร่า

    ReplyDelete
  26. FOXZ88.NET online casino website Global standard 2020-2021. คาสิโนออนไลน์


    Betting online gambling reminiscent of UFASCR.COM Baccarat. ufabet


    UFABET football betting website, the big brother of all UEFA networks, UFADNA, with an update The first modern system in 2021. ufa


    Web football i99PRO online lottery casino apply today for free 5000 bonus. เว็บบอล


    Kardinal Stick Siam - Relx a great promotion. Express delivery in 3 hours. relx


    Online Marketing Company By the way we can make your website. Reach more customers directly to your business group. Grow your sales. SEO

    ReplyDelete
  27. What a really awesome post this is. Truly, one of the best posts I've ever witnessed to see in my whole life. Wow, just keep it up.
    Best Data Science courses in Hyderabad

    ReplyDelete
  28. Movie-watching websites that are more than movie-watching websites Because we are the number 1 free movie site in Thailand for a long time, including new movies, Thai movies, Western movies, Asian movies, we have all kinds of ways for you Including new series Full of all stories without interstitial ads to keep annoying anymore. One place sa-movie.com.

    Android and IOS operating systems. Watch online movies, Thai movies, Western movies, Asian movies, Cartoon movies, Netflix Movie, Action Movies, Comedy Movies, Crime Movies, Drama Movies, Horror Movies, Adventure Movies, Crash Movies and still have many new movies to watch. You can watch for free anytime, anywhere 24 hours a day at see4k.com.


    GangManga read manga, read manga, read manga online for free, fast loading, clear images in HD quality, all titles, anywhere, anytime, on mobile, tablet, computer. Android and IOS operating systems. Read top comics, action dramas, comedy, adventure, horror and manga. New coming every day to watch many more. Can be read for free anytime anywhere 24 hours a day at gangmanga.com..

    It is no secret that football is among the most popular and widely watched sports. Everybody who likes football tries to find the best platform for free soccer streaming. So, what are the best free sports streaming sites? We are going to answer this question. On this page, you can find a detailed overview of the most widespread soccer streaming websites. Keep on reading and make the best choice for you live24th.me.

    ReplyDelete
  29. I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
    data analytics courses in bangalore

    ReplyDelete

Post a Comment