Eyal Itkin - Say Cheese: How I Ransomwared Your DSLR Camera
Exploits the Picture Transfer Protocol over USB and Wi-Fi to remotely ransomware a Canon DSLR camera.
Summary
Ransomwaring a DSLR Camera
Eyal Itkin (vulnerability researcher, Check Point Research) demonstrates a complete exploit chain targeting Canon DSLR cameras, achieving remote code execution over both USB and Wi-Fi using the Picture Transfer Protocol (PTP).
Picture Transfer Protocol Attack Surface
PTP is an unauthenticated protocol designed for image transfer. Itkin identifies multiple buffer overflow and integer overflow vulnerabilities in the Canon EOS 80D firmware's PTP request handler, exploitable over both USB and the camera's built-in Wi-Fi.
Full RCE and Ransomware Payload
After triggering RCE, the researcher writes a proof-of-concept ransomware that encrypts all photos on the SD card using AES and displays a ransom demand on the camera's LCD, demonstrating the real-world impact of ignoring IoT security.
Coordinated Disclosure
Canon was notified before the talk and released firmware updates. Itkin discusses the disclosure timeline and the broader implications for embedded device update mechanisms.
Related talks
Hackers of CypherCon·21 min
Security researchers examine technical aspects of IoT Security Privacy Weaknesses & Ransomware with Rick Ramgattie | CypherCon 2.0.
Village Interviews·1 min
A tour of the IoT Village at DEF CON 32 exploring hands-on router hacking, connected device vulnerability research, and zero-day labs.
ROOTCON Hacking Conference·36 min
Security researchers examine technical aspects of Demystifying the Ransomware and IoT Threat by: Christopher Elisan.