Turning Camera Surveillance on its Axis

A vulnerability researcher investigates the security of enterprise video surveillance infrastructure on Track 3, presenting an analysis of Axis Camera Station (ACS)—a centralized management platform used in corporate and governmental facilities to aggregate hundreds of IP camera feeds [03:52].

The presentation examines the proprietary Axis Remoting Protocol, detailing how intercepting network traffic with an inline proxy revealed unencrypted communication flows between the client application and backend servers [07:17]. The researcher uncovers an unsafe .NET deserialization vulnerability in backend Windows client API classes that presents a high-severity remote code execution risk [10:58]. The talk explores complex authentication boundaries, analyzing NTLM challenge-response mechanisms [14:22] and Negotiate/SPNEGO web authentication schemas [18:11], while providing mitigation advice for network administrators to isolate video management systems and restrict remoting protocol access [21:47].

(AI summary — Gemini Flash)