CVDEAD Publishes Dataset Listing 26,500 Exposed IoT Devices and 3,000 RTSP Cameras in Saudi Arabia
Summary
A report says CVDEAD published a free dataset listing 26,500 exposed IoT devices and 3,000 RTSP camera streams in Saudi Arabia, and encouraged using them as DDoS nodes or proxies.
Key points
- The report attributes the dataset publication to the threat actor using the handle CVDEAD.
- The dataset reportedly lists 26,500 publicly accessible IoT devices and 3,000 RTSP camera streams in Saudi Arabia.
- Listed device types include medical devices, routers, cameras, local servers, sensors, and administration interfaces.
- The report says the dataset was compiled through active scanning and includes sample IP addresses, ports, and device information.
- CVDEAD reportedly encouraged using the listed devices as DDoS botnet nodes or anonymizing proxies; the article describes potential safety implications but does not establish that devices were compromised or used.
Article Details
- Event Type
- A threat actor published a free dataset listing exposed IoT devices and RTSP camera streams in Saudi Arabia and encouraged their use for botnet and proxy activity.
- Impact
- The dataset reportedly includes 26,500 publicly accessible IoT devices and 3,000 camera streams, including medical devices. Their potential use for DDoS attacks or anonymized traffic routing, and the exposure of medical devices and video streams, create security and possible real-world safety risks.
MITRE ATT&CK
T1090 · ProxyCVDEAD encouraged using listed devices as proxies for anonymized traffic routing; the article does not report that proxy use occurred.T1498 · Network Denial of ServiceCVDEAD encouraged using listed exposed devices as DDoS botnet nodes; the article does not report that they were actually used in an attack.