Check Point researchers have discovered that the unauthenticated Picture Transfer Protocol (PTP) puts some digital single-lens reflex (DSLR) cameras and certain mirrorless cameras at risk of ransomware attacks. An attacker within range of a vulnerable camera’s WiFi could use the PTP to infect the device with ransomware that encrypts all photographs on it.
The researches found critical flaws in the firmware of Canon EOS 80D that made the ransomware attack possible. They warn that the majority of Canon cameras are likely vulnerable to the attack, while cameras by other manufacturers that also use PTP may be at risk as well.
This attack is a striking example of how the reliance on protocols that were designed without security in mind can put Internet-of-things (IoT) devices at risk.
