## 3 Critical Analysis of Selected Literature
### In-Built Backdoor Exploitation Technique  
This type of attack primarily occurs through the installation of backdoors [54], where an intentionally concealed administrative access user, known only to the Original Equipment Manufacturer (OEM), is referred to as a \"backdoor user\". Such a user is unknown to the organization being attacked, since neither the product manual nor the factory settings provide any reference to it. However, in their analysis of IoT firmware vulnerabilities, [PERSON] et al. [27] clarified that OEMs and ODMs (Original Design Manufacturers) frequently give little consideration to firmware or IoT device security. Even when they do address security concerns, some ODM code provided to an OEM may contain vulnerabilities or security flaws, leading to the introduction of a single bug across thousands of commercial devices. To streamline development and expedite time-to-market, some OEMs resort to utilizing outdated (and free) code bases and libraries. This practice frequently results in the deployment of specific vulnerable frameworks, leading to the creation of insecure firmware. Moreover, on the extreme side, [PERSON] et al. [55] highlighted that distribution vendors simply acquire the device from an OEM, rebrand them, and then offer them for sale on the market.  
**Impact:** With the further exploitation of the vulnerable camera, the outside attacker may find access to a more secure internal network of the intended target, infect other systems, and access confidential data, as shown in Figure 10.  
**Use case:** The majority of Hikvision IP cameras remain vulnerable to the access control bypass due to a backdoor in firmware that allows the unauthenticated impersonation of any configured user account disclosed in 2017 [56], and to unauthenticated remote code execution, disclosed in 2021 [57]. One of the API handlers in this camera allows authentication with the logic of \"if this exists, then skip all authentication\", which developers had used for debugging and forgot to remove. This allows authorization by username only, with the password ignored. Another backdoor allows one to gain root access via SSH and bypass the camera admin web portal authentication.  
Security measure: As a preventive measure, Big Brother Watch [58] in the UK, a civil liberties and privacy campaigning organization, recommends a ban on the sale and operation of Hikvision and Dahua surveillance equipment in the UK. They further urge the UK government to commission a nationwide independent examination of the scope, capabilities, moral implications, and effects of contemporary CCTV in the UK.  
Figure 10: Diagram of the in-built exploitation technique in a logically air-gapped network.  
[PERSON] et al. [59] discussed a more pragmatic reactive measure, emphasizing the importance of correctly identifying the OEM as a crucial factor in running the most relevant test cases when assessing vulnerabilities. In contrast, a traditional vulnerability assessment approach might label a Honeywell camera as a \"Honeywell\" camera and only run test cases relevant to Honeywell firmware. However, a modern-era tool would recognize a Honeywell camera and run Dahua test cases on it because many models of Honeywell cameras have Dahua firmware signatures underneath. This comprehensive approach provides a more accurate assessment of the security posture of the scanned IoT devices.