5 ms·

That sounds horrific. This code seems related - it has the cow ascii art and the email-sending functionality and email address mentioned in the article: https:

That sounds horrific. This code seems related - it has the cow ascii art and the email-sending functionality and email address mentioned in the article: https://github.com/simonjiuan/ipc/blob/master/src/cgi_misc.c https://github.com/simonjiuan/ipc/blob/master/src/cgi_misc.c - I wonder what else is in there!

colanderman 11y ago
Good find. Wow, that repo is a class act. Binaries checked in and everything. Clearly looks like this and the OP's DVR share lineage. From what I can tell, the e-mail address etc. are defaults used in CGI_send_email, which is only invoked as the handler for the /email endpoint. Looking at the order of endpoints defined in https://github.com/simonjiuan/ipc/blob/master/src/ipcam_network.c https://github.com/simonjiuan/ipc/blob/master/src/ipcam_netw... it seems that /email was probably left out in the DVR's code, so it's possible this function is simply never invoked, and we're just left with the WTF that not only did the original author (Mr. Law) think that an e-mail service needed a default "To", but that he thought it should be him, and that he left it in the final product.
- ttctciyf 11y ago
  Yeah, it wasn't at all clear to me from 2 minutes of static analysis under what circumstances an email would be sent and to which address. I'd hope the authors of the linked article would have verified this with a packet sniffer (as mentioned in another comment here) before making the claim.
  - cybergibbons 11y ago
    Sorry, should have been more clear. Yes, it does send the emails.
PinguTS 11y ago
Good find. And according to that source, you can change that target email address via a request parameter.
davenull 11y ago
I surely hope that somebody can figure out how to make firmware images for these, and use this code as a base to fix these flaws. A kind DD-DVR project, if you would.
Phil_Latio 11y ago
Just got deleted. Anyone has mirror?
- john_reel 11y ago
  Yes. http://archive.is/HUW8c http://archive.is/HUW8c
  - Phil_Latio 11y ago
    Thanks, I found another repo here: https://github.com/zackxue/ipc https://github.com/zackxue/ipc

colanderman 11y ago

Good find. Wow, that repo is a class act. Binaries checked in and everything. Clearly looks like this and the OP's DVR share lineage. From what I can tell, the e-mail address etc. are defaults used in CGI_send_email, which is only invoked as the handler for the /email endpoint. Looking at the order of endpoints defined in https://github.com/simonjiuan/ipc/blob/master/src/ipcam_network.c https://github.com/simonjiuan/ipc/blob/master/src/ipcam_netw... it seems that /email was probably left out in the DVR's code, so it's possible this function is simply never invoked, and we're just left with the WTF that not only did the original author (Mr. Law) think that an e-mail service needed a default "To", but that he thought it should be him, and that he left it in the final product.

ttctciyf 11y ago
Yeah, it wasn't at all clear to me from 2 minutes of static analysis under what circumstances an email would be sent and to which address. I'd hope the authors of the linked article would have verified this with a packet sniffer (as mentioned in another comment here) before making the claim.
- cybergibbons 11y ago
  Sorry, should have been more clear. Yes, it does send the emails.

PinguTS 11y ago

Good find. And according to that source, you can change that target email address via a request parameter.

davenull 11y ago

I surely hope that somebody can figure out how to make firmware images for these, and use this code as a base to fix these flaws. A kind DD-DVR project, if you would.

Phil_Latio 11y ago

Just got deleted. Anyone has mirror?

john_reel 11y ago
Yes. http://archive.is/HUW8c http://archive.is/HUW8c
- Phil_Latio 11y ago
  Thanks, I found another repo here: https://github.com/zackxue/ipc https://github.com/zackxue/ipc