11 ms·
Ransomware-ing a DSLR Camera
- elorant 7y agoIt could get even worse if the perpetrator instead of bricking the device decides to install a backdoor that silently uploads photos to a server whenever a wifi connection is established.
- notyourday 7y agoCameras tend to insist on being a HostAP, not a client.
- dboreham 7y agoCanon DSLRs and mirrorless cameras can act as Stations.
- colinbartlett 7y agoI really appreciate researchers like this who take the time to explain in detail the way in which they find vulnerabilities, especially when they document even the dead ends. For a relative lay person like myself, it really helps me gain an understanding and appreciation for the work that goes into keeping applications secure.
- zelon88 7y ago> ...even the dead ends. I agree. I find it harder to follow a highly technical blog post that goes on and on from one productive thing to the next like a machine. I want to follow the process, not just duplicate the results. If I can just copy/paste your code to reproduce I'm never going to learn how you arrived at your results!
- roland35 7y agoYes, that is often times missing from these write-ups, and can lead me to feel more frustrated during my own projects when things don't go perfectly well on the first go!
- StavrosK 7y agoFirst off, Magic Lantern is amazing, it has been a huge value-add for my camera (which I kind of hate because it disincentivizes Canon from improving its practices). Secondly, does anyone know how ML got the encryption key and why they aren't releasing it?
- saul_goodman 7y agoAs with many community ran projects based around a commercial vendor, fear of being DMCA'd out of existence is real. We can safely assume they want to be left alone by Canon and not posting the encryption key not only shows they mean no harm to Canon, it also could be argued in court that they are not violating the DMCA (despite the fact they had to obtain the key somehow, at least they can claim ignorance as to how their firmware was magically encrypted/signed - yes it's weak but its something).
- walrus01 7y agoWhat's to stop people from forking the entire magic lantern code base and putting it on a self hosted gitlab server physically hosted at a Russian or Chinese domestic ISP that ignores 100% of US copyright/DMCA threats?
- heavenlyblue 7y agoThe fact that the developers themselves aren’t Russian.
- BooneJS 7y agoIronically, I thought the email from Canon was a hoax and didn’t open it yet. I’ve got some patching to do today.
- Finnucane 7y agoI'm going to use this the next time my wife suggests unloading my old Hasselblad.
- pjmlp 7y agoAs expected, all CVEs are related to memory corruption issues.
- penagwin 7y agoSerious question and asking as not a current Rust user - is this something Rust would have prevented? (Let's assume the any technical limitations of compiling firmware for the camera in Rust are overcome - just focusing on the memory corruption part)
- Santosh83 7y agoI believe so. Any memory safe language (not just Rust) would've prevented memory corruption. One of Rust's aims is to target embedded development, so one might hope for software such as these to be written in Rust at some point in future.
- jstimpfle 7y agoRust's safety mechanisms aren't about buffer overflows. But if you can get away with always using a specific vector type throughout the code (instead of using the simpler and more modular rawpointer+length/rawpointer+offset+length scheme), and you enable bounds checking when compiling, then yes, you probably can get there most of the way or even all the way. But it will be more painful in my experience, and there might be a noticeable performance overhead (I've actually never used Rust but many other languages with objects).
- heavenlyblue 7y agoIsn’t Rust Vec a pointer and a length by itself?
- steveklabnik 7y agoA pointer, a length, and a capacity. Slices are pointer and length.
- post_break 7y agoI hope this doesn't make it more difficult for Magic Lantern devs.
- burk96 7y agoFirst thing I thought of as well. It's a fantastic project and I would hate for Canon's response to this to negatively affect them, whether it becomes hardening the device's firmware upgrade process to the point that the project does not become feasible or unnecessary legal woes.
- notyourday 7y agoThe camera software of all modern DSLRs, mirrorless cameras and even camera lenses is total junk. I have successfully crashed D7200, D7500 by throwing random packets at them over the network ( which probably explains why the cameras only work in the HostAP mode and never as clients -- weirdly it explains Nikon's position of "it" being a security choice )
- roland35 7y agoThis type of security is often overlooked in embedded devices, especially those ones that are connected to wifi/cellular for the first time. A good bit of advice I received was "imagine someone is trying their hardest to break into your device at every interface. What can they do?". With that mindset you can then see where to firewall every connection to the outside world to the main controls of your system.
- ISL 7y agoIs there a direct link to patches anywhere? Canon's press-release and the Canon USA website don't appear to have direct links.
- mschuster91 7y agoMeanwhile in Sony Alpha land: the entire firmware is Linux based and you can pwn it and install Android payloads... but the reverse-engineering community seems to have died down :(