3 ms·

Unveiling Vulnerabilities: A Deep Dive into WiFi Camera Security

27 points by transpute 3y ago

jcrawfordor 3y ago
Open port 34567 for video streaming is indicative of a very common firmware package on the cheapest Chinese IP cameras, often called the Cantonk firmware although I'm not confident that Cantonk was the original developer. It's not as common as it used to be, thankfully, but AliExpress still carries plenty of devices running it. I'm unhappy with calling out plaintext storage of the WiFi password as a vulnerability. The device is a WiFi client. It ultimately needs to store either the password or the hash for a specific protocol, which is as good as a password (can be used to authenticate) with the downside that the device will need to be reconfigured if the network security protocol changes. WiFi passwords are shared keys, they must be shared. Absent some type of hardware secure enclave, any means of encrypting the shared key for storage would be mere obfuscation to an attacker with access to the device. This kind of knee-jerk "the password should not be stored in plaintext" seems to come from people who are rotely applying advice for services, not clients, without actually thinking out the threat model. Overall this analysis is very shallow and I think fails to get at by far the largest and most concerning attack surface on these devices, the cloud and NAT negotiation services used by the first party mobile apps.
- contingencies 3y ago
  I don't trust security people to do sane things. - Linus Torvalds (2017) ... via https://github.com/globalcitizen/taoup https://github.com/globalcitizen/taoup
denysvitali 3y ago
Sorry, this article isn't worth reading. The analysis done here is worth nothing - it's just dumping the firmware and running an automated tool to find known vulnerabilities. Those chinese IP cameras have far more interesting vulnerabilities that are worth discussing, but this article is completely ignoring them. For example, these cameras generally expose themselves to the internet, phone back home in HTTP and have backdoors in multiple places (e.g: root credentials [1], web interface backdoors and such) On top of that, the SOC is not introduced and the author just says "ESP-based chip". I really doubt this camera is using an Espressif chip: Espressif is not used for video processing. If I had to guess, it's probably a Goke chip, or one of the many vendors mentioned in OpenIPC supported HW page [2]. [1]: https://gist.github.com/gabonator/74cdd6ab4f733ff047356198c781f27d https://gist.github.com/gabonator/74cdd6ab4f733ff047356198c7... [2]: https://openipc.org/supported-hardware/featured https://openipc.org/supported-hardware/featured

27 points by transpute 3y ago

Open port 34567 for video streaming is indicative of a very common firmware package on the cheapest Chinese IP cameras, often called the Cantonk firmware although I'm not confident that Cantonk was the original developer. It's not as common as it used to be, thankfully, but AliExpress still carries plenty of devices running it. I'm unhappy with calling out plaintext storage of the WiFi password as a vulnerability. The device is a WiFi client. It ultimately needs to store either the password or the hash for a specific protocol, which is as good as a password (can be used to authenticate) with the downside that the device will need to be reconfigured if the network security protocol changes. WiFi passwords are shared keys, they must be shared. Absent some type of hardware secure enclave, any means of encrypting the shared key for storage would be mere obfuscation to an attacker with access to the device. This kind of knee-jerk "the password should not be stored in plaintext" seems to come from people who are rotely applying advice for services, not clients, without actually thinking out the threat model. Overall this analysis is very shallow and I think fails to get at by far the largest and most concerning attack surface on these devices, the cloud and NAT negotiation services used by the first party mobile apps.

contingencies 3y ago
I don't trust security people to do sane things. - Linus Torvalds (2017) ... via https://github.com/globalcitizen/taoup https://github.com/globalcitizen/taoup

denysvitali 3y ago

Sorry, this article isn't worth reading. The analysis done here is worth nothing - it's just dumping the firmware and running an automated tool to find known vulnerabilities. Those chinese IP cameras have far more interesting vulnerabilities that are worth discussing, but this article is completely ignoring them. For example, these cameras generally expose themselves to the internet, phone back home in HTTP and have backdoors in multiple places (e.g: root credentials [1], web interface backdoors and such) On top of that, the SOC is not introduced and the author just says "ESP-based chip". I really doubt this camera is using an Espressif chip: Espressif is not used for video processing. If I had to guess, it's probably a Goke chip, or one of the many vendors mentioned in OpenIPC supported HW page [2]. [1]: https://gist.github.com/gabonator/74cdd6ab4f733ff047356198c781f27d https://gist.github.com/gabonator/74cdd6ab4f733ff047356198c7... [2]: https://openipc.org/supported-hardware/featured https://openipc.org/supported-hardware/featured