7 ms·

Hacking the Samsung NX300 "Smart" Camera

126 points by ge0rg 12y ago

richardwhiuk 12y ago
FYI, the request to http://gld.samsungosp.com http://gld.samsungosp.com is probably to attempt to detect wireless networks which require login. iOS does something similar - http://blog.erratasec.com/2010/09/apples-secret-wispr-request.html http://blog.erratasec.com/2010/09/apples-secret-wispr-reques...
- mey 12y ago
  I understand the accept-language based on the company that created the device, but why would the accept reference shockwave and excel documents? That seems a little odd and not a simple library default.
matthewmacleod 12y ago
Jesus. How do engineers get away with this sort of thing? Why is there such resistance among hardware companies to a philosophy along the lines of "let's develop some simple, no-nonsense, standards-compliant firmware with a straightforward user interface"? Like every single router configuration page - godawful. There's a hardware platform I've been keen to implement for some time, and to some extent I keep putting it off when I think about how challenging security and a good UX would be. Apparently the bar is lower than I thought.
- joezydeco 12y ago
  Because the engineers get a directive to jump to a new platform (like Tizen) and they're handed a barely-working reference platform with a HelloWorld app on it. Then they're told "oh yeah, this has to be ready by the Christmas selling season, which means you need to lock down firmware by July 1st. And we're demoing it at a trade show in May." And it's already April. So the engineers comment out printf("Hello World\n"); and start writing a camera. And so on. If they remember to take the other crap out of the Makefile (including the demo pictures of Obama), that's probably because they ran out of space in NOR Flash. Otherwise it stays in. Is there time to run network hidey-hole testing on the WiFi stuff? They're probably happy the thing takes a picture without wiping the SD Card a this point. It's all bubble-gum and duct tape underneath it all. From your Toyota auto to your Samsung camera to the Smart TV on your wall to the KitchenAid LCD oven in your house.
  - r00fus 12y ago
    What's with your comment about the Toyota auto? As I understand there's a hell of a lot more regulation, forcing automobile product time lines to be naturally longer.
    - mahyarm 12y ago
      Probably talking about the in car infotainment system.
    - pearjuice 12y ago
      He is taking a cheap stab at a budget car manufacturer. Probably owns a Tesla. Or two.
      - joezydeco 12y ago
        Actually I drive a Toyota. But it's a 1996 model. ;-)
    - joezydeco 12y ago
      "Toyota’s developers used MISRA-C and the OSEK operating system, both good choices for a safety-critical real-time system. But then they ignored, sidestepped, or circumvented many of the very safety features they are designed to enforce." "On a cyclomatic-complexity scale, a rating of 10 is considered workable code, with 15 being the upper limit for some exceptional cases. Toyota’s code had dozens upon dozens of functions that rated higher than 50. Tellingly, the throttle-angle sensor function scored more than 100, making it completely and utterly untestable." http://www.eejournal.com/archives/articles/20131127-toyota/ http://www.eejournal.com/archives/articles/20131127-toyota/ Michael Barr was the engineer that was able to sit down with the Toyota engine code during the "unintended acceleration" lawsuit and determine what NASA could not: that the code was a wreck: http://embeddedgurus.com/barr-code/2013/10/an-update-on-toyota-and-unintended-acceleration/ http://embeddedgurus.com/barr-code/2013/10/an-update-on-toyo... Like I said. Bubble gum and duct tape.
    - dbloom 12y ago
      The regulations only apply to the engine computer (which is probably not changed much in each model year). There is no strict quality or safety (or aesthetic, for that matter) regulation for the entertainment/climate control system user interfaces. (In case you've ever wondered: yes, these screens do often show information from the engine computer. For example, the 2nd generation Prius's center console screen shows live information about the hybrid system. But that information is pretty much always obtained from a read-only connection to the CAN bus.)
- javajosh 12y ago
  People don't care how the sausage is made.
  - Falling3 12y ago
    It's not about how it's made. It's about the final product.
  - pfortuny 12y ago
    That is until some expert comes and informs them that it is actually made 90% pork 10% rat.
    - dvhh 12y ago
      And soylent green is ... nevermind the taste is amazing
- criley2 12y ago
  Because the average user and the vast majority of users can't use your straightforward and easy UI without explicit instructions because they don't understand any of it. If they're not going to use it or understand it, why spend time on it? The model is moving to ISP-controlled network hardware anyway. All new Comcast modems are remotely manageable by Comcast and they enable features that customers have to call Comcast to disable, as Comcast has better access to the modem firmware than the end user.
  - drdaeman 12y ago
    It's actually irrelevant who uses the interface - the end user or ISP employee acting on users demand. Such change of the party in charge neither adds any usability to user interface (just the side who has to struggles with it), nor it increases security and reliability.
    - criley2 12y ago
      I actually believe that you're using false equivalence to pretend that both paradigms are the same. I disagree that they are, and I believe that you've made a lot of assumptions to declare my point "irrelevant", the biggest of which being that the software is identical and the only difference is who accesses it. That's a falsehood, and I'm going to reject the rest of your point because I disagree with those assumptions.
lnanek2 12y ago
The security flaws are bad, like not write locking the tag. Still, lots of fun stuff for a developer user there, though. It runs a full X server, so technically some Linux people might consider it even more capable than Android. Supporting a shared amongst manufacturers format like DLNA is cool too. Maybe a different brand smartphone could work with it more easily then, for example.
- skeletonjelly 12y ago
  Plug in a few things and you'd be able to make a phone call from your camera and have it run Breakout or something
mikestew 12y ago
I'm shocked, shocked that there is shitty software running in this Samsung establishment. When I saw the title, I had a strong suspicion that it wasn't about making the camera do cool things, but the subject would be "how broken is Samsung's firmware?" What is it with Samsung and software? I mean, they can crank out some decent hardware, but their software is consistently abysmal. I have a Note 3. Ignore the plasticy and cheesy (fake leather stitching? Really?) exterior, and it's a decent piece of kit. But the included software is consistently crap. I bought the Note for the stylus, but both S Note and Action Memo apps that are to be used with the stylus consistently lost data. I think they fixed it in a later update (haven't lost data lately), but it doesn't inspire confidence. The prime example is Samsung's new Gear Fit. It just plain doesn't work as advertised, and it's due to unbelievably broken software. The only things that work reliably are the notifications and the pedometer. And though the pedometer works (if a bit inaccurately) the data reporting is broken. I mean so broken that if you want a historical listing of your steps each day, you'll have to write it down because the data reporting is grossly inaccurate. Everything else, including most exercise functionality, just doesn't work. I thought it would be fun (and please pardon the shameless plug) to see if I can post a new bug every day: http://gearfitbugs.tumblr.com http://gearfitbugs.tumblr.com (been slacking the last few days for lack of time). Point is, how do they stay in business? Who buys one Samsung product and then turns around later to buy another one (okay, me, I guess)? For me, they don't get three strikes. Two hardware products with amateur-level software (with apologies to all amateur developers out there; your stuff is likely better than Samsung's) are the only chances Samsung will get with me. And if they think I'm letting one of their Internet-connected TVs (with mic and camera) in my house, they're delusional. The Gear Fit brought to mind another question that I'll likely never get an answer to: how does this happen? Fine, you made some really bad dev hires. But don't you have a test team? Does the test team suck, or are they just ignored? What about project management? When the test team comes back and says, "the cycling function doesn't work. It will never record a whole workout without stopping mid-way.", does PM just say "ship it anyway"? Come ship date, you just take whatever is sitting at HEAD no matter what shape it's in, build it and call it the RTM build? I would seriously pay a week's wages to spend a week with their product team to get a look from the inside on how not to build software.
- throwaway851223 12y ago
feniv 12y ago
I bought this camera several months ago and I just want to chime in and say it's takes some AMAZING pictures. For all of the complaints about how bad Samsung's software is, its UI is a lot more intuitive than what I've come to expect from most cameras. The vulnerabilities they mention seem akin to what you get from connecting most printers to your network.
- ge0rg 12y ago
  My goal was not to criticize their UX (which I do nevertheless, triggering "advanced" features like HDR takes some amount of clicking), but to point out things that still need to be improved. Modern interconnected devices need to adhere to a new security standard, or they will be turned into bugs against their owners.
mx12 12y ago
If you're interested in more camera hacking, here is a very interesting talk from last years black hat about hacking security cameras. Title: Black Hat USA 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker https://www.youtube.com/watch?v=LaI0xjeefpg https://www.youtube.com/watch?v=LaI0xjeefpg
userbinator 12y ago
I don't think a digital camera needs to be running a pretty full-featured Linux distro with X11 and all, nor phone home with your location, nor have several hundred MB of firmware. These "smart" devices are way too smart for their own good.
murf13001230 12y ago
I don't know... I kind of like it that it is as hackable as it is. Worst thing imho is the permanent write-lock problem and that it should be secured in a way that lets the user hack it but keep the baddies out.

126 points by ge0rg 12y ago

FYI, the request to http://gld.samsungosp.com http://gld.samsungosp.com is probably to attempt to detect wireless networks which require login. iOS does something similar - http://blog.erratasec.com/2010/09/apples-secret-wispr-request.html http://blog.erratasec.com/2010/09/apples-secret-wispr-reques...

mey 12y ago
I understand the accept-language based on the company that created the device, but why would the accept reference shockwave and excel documents? That seems a little odd and not a simple library default.

matthewmacleod 12y ago

Jesus. How do engineers get away with this sort of thing? Why is there such resistance among hardware companies to a philosophy along the lines of "let's develop some simple, no-nonsense, standards-compliant firmware with a straightforward user interface"? Like every single router configuration page - godawful. There's a hardware platform I've been keen to implement for some time, and to some extent I keep putting it off when I think about how challenging security and a good UX would be. Apparently the bar is lower than I thought.

joezydeco 12y ago
Because the engineers get a directive to jump to a new platform (like Tizen) and they're handed a barely-working reference platform with a HelloWorld app on it. Then they're told "oh yeah, this has to be ready by the Christmas selling season, which means you need to lock down firmware by July 1st. And we're demoing it at a trade show in May." And it's already April. So the engineers comment out printf("Hello World\n"); and start writing a camera. And so on. If they remember to take the other crap out of the Makefile (including the demo pictures of Obama), that's probably because they ran out of space in NOR Flash. Otherwise it stays in. Is there time to run network hidey-hole testing on the WiFi stuff? They're probably happy the thing takes a picture without wiping the SD Card a this point. It's all bubble-gum and duct tape underneath it all. From your Toyota auto to your Samsung camera to the Smart TV on your wall to the KitchenAid LCD oven in your house.
- r00fus 12y ago
  What's with your comment about the Toyota auto? As I understand there's a hell of a lot more regulation, forcing automobile product time lines to be naturally longer.
  - mahyarm 12y ago
    Probably talking about the in car infotainment system.
  - pearjuice 12y ago
    He is taking a cheap stab at a budget car manufacturer. Probably owns a Tesla. Or two.
    - joezydeco 12y ago
      Actually I drive a Toyota. But it's a 1996 model. ;-)
  - joezydeco 12y ago
    "Toyota’s developers used MISRA-C and the OSEK operating system, both good choices for a safety-critical real-time system. But then they ignored, sidestepped, or circumvented many of the very safety features they are designed to enforce." "On a cyclomatic-complexity scale, a rating of 10 is considered workable code, with 15 being the upper limit for some exceptional cases. Toyota’s code had dozens upon dozens of functions that rated higher than 50. Tellingly, the throttle-angle sensor function scored more than 100, making it completely and utterly untestable." http://www.eejournal.com/archives/articles/20131127-toyota/ http://www.eejournal.com/archives/articles/20131127-toyota/ Michael Barr was the engineer that was able to sit down with the Toyota engine code during the "unintended acceleration" lawsuit and determine what NASA could not: that the code was a wreck: http://embeddedgurus.com/barr-code/2013/10/an-update-on-toyota-and-unintended-acceleration/ http://embeddedgurus.com/barr-code/2013/10/an-update-on-toyo... Like I said. Bubble gum and duct tape.
  - dbloom 12y ago
    The regulations only apply to the engine computer (which is probably not changed much in each model year). There is no strict quality or safety (or aesthetic, for that matter) regulation for the entertainment/climate control system user interfaces. (In case you've ever wondered: yes, these screens do often show information from the engine computer. For example, the 2nd generation Prius's center console screen shows live information about the hybrid system. But that information is pretty much always obtained from a read-only connection to the CAN bus.)
javajosh 12y ago
People don't care how the sausage is made.
- Falling3 12y ago
  It's not about how it's made. It's about the final product.
- pfortuny 12y ago
  That is until some expert comes and informs them that it is actually made 90% pork 10% rat.
  - dvhh 12y ago
    And soylent green is ... nevermind the taste is amazing
criley2 12y ago
Because the average user and the vast majority of users can't use your straightforward and easy UI without explicit instructions because they don't understand any of it. If they're not going to use it or understand it, why spend time on it? The model is moving to ISP-controlled network hardware anyway. All new Comcast modems are remotely manageable by Comcast and they enable features that customers have to call Comcast to disable, as Comcast has better access to the modem firmware than the end user.
- drdaeman 12y ago
  It's actually irrelevant who uses the interface - the end user or ISP employee acting on users demand. Such change of the party in charge neither adds any usability to user interface (just the side who has to struggles with it), nor it increases security and reliability.
  - criley2 12y ago
    I actually believe that you're using false equivalence to pretend that both paradigms are the same. I disagree that they are, and I believe that you've made a lot of assumptions to declare my point "irrelevant", the biggest of which being that the software is identical and the only difference is who accesses it. That's a falsehood, and I'm going to reject the rest of your point because I disagree with those assumptions.

lnanek2 12y ago

The security flaws are bad, like not write locking the tag. Still, lots of fun stuff for a developer user there, though. It runs a full X server, so technically some Linux people might consider it even more capable than Android. Supporting a shared amongst manufacturers format like DLNA is cool too. Maybe a different brand smartphone could work with it more easily then, for example.

skeletonjelly 12y ago
Plug in a few things and you'd be able to make a phone call from your camera and have it run Breakout or something

mikestew 12y ago

I'm shocked, shocked that there is shitty software running in this Samsung establishment. When I saw the title, I had a strong suspicion that it wasn't about making the camera do cool things, but the subject would be "how broken is Samsung's firmware?" What is it with Samsung and software? I mean, they can crank out some decent hardware, but their software is consistently abysmal. I have a Note 3. Ignore the plasticy and cheesy (fake leather stitching? Really?) exterior, and it's a decent piece of kit. But the included software is consistently crap. I bought the Note for the stylus, but both S Note and Action Memo apps that are to be used with the stylus consistently lost data. I think they fixed it in a later update (haven't lost data lately), but it doesn't inspire confidence. The prime example is Samsung's new Gear Fit. It just plain doesn't work as advertised, and it's due to unbelievably broken software. The only things that work reliably are the notifications and the pedometer. And though the pedometer works (if a bit inaccurately) the data reporting is broken. I mean so broken that if you want a historical listing of your steps each day, you'll have to write it down because the data reporting is grossly inaccurate. Everything else, including most exercise functionality, just doesn't work. I thought it would be fun (and please pardon the shameless plug) to see if I can post a new bug every day: http://gearfitbugs.tumblr.com http://gearfitbugs.tumblr.com (been slacking the last few days for lack of time). Point is, how do they stay in business? Who buys one Samsung product and then turns around later to buy another one (okay, me, I guess)? For me, they don't get three strikes. Two hardware products with amateur-level software (with apologies to all amateur developers out there; your stuff is likely better than Samsung's) are the only chances Samsung will get with me. And if they think I'm letting one of their Internet-connected TVs (with mic and camera) in my house, they're delusional. The Gear Fit brought to mind another question that I'll likely never get an answer to: how does this happen? Fine, you made some really bad dev hires. But don't you have a test team? Does the test team suck, or are they just ignored? What about project management? When the test team comes back and says, "the cycling function doesn't work. It will never record a whole workout without stopping mid-way.", does PM just say "ship it anyway"? Come ship date, you just take whatever is sitting at HEAD no matter what shape it's in, build it and call it the RTM build? I would seriously pay a week's wages to spend a week with their product team to get a look from the inside on how not to build software.

throwaway851223 12y ago

feniv 12y ago

I bought this camera several months ago and I just want to chime in and say it's takes some AMAZING pictures. For all of the complaints about how bad Samsung's software is, its UI is a lot more intuitive than what I've come to expect from most cameras. The vulnerabilities they mention seem akin to what you get from connecting most printers to your network.

ge0rg 12y ago
My goal was not to criticize their UX (which I do nevertheless, triggering "advanced" features like HDR takes some amount of clicking), but to point out things that still need to be improved. Modern interconnected devices need to adhere to a new security standard, or they will be turned into bugs against their owners.

mx12 12y ago

If you're interested in more camera hacking, here is a very interesting talk from last years black hat about hacking security cameras. Title: Black Hat USA 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker https://www.youtube.com/watch?v=LaI0xjeefpg https://www.youtube.com/watch?v=LaI0xjeefpg

userbinator 12y ago

I don't think a digital camera needs to be running a pretty full-featured Linux distro with X11 and all, nor phone home with your location, nor have several hundred MB of firmware. These "smart" devices are way too smart for their own good.

murf13001230 12y ago

I don't know... I kind of like it that it is as hackable as it is. Worst thing imho is the permanent write-lock problem and that it should be secured in a way that lets the user hack it but keep the baddies out.