4 ms·

Unpacking CCTV Firmware

33 points by mortenlarsen 11y ago

pbreit 11y ago
I had one of those cheapo CCTV systems for a store of mine and, wow, how dreadful the software! Has anyone ever written some decent software that one could load up on the generic CCTV systems?
- sikhnerd 11y ago
  Zoneminder[1] is FOSS and pretty good, it's not pretty but very much gets the job done, and is fairly hackable. [1] http://www.zoneminder.com/ http://www.zoneminder.com/
- X-Cubed 11y ago
  If you have a Synology NAS, Surveillance Station works quite well. https://www.synology.com/en-us/surveillance/7.0 https://www.synology.com/en-us/surveillance/7.0
- hobarrera 11y ago
  Indeed, it's a Java applet that drops a DLL? Horrible. Basically, you need a windows machine with the Java applet installed (isn't this obsolete already?). Say goodbye to any potential security.
- contingencies 11y ago
  Maybe check out Axis, they are a very well established (15 years) provider of cheap web surveillance cameras. They may have slightly better security due to this. I know some of their earlier firmware vulns were called out.
chrisper 11y ago
Are you the author? There are so many typos...
gvb 11y ago
His spelunking through the binary shows "uImage" which is the U-Boot[0] header/wrapper for a kernel image. The mkimage[1] utility will show what is in the header and give direct information on how to dissect it. A very large number of systems that run on architectures other than x86 use U-Boot to boot their embedded OS, typically linux. U-Boot also has extensive command line utilities that can be used to explore the hardware and software. The console is often available as TTL-level signals on an unpopulated connector. A little soldering and USB/TTL-level serial converter[2] results in a console interface. [0] http://en.wikipedia.org/wiki/Das_U-Boot http://en.wikipedia.org/wiki/Das_U-Boot [1] http://linux.die.net/man/1/mkimage http://linux.die.net/man/1/mkimage [2] Example: https://www.adafruit.com/products/70 https://www.adafruit.com/products/70
captn3m0 11y ago
I did something similar for my D-Link router, and unpacked the last 3 versions of its firmware to look for security loopholes. The git history is interesting to look at[0]. [0]: https://github.com/captn3m0/dir-600l https://github.com/captn3m0/dir-600l

33 points by mortenlarsen 11y ago

I had one of those cheapo CCTV systems for a store of mine and, wow, how dreadful the software! Has anyone ever written some decent software that one could load up on the generic CCTV systems?

sikhnerd 11y ago
Zoneminder[1] is FOSS and pretty good, it's not pretty but very much gets the job done, and is fairly hackable. [1] http://www.zoneminder.com/ http://www.zoneminder.com/
X-Cubed 11y ago
If you have a Synology NAS, Surveillance Station works quite well. https://www.synology.com/en-us/surveillance/7.0 https://www.synology.com/en-us/surveillance/7.0
hobarrera 11y ago
Indeed, it's a Java applet that drops a DLL? Horrible. Basically, you need a windows machine with the Java applet installed (isn't this obsolete already?). Say goodbye to any potential security.
contingencies 11y ago
Maybe check out Axis, they are a very well established (15 years) provider of cheap web surveillance cameras. They may have slightly better security due to this. I know some of their earlier firmware vulns were called out.

chrisper 11y ago

Are you the author? There are so many typos...

gvb 11y ago

His spelunking through the binary shows "uImage" which is the U-Boot[0] header/wrapper for a kernel image. The mkimage[1] utility will show what is in the header and give direct information on how to dissect it. A very large number of systems that run on architectures other than x86 use U-Boot to boot their embedded OS, typically linux. U-Boot also has extensive command line utilities that can be used to explore the hardware and software. The console is often available as TTL-level signals on an unpopulated connector. A little soldering and USB/TTL-level serial converter[2] results in a console interface. [0] http://en.wikipedia.org/wiki/Das_U-Boot http://en.wikipedia.org/wiki/Das_U-Boot [1] http://linux.die.net/man/1/mkimage http://linux.die.net/man/1/mkimage [2] Example: https://www.adafruit.com/products/70 https://www.adafruit.com/products/70

captn3m0 11y ago

I did something similar for my D-Link router, and unpacked the last 3 versions of its firmware to look for security loopholes. The git history is interesting to look at[0]. [0]: https://github.com/captn3m0/dir-600l https://github.com/captn3m0/dir-600l