Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker

[@FarazMazhar]

Makes D-Link joke. *laughs* *nervously realize I also have D-Link products*

[@butteredtoast8666]

some places that make cameras, expensive and inexpensive, use the same stuff it doesn't matter.

[@57thorns]

I have a router, I am powned. Simple as that. Mode, make etc makes no difference. But the only webcam I have is connected through USB when used and otherwise physically disconnected.

[@nogo7277]

@@MrDoboz would work for blackmail purposes

[@MrDoboz]

@@nogo7277 unless the hacker can automate the blackmailing (which is not an easy thing to do), it's probably not worth their time. They could work on some ransomware instead which brings some shitton of money, or just get a real job at some security testing team. You see those are the big money, not individual person's wallet. Those are not big, and many would still refuse to pay.

[@stormchaser8472]

the toaster laughs!

[@DeeWeext]

The speakers should always repeat the questions asked.

[@micicubere]

I regularly speak every year, and I always forget to do this! You're at the end, the tough part is over (only questions left), and it's so easy to miss it. (I've written this so I engrave it into my brain)

[@xl000]

you can infer the question from the answer

[@maze42d]

xl Not if the answer is something like "yes" "no or "maybe"

[@omardude39]

Good speaking practice, but to be fair, I really liked this speaker's mannerisms, his talk presence and clarity so I let it pass because his talk was extremely interesting and very entertaining.

[@GoogleUsedToLetThisNameBeLong]

Or you could just ascertain the questions by listening to the answer. Lemme help you out. (and yes I know this was commented 3 years ago) First person asked if these were the only cameras he had looked at for his research, or if he had an opportunity to look at some other more secure vendors. And second question asked if it was possible to replace the .cgi with something other than a still image, such as a video file. Luckily, there were no questions that were simply answered with a "Yes' or "No", but that's just offering half ass answers anyways, which most presenters are going to try their best not to do. Alrighty then!

[@olfmombach260]

This is better than comedy.

[@HelloKittyFanMan.]

That's fine, Olf, it's OK to like tech stuff more than comedy.

[@MrDoboz]

true, but it's actually sad too, now what the fuck am I gonna do? I can't buy a fucking camera that can't be exploited by anybody who has a brain and some free time to work out the exploits

[@WordlyAnkit]

exactly my thoughts.....I swicthed stand-ups with blackhat videos :D

[@jojolafrite90]

This is some form of comedy, to my eyes.

[@dementionalpotato]

6 6 better than douchery and pretentiousness.

[@katrinal353]

Every single time that I worry that technology is moving too fast for us security types, there's a million dollar company to prove me wrong. Every, single, goddamn time. I love it.

[@freedfighter96]

I barely know how to script, but I actually understood a good amount of that. This guy is great :D

[@omardude39]

I agree. He's fantastically good at explaining things in understandable terms.

[@butteredtoast8666]

You're AWESOME! dont give up

[@realm2090]

omg same!

[@simplekindofman8867]

Can someone tell me what he uses to read the firmware code?

[@adarshsingh764]

@@simplekindofman8867 binwalk. He said it at 31:22

[@renakunisaki]

Some of these are so blatant, you have to wonder if they're on purpose. Oops, the one script we forgot to password-protect happens to have a trivial root command injection exploit...

[@omardude39]

I think the vast majority of these backdoors rely on complacency - "we know way more than the average user, and that makes this device secure" - or security through obscurity - "let's make it difficult to defeat this security by throwing a few things in there they can't possibly know already". Lamentably, as a manufacturer it's far easier to deliberately write a backdoor into every device you produce than to try and provide the customer service to all of those who actually manage to lock themselves out of their own devices. This talk serves to demonstrate that if you (accidentally or deliberately) make your design vulnerable to attack, somebody will attack it. Because if they can attack it with the right reasons in mind, anybody can attack it for any purpose they want to.

[@GoogleUsedToLetThisNameBeLong]

​@@omardude39 Ahh yes, the classic "We know more than you and our customers are bound to be ignorant. Let us accommodate easy troubleshooting solutions that don't ask too much of our privileged position!" No idea why anyone thinks this is good logic, as something that is only secure to the ignorant masses isn't actually secure from any threat that matters.

[@mikepark5884]

A bugdoor, as we like to call it

[@cyberchef8344]

@imdahG What does this have to do with the talk? It doesn't take a government to take advantage of these types of vulnerabilities. Anyone with a decent undestanding of RE and exploitation can utilize them, and anyone that watches a talk like this and has a basic understanding of computers can follow along and utilize the bugs that security researchers publish. Furthemore, going back to your actual point, what makes you think the government even takes advantage of these? The employees have more important things to do than watch random video feeds. The speaker also made a note to say that he discovered these on his own - this wasn't work he was doing for the government.

[@butteredtoast8666]

Mr. Patato head! Mr. Patato head! A bug door is not a secret!!!!

[@aeonlong8303]

Very good presentation. The presenter is also very good with public speaking, and knew this subject very well. Also was experienced with good audience eye contact, and body language. As a former instructor/trainer myself, public speaking is not for everyone. Interesting subject, I didn't understand a lot about the coding and software values, but nonetheless it was fun/scarey to listen to what can be done. Job well done.

[@YaBoiiiNikki]

Simplicity is key: Want to be safe? Just get a camera physically connected to a hard drive. Almost 10x cheaper and definitely more secure.

[@ConstantlyDamaged]

+NikkiDiamond Or put your IP cameras on a locked down vlan with no internet access.

[@YaBoiiiNikki]

Darthane I'm too flinstone for that shit

[@ConstantlyDamaged]

NikkiDiamond Damn you, now I have that theme song in my head.

[@YaBoiiiNikki]

Darthane That was all part of my evil plan

[@endoscopisis]

+NikkiDiamond hahaha too flintstone for that shit hahaha

[@pgibsonorg]

He failed to guard his corona now there’s an outbreak.

[@mikhailoldskool8955]

haha i just realised that and its now 2020 woah

[@maycodes]

lol

[@Rico-iz8mb]

Dude you know it doesn't come from the beer right? also this talk was from 7 years ago...

[@princeray4247]

@@Rico-iz8mb joke went miles over your head huh?

[@thefudderation444]

Six years later, and this shit is still happening... CVE-2019-15498

[@burgerlx8871]

OMFG LOOOOL

[@57thorns]

Of course. No one cares about these things. NSA want these backdoors. Russian equivalent want them. Customers (even when running nuclear plants) does not know enough about these thing. I as an professional programmer with more than a few decades worth of experience and enough interest to see a few of these videos do not know _enough_ about these things. And most people, programmers and customers alike, can't be bothered.

[@andrew1717xx]

I'd even argue there are two reasons. Innovation and profit. Flaws=room to improve=Selling "Better" equipment with different flaws. After all, the media basically suffers from the same security through "obscurity" bias.

[@icarusswitkes986]

Wtf still?

[@killslay]

is that podium comically large or is he comically small

[@AreroniumPlaysL]

both

[@jonotwist]

Schrodinger's poduim

[@carloharryman]

Could be neither, camera might just be really low and close

[@DanielRivera-pb9zs]

Comical camera angle !

[@Shazzkid]

He's just comically far away from it

[@H33t3Speaks]

For anybody wondering whether or not the byte code is x86, it is ARM. (now things make sense lol)

[@hgbugalou]

This is why I drop all traffic to and from my IP cameras at my edge firewall. If I want to view them remotely I will VPN into my network. It's old school but I don't trust any hardware running embedded Linux on my network. To many companies have no idea what they are doing code wise and these cameras are essentially computers to be abused.

[@fss1704]

yeah i don't run anything other than openwrt, the main router can be whatever the fuck but i won't connect without a good router.

[@lostcause7072]

Get this man a glass of water.

[@garybarbourii8274]

He was saving room for Corona

[@nahrafe]

11:58

[@davecarter4129]

hell no, take his water... his loud ass gulping

[@paulx2777]

Moral of the story: don't put your surveillance system on the Internet. And if that is impossible for you, put it behind a firewall that has been beefed up to eliminate such exploits (I'm not sure this is even realistically possible, but I'm just suggesting a possible way to deal with insecure devices of which we have no shortage).

[@quelorepario]

I don't think a firewall will protect you, unless you are blocking all traffic to the camera. If there is a firewall rule allowing incoming http traffic to the camera, to the camera it will be the same to have video feed streaming out from strings coming in or out, and those strings can be malformed urls or command injections.

[@paulx2777]

Yeah. So again, don't put your system on the internet. What little having an internet-connected system buys you (a bit of convenience), is not worth the risk of easy exploits.

[@satibel]

the easiest way to block from the firewall is to use port knocking. that means trying for example to connect on port 30506, then 18365, then 28435, then the firewall allow http packets to the webcam from your IP only, if you don't connect in this exact sequence, it blocks you for 5 seconds. if you wanted to brute force a 3 port port knocking pattern with a 5 sec timeout, you'd have to wait about 21 990 232 555 520 seconds or about 696 828 years. Still doable, but if you change the pattern every 2 months, that might be almost impossible (you'd need a 4 million ip botnet working on it, and it should probably rise a huge flag on the firewall.) also if you lock definitely an ip after 50 or 100 fails, it would be impossible to brute force unless you are lucky.

[@dylanh333]

Better still, set up a personal VPN to your home network and only make it accessible from that and the LAN, or alternatively, use SSH port forwarding to get to it. Don't make it accessible directly from the Internet - even with port knocking

[@jx4219]

Or you just put a second password between the camera and the internet. The backdoor doesn't work anymore then.

[@themanyone]

This guy hacks into security cameras for fun. It looks simple, but it took some brain power to figure out. Although some of these exploits are patched by now, hardly anybody updates their firmware, and someone could conceivably download new firmware and find more of these exploits in a debugger, without even having to buy the camera.

[@fss1704]

they're almost all gone by now, you have to remember that ipv4 is rather small and that people fuck up the hosts or a white hat comes and plant a flag, fixing the cve.

[@JasonSpiffy]

This is great! Scary but great. Ive read about several companies doing half assed jobs doing these kinds of things. This man just showed how easy it is (for the people with the technical skill).

[@mandisaplaylist]

13:28 Well, they use "high security" as one of their marketing points. Additionally, their main business focus is networking infrastructure hardware. So this networked camera insecurity fiasco is pretty relevant and pretty embarrassing for them even when "they are not a camera company".

[@simplekindofman8867]

I am new to the cyber world and I have to say this video is amazing. What great presentation and knowledge. Thank you.

[@PeterMaddison2483]

Have you got Kali Linux? If not, get it.

[@simplekindofman8867]

Peter Maddison I’ve got it. Using it on Virtual Box. This security stuff is so complicated. I had no idea how traffic could be manipulated.

[@haveaniceday7950]

Simplekind Ofman any update for a fellow absolute beginner?

[@simplekindofman8867]

@@haveaniceday7950 Well, I use Virtual Box for loading the virtual machines. However, lately, Hack the Box is a great site for practicing pen testing. You learn a lot and see some real material. If you really want to learn, go to Udemy, they have classes really cheap and some of those folks are very detailed.

[@elduderino7456]

Every camera manufacturer ceo face rn: PIKACHU FACE

[@mitchblackmore5230]

Even though this was miles above my nerd level, it was still interesting to watch.

[@msven]

Thanks for the post. I love watching Craig's stuff. Very well explained and makes me actually want to look through firmware

[@Slash27015]

It's almost 2020 and these days I see automated scans on my router from all kinds of national IP's that scan automatically on every port available and try default FTP passwords etc, with access denied errors hence how i found out about this. This video is great security motivation for anybody, especially with the new generation of minecraft kids setting their routers DMZ to their local PC so their servers run easily consistent, but also opening a whole world of AI scanners that will get into much worse once they've found local admin / root.

[@ChillerDragon]

This was fun. Also funny was when he said 0day and I realized that the video was uploaded years ago haha

[@devnull7970]

Actually rofling at the "Ron Burgundy" exploit.

[@Shazzkid]

I. AM. ROOT

[@MrSaemichlaus]

Somebody needs to make a shirt of that.

[@MrDoboz]

I am Groot

[@colosalkompakt]

Winner of KZbin 2019!

[@DeannaEarley]

I used to work for a CCTV software company and the vast majority of cameras had default passwords still in use (I still have a list, and a map of all the camera clones) We always stood be the "we don't have a default/backdoor password" when people called us after getting locked out.

[@jozjr88]

Share the list

[@SymplyAmazingJD]

i really didn't understand a word, but somehow I still found it to be quite interesting to hearing him explain all this fancy stuff. I am highly confused yet entertained

[@aqueouscomputing8153]

Isn't this the same guy that developed Reaver, the tool built into Kali Linux/Parrot Sec used for recovering WPS PIN Registrars?

[@kd1s]

Well a good nmap scan is pretty valuable too.

[@dot_lexg]

I love the Bob Evans product placement of the podium

[@SirCommoner]

Playing Watch_Dogs and seeing this afterwards is really mindblowing...

[@matejcerman4494]

I have just finished the campaign and then discovered this video :)

[@SirCommoner]

Me too!

[@jian2069]

watch dogs is literally the worst game of this year.

[@SirCommoner]

Josh Kelly I agree

[@scionboy100]

Josh Kelly You're opinion, but it is basically the modern AC

[@lyfeninja7264]

With how much money these companies make, why do they not invest in the security of their products? It's sad to think people are able to tap into schools, hospitals, financial institutions, government agencies, etc and see anything that want; not to mention having access to the local network. Maybe instead of being so tight with their money, they should hire people such as the speaker to find vulnerabilities for them. I know there are companies that do such work, but there are more skilled individuals than what any company has. Put a bounty out for vulnerabilities... Awesome presentation.

[@57thorns]

26:26 In this case I believe the answer to "who is vulnerable" is "everyone"?

[@entee123]

It's 2019 and my friend told me that there are still cameras out there with version 1.4.13 that can be easily searched for and yet none of these exploits work. Strange...he said.

[@Jump-n-smash]

I've seen them behind WAFs.

[@EXPLROUTDOORS]

Would've been swell if he swigged the beer instead of the water at the end of that haha.

[@Dorngela]

Why in the world would someone possibly do Javascript Authentication? They write firmware for camera's but they don't know how to write PHP?

[@MazeFrame]

Why not have the firmware available and pay bounties?

[@MrDoboz]

@@MazeFrame You answered it with the question. "pay"

[@erikecoologic]

Great talk. Impressive that products not designed to receive updates are shipped in this conditions. We need better ethic in the industry.

[@the_average_canadian]

XD 3SVISION hasn't patched that yet

[@pokemocestlediable]

chuck norrisonefivesix now it is ^^

[@Lino1259]

There are still cameras accessible tho

[@TheMrKeksLp]

Don't forget that absolute nobody on this planet updates surveillance camera firmware

[@DilanGilluly]

What beats me is the admins throwing their security cameras out in the wild right on the internet. It's common and best practice to firewall them and hide them behind a secure VPN. Also VPN software gets patched and evaluated for vulnerabilities more than embedded firmware does. But these guys are like "nope, just throw that shit right on the open internet."

[@RileyNRV]

I hope to know as much as this guy does one day.

[@GoldCaesar]

What a stupidily large podium, really the adverse of what a podium is for🤦

[@KatorNia]

Funny, I always thought it was "0-day (zero-day)" instead of "O-day (oh-day)".

[@howlingwolven]

Both are right.

[@icarusswitkes986]

It’s been 6 years... are these patched yet?

[@KangJangkrik]

Not for D-Link, good luck!

[@deanvangreunen6457]

only issue is that if it had low video quality , when pausing or freezing the image, you will notice that from the user side that there are no artifacts, meaning that the user could detect that the image has been paused, such things which would add noise to a basic low video quality camera are nearby computers, other machines, maybe cleaning machines, or noise from the outside...

[@andhemills]

I was listening, not watching. After the exploit, I heard him take a drink. I was disappointed he wasn't swigging the beer that was being guarded. Phrase of the video: "Epicly trivial" Hoping the state of the art has improved in the last decade.

[@JimiDunlop]

Excellent talk! Thanks for uploading

[@Flqmmable]

What makes me happy is when someone laughs at his jokes that normal people wouldn't understand. We smart!

[@darthstar18]

I bet police and security officials are all over this convention

[@cellarseer]

I realize he's 1000x as brilliant as I am, so is it wrong it bugs me when he says "oh-day" instead of zero day?

[@GoogleUsedToLetThisNameBeLong]

I think your confusing his nerdy colloquialisms (which he let show multiple times in his presentation) with ignorance of the letter "O" not being the same thing as the number "0". But to be fair, your not wrong still lol.

[@GoogleUsedToLetThisNameBeLong]

@Joe Blow Yeah this is true. And while i do think he was doing it on purpose to some degree, I was thinking about another example where it's considered the norm. I live here in Denver, Colorado and if you ask almost ANYONE what our area code is, they will tell you its "3-Oh-3" or 303. Almost nobody will ever say "3-Zero-3", and i've never really given it much thought as to why until now...... Conclusion: People are weird.

[@edogg5690]

@@GoogleUsedToLetThisNameBeLong that's pretty common around me also. Somewhere along the line someone subbed Oh for Zero and it's been like that ever since. In fact the only time i ever say zero as opposed to oh is when I'm on the phone confirming some type of number or code.

[@andrewferguson6901]

yeah I fucking hate when people say four oh four error too /s

[@andrewmcswain9452]

"OH" is one syllable and is arguably the second easiest, after "AH." compare that to zero, which has two difficult consonants as well as vowels that vibrate at very different tones and in different parts of the oral cavity. in other words, it's just easier

[@tim2221]

What's that B64 non-standard key string encryption he's talking about? I have no clue what this is nor was I able to google it successfully.

[@fsecofficial]

Those cameras are all on the WAN and behind the WAP and firewall. If you’re already on the network you can just use Wireshark to watch existing feeds.

[@olfmombach260]

*So there is one big problem: Even if you can break through all these pseudo-walls and stuff, HOW THE HECK CAN YOU FIND OUT THE IP ADDRESS OF THE CAMERA?*

[@Landoaeon]

every vendor has programs that will scan for cameras on the network. it will even allow you to change the ip... without autentication... there are some models that lock this out though after a period of time after start up

[@olfmombach260]

Landan Hughes Now that is surprisingly (in a scary way) easy.

[@m3n4lyf]

*ahem* github.com/robertdavidgraham/masscan

[@2arx992]

shodan

[@KyrstOak]

He makes that tisking sound a lot.

[@Pippymint]

So?

[@mouser4290]

This has inspired a lot of fun thank you.

[@Slash27015]

Jokes to future hackers, I now have an obscure east-european router. Even I don't know how it's performing, but it's the sturdiest rock I ever owned.

[@adrianalexandrov7730]

Mikrotik, I'd guess? That's pretty popular in Eastern Europe

[@Slash27015]

@@adrianalexandrov7730 my secret has been compromised, roll the delete everything scene from wolf of wall street

[@westernvibes1267]

I never laughed this much in any comedy show. Xd

[@JoeCnNd]

10:40 I think the crowd didn't get the war games picture. lol

[@PashaDefragzor]

cracking the old way, I wonder about the creators of an IP cameras, what did they wanted to get at the end of a result, the next conference of a Black noob 2013 ? ^^

[@HelloKittyFanMan.]

Huh, this reuse of code across several brands of networked cameras reminds me of keyed-alike locks as described by "Deviant" Ollam! So even though this code isn't exactly keys (public, private, SHA, hash, etc.), it seems similar.

[@Polygonlin]

"This Camera has a list price of *CONTACT US* Which is how i KNOW i can't afford it" LOL THAT SHIT HIT HOME *HARD!*

[@squelchedotter]

Since they are all running GPL licenced software, why didn't he just request the source code? The GPL says it is his right to do so.

[@Noox38]

that's hella suspicious

[@fredrikjonsen6222]

and legal

[@DeannaEarley]

Their code may not be GPLd. The base os is normally a standard distro like uclinux, running other open apps like apache. They don't have to release their own code.

[@fss1704]

@@DeannaEarley yes they do, according to the linux license they have to open all of their modifications to the kernel, it doesn't say anything about The rest of the software

[@DeannaEarley]

@@fss1704 that's what I said. Thank you for explaining it back to me.

[@DursunX]

$get password..... >ok why not

[@fss1704]

they almost fucking leave that in blank text...

[@HelloKittyFanMan.]

And let me guess: the panel that covers the SD card slot on those cameras that have them is held in place by a lock that has "CH-751" or "C0106" stamped on it! Right?

[@MrDoboz]

no, it has MasterLock stamped on it

[@iangraham6730]

Excellent demonstration 👌 Anything nice for 'hikvision' lately?

[@keyboard_toucher]

"oh-day", "daymen"

[@TheMrKeksLp]

"Geoff"

[@coler154]

Ehtcee

[@finnaustin4002]

He knew about corona ahead of time

[@tommytomtomtomestini3894]

I had all the respect to this guy till he called the Corona a beer.

[@LashyYT]

Are there parts in the video that you don’t understand ?

[@opiniondiscarded6650]

I'd love to see a walkthrough of how he ran his Qemu. I wonder if he's just emulating the programs individually or if he's booting the full system with a kernel in a VM. I'd assume it's the former, but would love to see it regardless.

[@maycodes]

Memes, Exploits what else you want.

[@mikenichols0xcf42a64d]

Any updates to this talk? Have you looked at Ubiquiti's cameras?

[@happensign]

That was the scariest thing I've ever seen.

[@thegazillionmask]

18:47 how do i view the source code of a password field such as that one thats using java script, or anything else like php or whatever. Is it as easy as using inspect element in a web browser?

[@wasdasoos6552]

yeah you can just rightclick -> inspect to see the code, if they use js. you cant see any php code since its executed by the webserver but in this case the js evaluates if you authenticated successfully and redirects to the firmware dl page.. so you can just go there manually since you can see the needed GET param :)

[@fake12396]

they have a new site now, with a new security scheme for the firmware. instead of a password, they want the name of your sales person. brute force attack worked pretty well here, 2 guesses and i found out that 'Mike' gets you in. it's amazing how they can even come up with such password authentication and login systems.

[@freemanguess8634]

What is impressive is his knowledge of the exploits

[@MrDoboz]

your jealousy is impressive lol you see, most of the viewers here don't even know what IP stands for. I do, but I'm also impressed but about how awful these firmwares are lol

[@Axodus]

System? I KNOW WHERE THIS IS GOING!

[@ElunesMoonLight]

I have one question, all the admin pages IP adresses was accessed through google search i think right? How i can find out what IP adress is on one specific camera for example? Imagine this: I have camera on my house, i can see exact model of camera, how i can determine IP. Just interested how can be this done, in movies they know IP of everything imediately somehow :D

[@ElunesMoonLight]

@Marvin blue i would like to know how to find IP address. I just want to know how it is done. I dont need to hack something. i am interested in IT security. i never saw this concept on intermet somewhere of how to find IP of one specific hardware.

[@chriskaprys]

would anyone be so kind as to explain the grep command in terms of the command injection during 16:00 when he's talking about the IQinvision cameras? i think i understand the actual command injection appended to the end of the string entered into the URL (apart from the addition of "$IFS"), but how does the next command, "grep -i ...." come into play after that? it seems /oidtable.cgi and /oidtable.html give the same results in terms of the info they pull and list. thanks for any leads.

[@chriskaprys]

+chris kaprys oh nevermind. i missed that very quick slide that shows it's the camera's code itself that creates that line

[@ceskehry]

*chilling on my hardcoded access codes

[@Nicofromtheweb]

i laugh whenever they laugh but i don't understand any of this.

[@jonhille]

Is he using ubuntu? and what specific chromium did he use as his "hacker browser"? what made it a "hacker browser"?

[@knezivan1]

you tried any Bosch cameras? in my country they are the most expensive cameras sold and they sell a tone of them.

[@anglerandy5736]

Made in China, china has access.

[@Nerd2k7]

How does he managed to get to the download page at 18:58. What did he entered?

[@IVIasterIVIind]

Having checked it, their page still has the following bit in their source code: else if(par == 2) location.href = "prod_info.php?pid=" + pid + "&tab=4";That's a bad sign.

[@Nerd2k7]

ye i saw that too. But the question was what i have to enter to access?

[@quelorepario]

prod_info.php?pid=productid&tab=4

[@astrionn6182]

to make it a little easier for you: you can get the pid by brwosing to the product (in this case in the url it says :"prod_info.php?pid=11") so you already know half of the code ^^ just copy that and add "&tab=4" and there ya go

[@bornfree2237]

Isn't 100% of this avoided by separating your DVR IP network from the client? I use more Wisecom, but have used others the same.

[@fss1704]

nop, as long as you have a public address you can hack the camera and use the camera as a relay to hack the router or mess up with the network.

[@socaliguy81]

Does anyone really believe these back doors were left accidentally by the firmware programmers?

[@TripleForce]

omg just imagine these people want to see those people in the private chat room...lols

[@ThomasWagnerK]

Thank you for your admin password, Dlink Camera!

[@chrisg661]

what is the name of the software used to analyze the binaries?

[@chrisg661]

nvm it's IDA

[@haveaniceday7950]

So all of this is only possible if the model of the camera is known, correct? Then looking up the firmware sand going from there. Well in Hollywood they just do it without that😉

[@stockykhan9568]

My goal - get on this guy's level.

[@tryitout-701]

Don’t put your security cameras on the internet.

[@emsicz]

I get his point, but in order to do that, you have to access the same network the camera is on. Can someone point me in the direction why that would be the case? How do you get access to these? Even if the camera is accessible from the internet, how would you find it?

[@sheriffoftiltover]

Google.

[@G14N14RI12]

That's what the Shodan stuff was for. You can find internet connected devices using it.

[@samad934]

he is a real genius

[@xl000]

he's just asking machines to execute code he sent.. Nothing particularly new here

[@dahmanove1]

is all an do that ???

[@JamesJBurt]

ten commercials in 18 minutes.... screw you youtube

[@some______guy]

Isn't it called zero-day? Not oh-day.

[@Cobalt-Jester]

Why is this guy only just talking about something that we were all doing in late 90's early 2000s?

[@atreestump]

Cause the shit is so old it shouldn't work anymore, but it does and it's hilarious

[@GreenNati0n]

can someone explain how he gets root after getting admin access didn't quite understand that bit

[@grayfox4551]

Decoded the configuration file...then pass command new user=root......basically escalated privelges initially as default admin

[@freemanguess8634]

Reminds me when i gave myself root over win 10

[@flying-sheep]

Best joke: “A more reputable vendor like Cisco” ahahaha

[@BryonLape]

I do wonder how much of this is due to off-shoring and hiring bootcamp devs who are cheap.

[@simulationnomad5489]

On the 3S Vision website there is now, a new level of lame! Seriously, you don't even need to "?&tab=4", just view the page source on the Download page when the JS /usr/pwd box pops up, ALL the links that you need to download are RIGHT there, just scroll all the way down. ALSO for the ultimate level of stupidity, the JS Box ONLY blocks a certain part of the download page, meaning IF you scroll all the way down you will see the LINE of the JS Box end and you can click the links, not even need to check the Source page for these parts. Seriously...this is really bad.

[@nicolek4076]

Simulation Nomad It's terrifying how bad web sites are. The clueless contract with the unaware and put something in front of the public that's just plain awful. I've come across two monumentally bad UK government web sites this week, that have obviously been only superficially tested.

[@Nerd2k7]

+Simulation Nomad Can you describe that to me how he could got access to the page with the &tab=4 code section. I couldnt follow him

[@redactedllc.1864]

They changed the JS, cuz it doesn't work anymore... :/