Decrypting SSL to Chinese Cloud Servers - Hacking the VStarcam CB73 Security Camera

[@mattbrwn]

UPDATE: my camera account was pwned within 2 hours of the video going live. 😎Well done internetz

[@fakename2123]

LOL

[@PyschoHD]

🤣🤣🤣🤣🤣🤣🤣🤣

[@sakuchi4914]

well that was quick lol

[@kuyayan]

Dum Spiro Spero my friend. Soli Deo Gloria indeed. Nice phrase btw!

[@Darkk6969]

2 hours? You guys are slackin. 🤣

[@khx73]

Helped a friend set up a 6 camera system. He bought 4 reputable cams and two cheapies. We configured all cams to shut off any and all cloud services. All were set with static IP, gateway, NTP server, and NO dns. The four reputable ones generate zero unexpected traffic. The two cheapies? Constant flow of connection attempts to cn owned IPs, as well as dns requests to google DNS IPs (apparently hard coded). Nothing goes anywhere since they're on a segregated VLAN with no outside access... but the firewall packet counters are in the millions.

[@reabstraction]

Probably spyware selling what you do and recording *that*

[@zyghom]

I did the same, for all my Reolink cameras

[@khx73]

@@zyghom Do they stay quiet on the network? My Hikvisions do.

[@zyghom]

@@khx73 they don't stay quiet but firewall does not let any traffic from them outside my LAN ;-)

[@khx73]

@@zyghom Dirty little things... haha

[@the_beefy1986]

TLS encryption, in this case, is probably more about obscuring what this device is doing versus protecting the user's data.

[@TechTusiast]

What did you expect from chinese products? For younger people, watch the beginning of "Three body problem" and remember that unlike in Germany after WW2, this regime was never over thrown or made responsible for what it did and still is doing. This message will likely be removed after CCP propaganda machine launches multiple feedbacks to KZbin demanding it and YTs algorithm removes the message.

[@is350ace]

This is my favorite newly discovered KZbin channel. I watch every video as soon as they drop. Keep it up Matt!

[@tente-outro]

just like me

[@kateshiny6187]

🙋🏻‍♀️

[@paerrin1]

Same here! I get super excited when I see a video drop 😂

[@zetagaming8322]

same 😂

[@andreuuu68]

How cute they think+ 5g (jj=. P😊

[@mjmeans7983]

What i'm interested in is when firmware detects that it has no internet connection (because I put it in a network jail), but that triggers routines in the device to escape the jail by automatically connecting to any nearby open WiFi without being told to. Or having firmware that can entering promiscuous mode to watch and analyze other devices for te purpose of masquerading as those devices after it sees it's silent for 30 minutes or so in order to find a way out of its jail. I'm concerned with so-called security cameras that provide no actual data security, or worse actively try to evade attempts to make them secure. It's not a matter of whether your cloud data is secure, but when it becomes insecure and whether you will ever know that it has happened. Cloud data means it's stored (potentially indefinitely) on someone else's computer and used for whatever purposes they want to use it for. And you have no recourse if they lied to you in the first place, or later abuse that trust whether it be willful or by neglect.

[@monad_tcp]

that's why I have to wrap the device in tinfoil, so the WIFI doesn't work

[@tlxyxl8524]

That’s technically possible. But in practice, I don’t think most companies producing these cheap cameras are doing that. Not only does it significantly increases the software R&D cost, they have little to gain from, since most people using it are not experts in security, and simply sending data from device to their server is enough to “monitor their customer” (if that’s their goal). I bet most of their target customers don’t know how to setup a Firewall on their router. What you have described is more like an attack organized by state-backed hackers, who knows their device is likely to be placed in an airgapped environment or some sort. But let’s be honest, any high security facility won’t use WiFi security cameras at all. So a state backed hacker group will likely spend their time on something else that is more effective.

[@BLKMGK4]

Have you identified any devices behaving this way?

[@robertmccully2792]

There is always someone smarter hacking what appears to be secure. However if they’re at the top of the game they’re going after big fish.

[@mjmeans7983]

@@tlxyxl8524 I disagree. These companies producing cheap cameras are licensing firmware provided by another company. If that other company is a state sponsored front for a surveillance agency, then the licensing cost and terms will be very cheap to the camera producer. Something similar happened with a US agency that 'sold' an advertising library to Kuran app developers in order for the US agency to dragnet track Muslims. This kind of thinking not only can happen it IS happening, and it logically must happen. Only a fully open-source software and hardware (including microcode, ASICs and SBC BSMs) or full reverse engineering can hope to find these things when they are imported devices because there is no legal recourse against a foreign government that engages in this activity. And political recourse against a country doing this to its neighbor is unlikely.

[@arejay988]

this is the content we need more of, keep it up matt this is legitimately great stuff

[@CarneyAsada101]

You are wonderful! A couple of months ago my work was throwing out old IP cams and I asked to have one because I was super interested in hooking it up and digging into everything that’s on it that the user doesn’t get to typically see. The camera is a Vstarcam. How lucky am I that an expert like yourself is doing exactly what I (an absolute amateur) was wanting to do on this brand of ip cam!

[@dr.hinneredv932]

Thank you for letting us know. Having no certificate also means no certificate can expire. :-)

[@mattbrwn]

Root CA companies hate this trick!!!

[@MikkoRantalainen]

They could use self-signed root CA without any expiry time.

[@Hoerli]

Point the camera at a Rick Astley video so that a hacker of your keys can see the success directly :D

[@mikesyr]

Actually that's a really good and easy way to show proof of hack, point it at something only @mattbrwn knows, and they can jump on the discord with an image for proof. They can provide further proof afterwards....or not... 😂

[@jitgtij]

that is an awesome idea

[@nezu_cc]

Remember the time when 4chan located indoor cameras and raided them. I'm not sure it's that great of an idea...

[@mikesyr]

@@nezu_cc Cats out of the bag on that already if he's leaving it online for it to be hacked.

[@dumbidiot1119]

@@nezu_ccwell it was bc the camera was near an open window. I’m sure he can just put the camera in a box or something

[@kuyayan]

You are a natural teacher as well. I hope you many, many subscribers!

[@zymurgist8844]

This is some really cool content. I would highly recommend a brief intro with some bullets on what you are going to attempt and then as part of the outro, provide a summary of what you discovered. It would really help tie everything together.

[@is350ace]

I like this suggestion too. I feel like he always addresses his thinking process as he goes, but a quick outline up front may be helpful.

[@j0hnny_R3db34rd]

I would highly recommend they keep doing their own thing how they want, when they want. I'm here to watch, not exert control over the Internet.

[@cozzm0AU]

I’m not a hacker and have zero Linux knowledge but this stuff and how you present it is fascinating to me regardless. Thanks for taking the time to setup these demonstrations and so clearly explain what is a very deep understanding of these devices.

[@davidg2861]

For the typical end Luser, anc customer support people (if any), the potential for every device dying when the cloud server's certificate changes to one not in the chain of trust is a potentially significant issue. From the programmer's perspective... They possibly said to their manager, 'to do this properly we need to provide a way to update the trusted certs regularly' the account said oof, more infrastructure? and the CS people said 'what about users who had the device turned off for 2 years, and the manager replied, 'what if we just don't check the certs?' and went home with a bonus for saving the company money.....

[@monad_tcp]

"what if we just don't check the certs?" what if we check the certificates and the stupid users that forgot to use the product, forgot that they even had the product, so you sell them another one !

[@soneomeelse]

OCSP is what they need

[@TheAlchaemist]

To be honest, I would not be surprised if this was actually just as intended, by Chinese rules.

[@Tibbon]

Your videos are as good as sitting in sessions at DEF CON!

[@Unit-zv6zh]

Man these videos are great, love how you explain your steps with enough detail to follow along. Great stuff.

[@hockeyrink]

Wonderful. Exactly answering some of the questions I had about some of my Chinesium security cameras. I really appreciate you going through this with live workflow. Keep up the good work.

[@turtlefrog369]

western cloud cameras are not very different.

[@hockeyrink]

@@turtlefrog369 You're right. Really doesn't matter the country of source.

[@ThisIsJustADrillBit]

Absolutely incredible channel. You keep the pacing super easy to follow and your topics are always interesting. Very educational and cool at the same time this is one of my favorite channels now ❤

[@yay-r6j]

loving the idea of letting peeps from the web fish around on the device and connect with you and others on discord ❤

[@JohnnyLeuthard]

This is one of the many reasons people need to be more aware of the risks of IOT devices. Especially when it comes to devices from other countries like China. Even thermostats, sensors, etc. It;s all sending data and to think and say things like "I don't care if China sees the temp in my house" is not seeing the bigger picture. As your video points out IoT devices are not very secure. I've even seen some people argue that they disable traffic to China. That "may" help but not all people have that skill and I guarantee you Chiuna has cloud based servers all over not just in China so you really don't know unless you have the skills to analyze traffic, look at all destinations and lookup who actually controls that endpoint and dig up what shell companies may be masking the true owner/country. Good video.

[@supremeleader5516]

How temperature will benifit china?

[@t4nk3d402]

@@supremeleader5516 that thermostat can run network scans, or whatever recon and send it back to china. Every network device has a mac address which is assigned to a company. They could watch and see how many people have a samsung tv over a tcl for example and then sell that data to marketing companies to try and sell you something. Thats one small example. There is a lot of data going through a network at any time. Sometimes you just dont know what you dont know.

[@mashiniwami]

Until non-China stuff is tested you have no way of being certain the same, or more sophisticated, shananigans are going on.

[@nickg9215]

Good video, I can feel you raw passion and excitement about what you're doing coming through. I'll have to check out some of your others.

[@NilsHerzig]

Nice video! Btw, find supports filtering for names and even executing other commands on its results find . -iname '*pam*' # same as the grep pipe find . -exec file {} \; # same as your xargs pipe

[@rubhern8187]

After all these years never knew or have seen all this techniques in action. Very excellent explanation and educational we need more of this stuff. Subscribed and liked thanks matt🎉🎉🎉🎉

[@uncommonengineer]

That was an awesome run-down and explanation Matt, subscribed!

[@aniketsrivastava2651]

Yooooooo, You just got a new sub. Lovely vid. Love the work! ❤

[@joonasmakinen4807]

Subcribed! Not only highly educational video, but reveals why it makes strategically sense that AliExpress and similar are so dirty cheap. Could you make more videos exposing products bought from China?

[@kyoteecasey]

Awesome stuff mate. I am learning so much, and gives some scale as to how much I have to learn still. Keep it up!

[@iamionscat9035]

Jesus! I just stumbled across this video and now I'm subscribed and know that I need to be much MORE more paranoid about stuff that I was previously just suspicious about.

[@micahakervold]

Your content is awesome man,thanks for making it!

[@jordanaldrich]

Great video. You did a great job explaining all the steps you did.

[@NanoCloud99]

Great morning watch from Sweden, appreciate the video, Matt!

[@squelchtone]

How have I never found your channel before? subscribed! This should be a DEFCON talk.

[@bordeux]

finally some channel for me :) high quality content!

[@LonnonFoster]

Super instructive, and highly illustrative of the (in)security of many IoT devices. I just got into embedded and packet hacking at Def Con 32, and this is a fantastic continuation of what I learned there. Great to see these techniques employed in the wild, and you do a fantastic job of describing what's going on at each step.

[@joelljung9325]

Just discoverd your channel. This is sweet stuff. Great job

[@Turco949]

It seems, most of the current spies out of China are using 0s and 1s. Good stuff, Matt!

[@resoldab]

I hit the like button 10 seconds into the video as I know I am in for a treat! Great work!

[@nated4wgy]

Decrypting SSL!? Can’t wait for this one! Keep it up dude. Really enjoying the videos.

Way over my knowledge but found it very interesting to look at. Have for long time been thinking of a way to check what an app like TikTok and other app that should not be trusted, and different hardware, to see if they can be trusted. Wonder if such devices like you cheap camera should be on it's own network isolated from home server and other stuff. Looking forward to watch your future videos that educate us all.

[@SB-qm5wg]

Very cool. I look forward to part2.

[@namesurname201]

What awesome content again thanks matt❤❤

[@slincolne]

Looking at some of the details decoded by certmitm it looks like the cloud infrastructure may be setup for multiple manufacturers to use (the reference to OEM look interesting). What are the chances that the work that Matt is doing applies not only to the make/model of camera being analysed, but also other brands and models ?

[@mattbrwn]

Wow I didn't catch this! I bet you are right and that there are a bunch of whitelabel brands out there.

[@t4nk3d402]

im sure many companies are using these services. Think about the cost for them to pay for this infrastructure, these companies are pretty obviously selling some kind of data to pay for it. These cameras dont cost that much so they cant keep that kind of operation afloat for free

[@BlueByrd69]

Great content, Matt. You earned a new subscriber.

[@the-real-random-person]

This channel should go viral, love it.

[@mattbrwn]

I, an extremely biased source, agree 😁

[@kuyayan]

So thankful to have found you!! Woot Woot!!

[@MPE-iX]

Nice work Matt

[@Y3llowMustang]

Would be cool if you could get that binary to run on your Linux machine and view the video feed without using the app

[@JG-vo3mh]

Great content, definitely subscribing!!

[@andrewphi4958]

IoT means "Internet of Trouble". Also, don't get too comfortable if YOUR cam doesn't generate suspicious traffic. It is just waiting for the right time. ;)

[@paaabl0.]

Thanks!! Great video, ionly interesting stuff, no bullshit stories.

[@escherichiacoli7069]

respect bro, keep up the great work!

[@pierremartel3552]

Seriously. With what you are giving me as information and other hints. I am enjoying testing all the wifi device I have. Be it sensibo heat pump controler to my thermostats. And door bell camera. Amazing stuff!!!

[@JustLennyBenny]

Nice video's Matt, subbed! 👍

[@rklauco]

Now I have to reuse this tutorial in my lawnmower! I did not even try as I've seen it is ssl traffic, but I've never guessed the tls is not even verified! Thanks!

[@jani140]

What is the most dangerous threat? A kind of obfuscated but auditable connection or a perfectly secure connection directly to an malicious service?

[@racemouse5014]

Thanks for posting. Super interesting 🙂

[@ryangrogan6839]

Yoooo my man usin polybar and i3wm, lets go

[@AdamVanHine]

Such an awesome video! Thanks!

[@lastnameavailableok]

fascinating Matt, brilliant

[@jamesclegg8981]

I like this video. I'm technical (software experience but not security background) and would love more high level summary and explanation of what all this means. E.g. what are the consequences for users, what does this enable the Chinese to do etc etc

[@thinkright]

This is great content. Have you tried this on any major brand name cameras like Blink or Ring?

[@Sircliffe]

Great vid! Stay awsome, Jim.

[@myfxhelper7562]

Awesome matt!! subscribed!

[@themessenger-zq9lr]

Love these videos! Keep it up!

[@dan_in_sd]

was the initial HTTP Request packet for that .jpg file just a "semaphore" or "signal" to the chinese server farm that the device was rebooted. and perhaps the "token" was really a way to get a message to those servers? This might have been a method of obscuration used by the manufacture. also, I noted that a HTTP 404 was returned by the server. hmmm

[@AlgoBasket]

Nice Hacking Video, keep it up brother !!

[@andrewlalis]

Same shit with owning a VPS. I installed fail2ban and occasionally looked at the ban list, and it was just thousands of Chinese IPs trying to probe any open port.

[@khx73]

@@andrewlalis Did this with my firewall as well.. ru and cn hits in the hundreds of thousands

[@hatman-rc2vc]

very nIce, good man

[@johnsonfitzgerald2696]

A lot of wow but nothing out of the ordinary here

[@cbg4567]

Now I can say Jason Bourne is teaching me hacking

[@marcusaurelius3487]

A token was sent in clear text, havent watched the whole video but could be used to start a remote unauthorized stream with it, same was done with eufy cameras. The JPG is the thumbnail of the camera seen in the app. And when it comes to mobile applications not properly SSL pinning, this can be fairly easily circumvented with reverse engineering and the usage of software like frida, to override functions and or inject your own logic.

[@SteveJones172pilot]

So.. to make sure I'm understanding - The flaw that allowed you to successfully run the MITM is that the camera didn't validate that the certificate was signed by a trusted root, so it trusted the cert dynamically generated by the utility? If this is the case, but it didn't work, is it common to be able to inject a new trusted root into the filesystem of the device under test, or if it did the root validation, that would be pretty secure?

[@effsixteenblock50]

I could be wrong but I think in this particular case, the dynamically generated certs weren't even needed, as the app didn't even bother to validate the server cert.

[@SteveJones172pilot]

@@effsixteenblock50 Oh.. I was figuring that "not validating" the cert meant it just didnt verify it was valid up to a trusted root installed on the camera, but if it really didn't even validate the name of the cert, that's a new level of carelessness on their part! I might have to get one of these things just to play with now!

[@JamesTK]

@@SteveJones172pilotoften devices do nothing more than verify the common name/san matches an expected value. In those cases a self signed certificate with the same name as the intended site will suffice.

[@jimlundborg]

I am fascinated by type of thing and really enjoy your videos.

[@Mehhh_was_here]

I have mad mad respect for this guy.

[@Dutch-Viper]

Nice series! and the adres eye 4 China.............. 🤫

[@marcd6897]

Yeah, true, now that you spell it out. Didn’t see it in the first place.

[@BitcoinLifeToday]

Now I would like to see some kind of custom firmware that we can install to make it localhost RTSP stream with audio. That would be TOP TIER! Cause I also have these China cameras and would love to localize these.

[@hmtechsvc]

so freaking badass bro! next chapter lets goooooooo!!!

[@Matlockization]

Do these cameras have built in chinese backdoors from software or hardware or both ? And have you created a list of security cameras that have been compromised ?

[@mmuller2402]

Yes it has been proven, there are even Website with hacked or unsecured cameras..

[@Matlockization]

@@mmuller2402 Very worrying.

[@joonasmakinen4807]

@@mmuller2402How to find that website?

[@johnsullivan8673]

@@Matlockization what actually happens is these devices have to use remote servers to generate things like thumbnails and/or previews. The problem is you have to compete on price, not security.

[@Matlockization]

@@johnsullivan8673 Well, people are already paying extra for peace of mind since we all know what communist china are up to.

[@cg_539]

THANKS This is eye opening. Is there a clearing house for IOT devices that do not have these type of issues? Wired and Wireless?

[@ripplerxeon]

Great video, would love to see what they send after getting the auth.

[@Wraient]

Youre a goldmine of great videos

[@pauloantunes2363]

The Wireshark capture was on a specific port on your desktop or a port on your router/modem? It''s the mitmrouter?

[@anuroopkeshav2121]

your polybar looks so much similar to my previous style

[@zukjeff]

I also like to look for what other wifi/BT or RF traffic the device ( camera) has been scanning and packaging off the meta data for.

[@techbits-english]

Hi Matt, Can you do a video on decrypting the wireshark tls packets after certmitm injecting a self signed certificate in the camera connection? I mean, that should be possible now, right? I tried loading the certmitm key file into Wireshark but I just cannot get it to decode the tls trafic.....

[@mattbrwn]

That is only possible IF the TLS cipher used does NOT provide perfect forward secrecy. en.m.wikipedia.org/wiki/Forward_secrecy I agree this nuance would make a good video.

[@techbits-english]

@@mattbrwn So, how would you proceed if you want to spy on your camera traffic to see all the messages forward and backward with the Chinese server? Thanks for the link! Interesting!

[@mattbrwn]

A transparent proxy. E.g. certmitm or mitmproxy

[@mattbrwn]

Also sslsplit can create a synthetic pcap file if you really want to view the data in Wireshark.

[@theskelet4r]

Another Amazing Video Matt! Are you going to DC 32 this year?

[@markverstappen1365]

Could you make a video about your MITM-Router, hardware, making and software? Seach for a video and looked on your Github but can't find it.

[@mattbrwn]

its not HW, all software. sorry I'll add github link to video description

[@markverstappen1365]

Ah that would be perfect. Thanks!! On what linux distro do you run your script, or do you just run it in for example Kali?

[@romeoscrying2048]

I dont know how i ended up here, but im here to stay.

[@jpm172]

Great video

[@notsoweisz1]

I’d love a video on eufy cameras!

[@matheuscezar6309]

Hi Matt, Thank you for the great content! I have a question: when running a tool like certmitm, is it necessary to make any modifications to my router? How does the traffic get routed through the host? Thanks a lot!

[@kipchickensout]

I like how they misspelled "signature" as "signatrue" in one of those intercepted requests idk why, but now i wonder what "signafalse" looks like

[@thomasoliver1376]

Great vid!

[@flywithusMSFS]

Hello Matt! Your content is absolutely fascinating, I love your videos! A question, any chance you would once look at an easier project, such as the tiny LCD screens they sell for Pc performance monitor screens. They have an onboard chip and the HW usually can only be used with the provided software.

[@nathanruben3372]

I setup rules for hanasonic camera c210, it was trying to access dead panasonic cloud services in holland. Every ip camera register themselves somewhere to let users easily access camera from internet without messing firewall rules, port forqarding etc, buying rns name etc..

[@uzlonewolf]

The IoT devices I"m familiar with use TLS in PSK mode. It is very lightweight as there are no certificates to verify, and cannot be MITM'd unless you know the PSK.

[@MelroyvandenBerg]

If a root cert expire. Those IoT devices stop working. Or when your server cert is too strong for the IoT device openssl version. Either way, there are many bad reasons why it wouldn't validate the server certificate 😅

[@comosaycomosah]

I love this channel

[@chompchompnomnom4256]

I've got Zosi CCTV system and as soon as I set up a password on there, I stated getting hacking attempts on my network and even my email, so I just leave it offline and only access it locally. Also what's the point in SSL if it can be decrypted so easily?

[@showupshowout]

How did you connect to the device? UART? etc?

[@JR-sq2of]

Great video Mr Matt. So it's probably not good to buy a CAM from Temu? 😮