I have put off the ILDVR camera, as I kind of lost interest.
For previous posts see here, here and here.
I was bored so I decided to poke at again.
I was interested where does the camera store users and in what format. What I found out is an atrocious mocking of security.
The camera stores local users and their passwords (in plain text) in following file:
/mnt/flash/data/OwnUserInfo.txt
Yep: the same directory which is accessible without auth via port 10081. So if you forgot password (and forgot the silly hardcoded HANKVISION), then you can get a reminder what it is by simply going here:
http://${CAMERA_IP}:10081/OwnUserInfo.txt
There is also another “binary” file that contains interesting references to HANKVISION and local users:
/mnt/flash/data/UserInfo
strings that and you get following:
HANKVISION e82f5af1f39f021b44e78089b5a40a8e0aa8d2768c705e8f139bec04d87d5a54 8f081b5a8e0685ca975a01d4159930f9 0d9a1f80bcc7a1e4a00f04588062ed67 admin 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918 21232f297a57a5a743894a0e4a801fc3 76eb00c6458e9b2755b570ae565ba0a6
Changing the password to HANKVISION reveals that this string is “encoded” “HANKVISION”:
e82f5af1f39f021b44e78089b5a40a8e0aa8d2768c705e8f139bec04d87d5a54 8f081b5a8e0685ca975a01d4159930f9
Not sure if the obfuscation is worth spending time on, especially when we already know HANKVISION is hardcoded in web server binary and OwnUserInfo.txt already contains passwords in clear texts.
strace-ing ‘webs’ process during certain conditions opens the /tmp/umconfig.txt, which contains following:
TABLE=users ROW=0 name=HANKVISION password=0d9a1f80bcc7a1e4a00f04588062ed67 group=Administrator prot=1 disable=0 ROW=1 name=admin password=76eb00c6458e9b2755b570ae565ba0a6 group=Administrator prot=1 disable=0 ROW=2 name=adminadmin password=5ca1e16e4fa3fa58b6656b9ad547fa0f group=Normal prot=0 disable=0 TABLE=groups ROW=0 name=Administrator priv=4 method=2 prot=0 disable=0 ROW=1 name=Normal priv=4 method=2 prot=0 disable=0 TABLE=access ROW=0 name=/browse/ method=2 secure=0 ROW=1 name=/jpgimage/ method=2 secure=0 ROW=2 name=/mjpgstreamreq/ method=2 secure=0 ROW=3 name=/form/ method=2 secure=0 group=Administrator ROW=4 name=/cgi/ method=2 secure=0
The “hashes” correlate to /mnt/flash/data/UserInfo…
Looking firmware upload function (in browse/javascript/sysInf.js) I found this bit:
function fileUpload(){
...
var typeAllow = [".ifu", "macaddr.txt", "deviceid.txt", "sn.txt", "audio.dat", ".bin", ".png", ".ifc", ".lib", ".uid", ".pid","logo.gif","whitelist.txt"];
var fileType = ["ifu", "mac", "deviceid", "sn", "audio", "bin", "png", "ifc", "lib", "uid", "pid","gif","wlst"];
....
I have tested the upload function with logo.gif and that worked: the logo on top got replaced, so it brings a possibility of doing something more (sneaking in a binary?).
Looking at ‘webs’ binary I decided to google for strings in case someone leaked the source or these bastards stole somebody else’s work.
Here what I found:
The string:
webs: websWrite lost data, buffer overflow
Matches suspiciously named file here:
https://github.com/socoola/yhrouter/blob/master/user/goahead/src/webs.c
Same could be said for these strings:
webs: Listening for HTTP requests at address %s webs: accept request
What is surprising is that they avoided doing execve calls where they could. IP addresses, routes, all set via ioctl, even time is set via settimeofday function. This removed possibility of command injection.
Here is what I believe is going on with this firmware:
The video side and core functionality has been lifted off SDK by Hisilicon. The web server stuff has been implemented by actual Hankvision people, most likely low paid undergraduate Chinese students. The core web server functionality has been lifted off the internet (see above).
What could have been done better without spending much on development:
Remove hard coded passwords!
Throw away all activeX crap (use MJPEG stream for “preview”).
Turn off telnet and leave ssh on with configurable password (perhaps make it a separate user?).
Do not store plain passwrods anywhere
Throw away all the dyndns and cloud nonsense.
Add actual off checkbox for FTP, Mail and SIP stuff (and possbly throw away SIP stuff).
Add VLC plug-in functionality.
Remove web server that listens on port 10081 exposing whole bunch of private data.
I am not sure what they are trying to achieve by not allowing SSH/Telnet access, but this is counter productive. I will not buy a security product to which I do not have control! Besides if I wanted to get access to your firmware, I don’t need SSH or Telnet, when I have RS232 and soldering iron.
For those who purchased this camera, if you really have to use it do the following:
Hexedit webs binary and change the HANKVISION bit to something else
And
Remove gateway setting (set it the same IP as camera) and preferably isolate camera from rest of the network (separate VLAN and port forwarding to recorder).
Or
Just chuck it in the bin and never purchase anything from ILDVR again.
Shame on you ILDVR for not responding to me when I contacted you almost a year ago about hard coded passwords. Shame on you ILDVR for not providing root password or firmware updates.