In the previous articles we saw some security vulnerabilities related to the camera operation and now I'm interested on using them to find a way to replace the camera software with my own-version of the IPC.

The camera contains an update function that allows it to check online for new software versions and update itself. Fortunately for the users (and unfortunately for me), the camera only accepts encrypted software update packages, so I'm not able to simply upload my own modified version of the camera software.

In the previous parts of this study, I've demonstrated how I managed to to gain root access to this unbranded IP camera, downloaded its controller software and started to reverse-engineering it. This article will cover some discoveries I made during this adventure.

During a house cleaning I found an old box containing several ancient Atari 2600 cartridges. I really wanted to play them again, so I started this weekend project: The simplest Atari 2600 ROM dumper I could assemble to play those games as fast as I could.

I needed a wireless remote control for my camera but they are kinda expensive. The official Canon remote costs about half a month of minimum wage where I live. So I went for a less expensive solution, found this cheap wireless doorbell and hacked it to work as a remote trigger:

I've been studying the security aspects of network protocols and decided to take a look on the protocol used by a fun online game called "Among Us". If you don't know it, the game is very similar to the old board game "Clue". Do you remember "The assassin was colonel Mustard, with the candlestick, in the library"?

This is a Python script I made to generate an animated version of the cover image of the classic album "Unknown Pleasures" by Joy Division

This GIF is lousy. Check the video!

In the previous parts of this work I've gained access to the camera operating system and found the main program, "IPC", which controls everything related to video transmission. This part will document my attempts to reverse engineer this software.

In Part 1 of this analysis I started gathering information about this camera, and in Part 2 I found a way to gain root access to its operating system. This part will document the exploration I did using this access

CPU Information

So, the first thing I want to know was what processor this hardware is based on. This can be done by cat /proc/cpuinfo

Trying a terminal connection

In Part 1 we found out that the camera runs over Linux, but there are no SSH port open for a remote shell connection. So I'll try something more hardcore: Let's disassemble the camera

Epilogue

A few days ago I had to replace the old IP camera I use to watch over my dogs and cats, and found out that IP cam technology changed a lot since I bought that old camera. IP cameras are now low-price and ubiquitous. I bought one of those generic models and installed it at my home, expecting to use the same software and network configuration I used before. However, these new cameras do not work the same way. They didn't gave me the same control I had over the old model.