In this paper, we will present the result of our tests, showing several ways to remotely take control over the camera and exploit the following vulnerabilities which include 0-days :. After reading the manual, we used the dedicated mobile application downloaded from the Android Play Store to configure the camera. The network setup, which works without any direct interaction with the camera, is a little tricky behind the scenes.
The prerequisite is to dispose of a WiFi network and a mobile operating system compatible with the vendor application. We were then able to access the camera from our phone, remotely from the Internet, so without being connected to the wireless network, and obsiouly the camera was connected to the Internet cloud infrastructure type. The camera is based on a Goke GK SoC system on a chip that includes multiple computer components such as the CPU, memory and storage, all in one chip.
Moreover, it provides a UART serial interface source. This section presents several vulnerabilities that could lead to a total compromising of the tested camera. Having done the camera installation, we connected it to our wireless network and started to scan the network. After finding the camera IP address, we began to enumerate the services it was exposing with the nmap tool:.
It was surprising to see that the telnet service would not be listening, as it would be the case with most cameras of this type. We wanted to analyze the web application, but credentials were required in order to access it HTTP Basic Authentication :.
We tried admin:admin as set up previously during the configuration, which seemed to work. However, a blank page was returnedβ¦. We then fuzzed the web application using wfuzz tool to find some hidden directories:. A directory listing vulnerability exposed log data with quite a lot of sensitive information authenticated access :. After clearing the cache and cookies in our browser, we tried to log back in the web application, but this time with large identifiers and passwords more than chars :.
