Hacking the Samsung NX300 "Smart" Camera | Hacker News Reader

Hacking the Samsung NX300 "Smart" Camera

op-co.de

126 pointsge0rg51 comments

Jesus. How do engineers get away with this sort of thing? Why is there such resistance among hardware companies to a philosophy along the lines of "let's develop some simple, no-nonsense, standards-compliant firmware with a straightforward user interface"? Like every single router configuration page - godawful.

There's a hardware platform I've been keen to implement for some time, and to some extent I keep putting it off when I think about how challenging security and a good UX would be. Apparently the bar is lower than I thought.

Because the engineers get a directive to jump to a new platform (like Tizen) and they're handed a barely-working reference platform with a HelloWorld app on it.

Then they're told "oh yeah, this has to be ready by the Christmas selling season, which means you need to lock down firmware by July 1st. And we're demoing it at a trade show in May." And it's already April.

So the engineers comment out printf("Hello World\n"); and start writing a camera. And so on. If they remember to take the other crap out of the Makefile (including the demo pictures of Obama), that's probably because they ran out of space in NOR Flash. Otherwise it stays in. Is there time to run network hidey-hole testing on the WiFi stuff? They're probably happy the thing takes a picture without wiping the SD Card a this point.

It's all bubble-gum and duct tape underneath it all. From your Toyota auto to your Samsung camera to the Smart TV on your wall to the KitchenAid LCD oven in your house.

What's with your comment about the Toyota auto? As I understand there's a hell of a lot more regulation, forcing automobile product time lines to be naturally longer.

He is taking a cheap stab at a budget car manufacturer. Probably owns a Tesla. Or two.

Actually I drive a Toyota. But it's a 1996 model. ;-)

"Toyota’s developers used MISRA-C and the OSEK operating system, both good choices for a safety-critical real-time system. But then they ignored, sidestepped, or circumvented many of the very safety features they are designed to enforce."

"On a cyclomatic-complexity scale, a rating of 10 is considered workable code, with 15 being the upper limit for some exceptional cases. Toyota’s code had dozens upon dozens of functions that rated higher than 50. Tellingly, the throttle-angle sensor function scored more than 100, making it completely and utterly untestable."

http://www.eejournal.com/archives/articles/20131127-toyota/

Michael Barr was the engineer that was able to sit down with the Toyota engine code during the "unintended acceleration" lawsuit and determine what NASA could not: that the code was a wreck:

http://embeddedgurus.com/barr-code/2013/10/an-update-on-toyo...

Like I said. Bubble gum and duct tape.

The regulations only apply to the engine computer (which is probably not changed much in each model year).

There is no strict quality or safety (or aesthetic, for that matter) regulation for the entertainment/climate control system user interfaces.

(In case you've ever wondered: yes, these screens do often show information from the engine computer. For example, the 2nd generation Prius's center console screen shows live information about the hybrid system. But that information is pretty much always obtained from a read-only connection to the CAN bus.)

It's a bad example because "toyotism" is widely considered synonymous with valuing precision[1] and efficiency[2] in production with ever-increasing quality.

It would be less notable, though, if not for the contributions that Toyota brought to the craft, which are basically the same that today's developers apply so pridefully in their work.

[1]: http://en.wikipedia.org/wiki/Lean_manufacturing [2]: http://en.wikipedia.org/wiki/Kanban

Regulation doesn't make software better.

I don't know about Toyota specifically, but I work for a regulated sector, and the end result is that we generate documented and ISO 9001:2000 - compliant duct tape and bubble gum :P .

Have you noticed that ISO9000:2000 is a lot more relaxed than ISO9000 was in the 1990s? You have to wonder if so many projects were failing that they eventually decided to move the goalposts closer.

I never got to see the older ISO standard :) (I entered the workforce in 2002) so I'll take you at your word.

It does seem to be not that hard to attain a certification.

Nothing is a panacea. Regulation can encourage better engineering practices, and that can certainly make for better software.

The existence of false positives doesn't mean the whole exercise is pointless.

I agree that regulation might point you in the right direction, but if the company is not commited to quality, I think it's very hard (and unlikely) for regulation to make the company change its bad habits. What I've seen is regulation stifling change, freezing projects, and creating more bureaucracy.

In the particular company I work for (financial sector), there has been an increase in regulation and auditing of security practices. They're still really bad, you've seen endless posts here decrying the awfulness of some banking security practices. The worst thing is, they've probably been audited and made to pass some kind of regulatory standard, and the very fact they had to go through all that makes it harder to change (even if they're awful) since managament isn't willing to authorize it, especially since it doesn't affect the bottom line.

If more people have to resign (like the Target CEO), maybe things will change, but I suspect IT people will become scapegoats instead.

Agree that you have to actually be committed to improving the quality, you can't paper over holes in this and expect good results. If there is genuine disinterest at the management level in making better quality software for whatever reasons, you're probably screwed regardless of what you try.

You can lead a horse to water...

Probably talking about the in car infotainment system.

People don't care how the sausage is made.

It's not about how it's made. It's about the final product.

That is until some expert comes and informs them that it is actually made 90% pork 10% rat.

And soylent green is ... nevermind the taste is amazing

Because the average user and the vast majority of users can't use your straightforward and easy UI without explicit instructions because they don't understand any of it.

If they're not going to use it or understand it, why spend time on it?

The model is moving to ISP-controlled network hardware anyway.

All new Comcast modems are remotely manageable by Comcast and they enable features that customers have to call Comcast to disable, as Comcast has better access to the modem firmware than the end user.

It's actually irrelevant who uses the interface - the end user or ISP employee acting on users demand. Such change of the party in charge neither adds any usability to user interface (just the side who has to struggles with it), nor it increases security and reliability.

I actually believe that you're using false equivalence to pretend that both paradigms are the same. I disagree that they are, and I believe that you've made a lot of assumptions to declare my point "irrelevant", the biggest of which being that the software is identical and the only difference is who accesses it. That's a falsehood, and I'm going to reject the rest of your point because I disagree with those assumptions.

FYI, the request to http://gld.samsungosp.com is probably to attempt to detect wireless networks which require login.

iOS does something similar - http://blog.erratasec.com/2010/09/apples-secret-wispr-reques...

I understand the accept-language based on the company that created the device, but why would the accept reference shockwave and excel documents? That seems a little odd and not a simple library default.

The security flaws are bad, like not write locking the tag.

Still, lots of fun stuff for a developer user there, though. It runs a full X server, so technically some Linux people might consider it even more capable than Android.

Supporting a shared amongst manufacturers format like DLNA is cool too. Maybe a different brand smartphone could work with it more easily then, for example.

Plug in a few things and you'd be able to make a phone call from your camera and have it run Breakout or something

If you're interested in more camera hacking, here is a very interesting talk from last years black hat about hacking security cameras.

Title: Black Hat USA 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker https://www.youtube.com/watch?v=LaI0xjeefpg

I bought this camera several months ago and I just want to chime in and say it's takes some AMAZING pictures. For all of the complaints about how bad Samsung's software is, its UI is a lot more intuitive than what I've come to expect from most cameras. The vulnerabilities they mention seem akin to what you get from connecting most printers to your network.

My goal was not to criticize their UX (which I do nevertheless, triggering "advanced" features like HDR takes some amount of clicking), but to point out things that still need to be improved. Modern interconnected devices need to adhere to a new security standard, or they will be turned into bugs against their owners.

I'm shocked, shocked that there is shitty software running in this Samsung establishment. When I saw the title, I had a strong suspicion that it wasn't about making the camera do cool things, but the subject would be "how broken is Samsung's firmware?"

What is it with Samsung and software? I mean, they can crank out some decent hardware, but their software is consistently abysmal. I have a Note 3. Ignore the plasticy and cheesy (fake leather stitching? Really?) exterior, and it's a decent piece of kit. But the included software is consistently crap. I bought the Note for the stylus, but both S Note and Action Memo apps that are to be used with the stylus consistently lost data. I think they fixed it in a later update (haven't lost data lately), but it doesn't inspire confidence.

The prime example is Samsung's new Gear Fit. It just plain doesn't work as advertised, and it's due to unbelievably broken software. The only things that work reliably are the notifications and the pedometer. And though the pedometer works (if a bit inaccurately) the data reporting is broken. I mean so broken that if you want a historical listing of your steps each day, you'll have to write it down because the data reporting is grossly inaccurate. Everything else, including most exercise functionality, just doesn't work. I thought it would be fun (and please pardon the shameless plug) to see if I can post a new bug every day: http://gearfitbugs.tumblr.com (been slacking the last few days for lack of time).

Point is, how do they stay in business? Who buys one Samsung product and then turns around later to buy another one (okay, me, I guess)? For me, they don't get three strikes. Two hardware products with amateur-level software (with apologies to all amateur developers out there; your stuff is likely better than Samsung's) are the only chances Samsung will get with me. And if they think I'm letting one of their Internet-connected TVs (with mic and camera) in my house, they're delusional.

The Gear Fit brought to mind another question that I'll likely never get an answer to: how does this happen? Fine, you made some really bad dev hires. But don't you have a test team? Does the test team suck, or are they just ignored? What about project management? When the test team comes back and says, "the cycling function doesn't work. It will never record a whole workout without stopping mid-way.", does PM just say "ship it anyway"? Come ship date, you just take whatever is sitting at HEAD no matter what shape it's in, build it and call it the RTM build? I would seriously pay a week's wages to spend a week with their product team to get a look from the inside on how not to build software.

> Come ship date, you just take whatever is sitting at HEAD no matter what shape it's in, build it and call it the RTM build?

You nailed it, as if you saw it with your own eyes. Kudos.

nah, head changelist usually doesn't build

Yup. In the course of development, head changelist builds about 50% of the time. As deadline approaches, this probability slowly increases, but never gets to 100%.

I just don't think that many people really care. I buy Samsung products and they generally work. I've had 2 Samsung TVs and I'm still using the discontinued Galaxy Player[1]. Samsung is my go-to brand because while their software isn't perfect, they sometimes have a quirkiness about them that makes 'em unique.

I think having a camera with X server running on it is cool. I have no idea what I'd do with it but cool nonetheless.

>> Come ship date, you just take whatever is sitting at HEAD no matter what shape it's in, build it and call it the RTM build?

"Pixar films don't get finished, they just get released." --- http://www.lettersofnote.com/2010/06/pixar-films-dont-get-fi...

1. http://www.samsung.com/ca/consumer/tv-video/media-players/me... ...why not just get a smartphone? Because whatever, that's why.

I wish they still made the galaxy player. I'd love to have an android device that was a smartphone in all senses except for the phone.

Samsung at it's size is probably a business where the businessman/manager is #1 and they have an attitude where if they can cut corners to make deadlines, impress their bosses and get those bonuses, then they don't give a shit if it's ductape inside. Samsung is also a Korean company, so the high level software decisions are done in Korea. Looking at Korea's software in general, they have a different set of priorties than the typical american software culture.

It's very likely management attitudes that prevent decent software engineering. Every project has to tied to a near term business feature and strategic long term design and goals is determined by business people who probably never programmed in their life. Engineers probably can never push for large refactoring projects and proper long term design that will allow the company to deliver projects faster in the long term since the short term is what matters. They have to trojan horse them as performance improvement projects or similar.

tldr: Improper internal incentives

I don't find it surprising that a giant heavy industry and consumer electronics conglomerate doesn't get software testing right. Software quality is extremely difficult to get right, and an electronic product company doesn't have an understanding of it built into their brain wiring. How do you test a hardware product? You put it in an oven, then in a freezer, then spray it with water, tumble it in a dusty drum, drop it onto concrete, put a heavy weight on it, blast it with some radio frequency interference for good measure, mash its buttons a million times, then do some accelerated aging (some combination of the above for a few weeks) - and if it keeps working through it all, you have a good, reliable product. There is no equivalent for software. There is also EE snobism running through organizations like that, which basically assumes that software doesn't take real effort and can be shoehorned into any schedule.

And to be fair to Samsung, even software companies which should know better have gotten software quality spectacularly wrong on occasion.

One more thing (just so that I don't get accused of hating Samsung): sometimes, they get things right, also, at least from my perspective. I may be in the minority, but I enjoy their TouchWiz and prefer it to generic Android.

I jumped on the "I hatez da Touchwizs" bandwagon shortly after acquiring the Note. I loaded an alternative launcher that gave it that stock Android look and functionality. Two days later I went back to Touchwiz. For all my general hate of Samsung software, I've got to say that Touchwiz seems to get a lot of things right.

the note is tough. in my experiences with a note 2, when touchwiz left most of the decent pen features went with it. stock android doesn't give a good experience with the pen yet; or at least it didn't when I was playing with the ROMs.

Another example: d-link. Holy crap does their router firmware suck. Some of the stuff I saw in that thing ... never again.

> I'm shocked, shocked that there is shitty software running in this Samsung establishment.

haha. As someone with some knowledge of Korea, I can add a few pointers. Of course it should NOT be used to paint a broad black/white picture of S Korea or even the state of IT companies in S Korea, but let me try. Please note this is just a personal view.

First, Samsung and other S Korean companies know their weakness is software. They started providing more funding for software majors and Samsung even started a program where they will sponsor (pay salary, provide office space) high school graduates (but not in college yet) to study coding and put out projects over a period of a years (?) all in order to have more more talent get into software.

So WHY this seemingly lack of talent/interest in software building in S Korea's mega corporations? Surely with companies such as Hyundai Motors and Hyundai Shipyards and Samsung memory chips, it shouldn't be that hard to find good software engineers and coders?

I was told one reason is software piracy. It's gotten much better but in the past software piracy was a big issue in SK. I've used/seen many softwares in the past but the only one that ever required a physical dongle for licensing was a Korean Word processor. I had to support it a bit many many years ago. That was the only one with physical dongle for licensing that I've come across. Why the piracy? Well because people didn't have money (or thought didn't have enough money to spend on some intangible thing that requires a fee based upgrade in just a 1 or so). There's a reason linux/opensource is strong in some countries. Some just don't have the money to spend on software.

So due to piracy, a generation of students came to think that software was not a secure career path. Why get into a career to work to build something that can be easily copied at little cost?

Another reason I see is English. Again, it's gotten better with the obscene amount of money the nation as a whole spends on learning English and now other languages. But learning English for S Koreans used to be pretty intimidating. Sure source code is nonsensical alphabets to even native English speakers. Imagine someone learning English for first time starting in middle school with a dozen other subjets to learn. No wonder it was hard to find decent English speaker/writer in S Korea for decades. If you were decent at English, you had other far more prestigous/lucrative career path for you.

One possible reason that the seemingly big/stable corporations in S Korea don't seem to attract good coders is requirement for degree from top school. Getting into good college in S Korea is hard enough. Well, getting into one of the big corporations like Hyundai/Samsung is even more competitive. And we all know the really outstanding programmer/coder/startupers usually didn't have a degree when they started out in programming/IT. Like Jobs, Gates, etc.

That's my 2 cents.

So due to piracy, a generation of students came to think that software was not a secure career path. Why get into a career to work to build something that can be easily copied at little cost?

Wow, this is really interesting - in Russia, piracy was as prevalent, but my gut feeling is that Russian software is far superior to their hardware.

I think that's a function of their strong focus on mathematics and engineering education during the Soviet era (and then CS departments grew as an offshoot of that, I bet).

are they selling Russian software to Russians? if not, beside strong education in the soviet times, it's probably a very good career to sell software to the westerners.

> There's a reason linux/opensource is strong in some countries. Some just don't have the money to spend on software.

I always saw it as an inverse relationship. Once everything is pirated (Windows OS, utilities, games, Photoshop, business software) there is no incentive to adopt open source. Just keep pirating.

I don't think it's piracy that discourages Koreans from seeking a software career. Who's going to pirate the firmware of a smart camera, anyway? Rather, it's the way the culture and industry treats software developers that makes Koreans shudder at the thought of becoming a programmer.

The rapid industrialization of Korea over the last 50 years put a heavy emphasis on hardware: first it was clothes and shoes, then it was cars and TV, and now the focus is on memory chips and displays. Hardware is visible, tangible, easily quantifiable. "We shipped 10 million phones this month!"

But a culture that is obsessed with hardware will often have difficulty appreciating the value of software. Even nowadays, salaries for software developers are often calculated in the same way they calculate the wages for manual laborers [1], and the hourly rate is only around 2x of what manual laborers earn ($200/day vs. $90/day on average). Software is seen as something you do by throwing a bunch of man-hours at it. After all, that's how you've been doing hardware all along.

The same thing seems to happen in Japan, though to a somewhat lesser extent. Sony, for example, isn't exactly known for their world-class software, are they?

[1] Recommended daily wages for various skill levels, as of 2012: http://www.kdb.or.kr/info/info_01_07.php?mode=detail&dbnum=2...

> Sony, for example, isn't exactly known for their world-class software, are they?

Sony contracts out a lot of their software needs, and some of it out of Japan so that's probably not a good example to pick.

I think it's a fine example because practically all Sony software sucks, and whether they wrote it or not, it sucks because the company doesn't understand or value software.

I share the same feeling towards my LG G2. The reason I bought it is because it was the android phone with the longest battery life. And how bad could the software be?

While there are haters of the "pure android experience", I like it, because it is quite stable. What I cannot imagine is someone in LG/Samsung saying "We can do better android". Forget design, testing etc. How can the lack of design, tech understanding/expertise in the team go along with ambitious projects like this?

More importantly, If I were building a product that fits the above description, how would I know?

I don't know... I kind of like it that it is as hackable as it is. Worst thing imho is the permanent write-lock problem and that it should be secured in a way that lets the user hack it but keep the baddies out.

I don't think a digital camera needs to be running a pretty full-featured Linux distro with X11 and all, nor phone home with your location, nor have several hundred MB of firmware. These "smart" devices are way too smart for their own good.

Reply on news.ycombinator.com