Unpacking CCTV Firmware | Hacker News Reader

Unpacking CCTV Firmware

itsjack.cc

33 pointsmortenlarsen8 comments

His spelunking through the binary shows "uImage" which is the U-Boot[0] header/wrapper for a kernel image. The mkimage[1] utility will show what is in the header and give direct information on how to dissect it.

A very large number of systems that run on architectures other than x86 use U-Boot to boot their embedded OS, typically linux. U-Boot also has extensive command line utilities that can be used to explore the hardware and software. The console is often available as TTL-level signals on an unpopulated connector. A little soldering and USB/TTL-level serial converter[2] results in a console interface.

[0] http://en.wikipedia.org/wiki/Das_U-Boot [1] http://linux.die.net/man/1/mkimage [2] Example: https://www.adafruit.com/products/70

I did something similar for my D-Link router, and unpacked the last 3 versions of its firmware to look for security loopholes. The git history is interesting to look at[0].

[0]: https://github.com/captn3m0/dir-600l

I had one of those cheapo CCTV systems for a store of mine and, wow, how dreadful the software! Has anyone ever written some decent software that one could load up on the generic CCTV systems?

Zoneminder[1] is FOSS and pretty good, it's not pretty but very much gets the job done, and is fairly hackable.

[1] http://www.zoneminder.com/

If you have a Synology NAS, Surveillance Station works quite well.

https://www.synology.com/en-us/surveillance/7.0

Indeed, it's a Java applet that drops a DLL? Horrible. Basically, you need a windows machine with the Java applet installed (isn't this obsolete already?). Say goodbye to any potential security.

Maybe check out Axis, they are a very well established (15 years) provider of cheap web surveillance cameras. They may have slightly better security due to this. I know some of their earlier firmware vulns were called out.

Are you the author? There are so many typos...

Reply on news.ycombinator.com