1 00:00:00,000 --> 00:00:11,460 Our next talk will be on Hacking Your New Web Camera by Aaron Standridge, Distinguished Engineer, and Aaron Rosenberg, Head of Technology, Logitech. 2 00:00:14,620 --> 00:00:18,680 Good morning. My name is Aaron Rosenberg. I'm Head of Engineering for the Logitech Circle Group. 3 00:00:18,820 --> 00:00:25,960 I'm going to talk today about how to hack an insecure Wi-Fi camera and why we wait for the presentation to come up. 4 00:00:31,560 --> 00:00:34,460 So, I'm going to talk about a couple different things today, this morning. 5 00:00:34,840 --> 00:00:41,180 First, what are Wi-Fi cameras? How we can do some basic hacking and accessing of the Wi-Fi cameras? 6 00:00:41,400 --> 00:00:47,080 And then finally, a little bit, that's why I'm here, what makes our products a little bit more secure than everybody else? 7 00:00:48,500 --> 00:00:50,260 So, what is a Wi-Fi camera for everybody? 8 00:00:50,520 --> 00:00:55,400 For those who don't know, they're probably one of the most personal electronics that you may have in your home. 9 00:00:55,520 --> 00:00:59,320 They are both literally a camera. They have microphones. They have speakers. 10 00:00:59,320 --> 00:01:05,380 They have image sensors. And you'll put them in probably some of your most personal spaces inside of your house. 11 00:01:05,720 --> 00:01:08,960 People put them in garages. They put them in living rooms. They put them in bedrooms. 12 00:01:09,260 --> 00:01:15,160 They put them in kitchens. They put them in patios. They put them in far more interesting places than your phones will. 13 00:01:15,360 --> 00:01:20,020 If you think about where you might have your phone at home, it's oftentimes in your pocket. Maybe it's sitting beside a bed. 14 00:01:20,200 --> 00:01:28,500 But on a Wi-Fi camera or a home security system, that camera is almost always pointing at something that is interesting and other people, not just yourself, will want to see. 15 00:01:29,320 --> 00:01:33,400 From a technology perspective, almost all the cameras on the marketplace are Linux. 16 00:01:33,620 --> 00:01:38,460 They're tiny little Linux computers. Most of the time, they're about the same as your phone. 17 00:01:38,640 --> 00:01:43,740 They've got processors. They've got hardware. They've got image sensors. They've got microphones. 18 00:01:43,860 --> 00:01:50,600 What sets them apart, usually from your regular phone, is they've got much nicer quality image sensors, much nicer quality optics. 19 00:01:50,900 --> 00:01:59,300 The lenses in these cameras are on par with or better than your DSLR equipment for the size that they do and the image quality that they can produce. 20 00:01:59,320 --> 00:02:02,180 They will also have night vision. 21 00:02:02,500 --> 00:02:06,900 This can be combined with infrared emitters and infrared sensors. 22 00:02:07,400 --> 00:02:15,300 Oftentimes, they'll also have little mechanical infrared cut filters inside of it so that we can produce a high-quality image both daytime and in nighttime. 23 00:02:15,780 --> 00:02:23,380 And finally, the most important thing and why they are hackable and interesting for hackable targets is almost always they're connected to the Internet. 24 00:02:23,620 --> 00:02:27,880 They usually are connected to your local LAN at home or business connections. 25 00:02:28,000 --> 00:02:29,300 And most generally, they're not. 26 00:02:29,320 --> 00:02:32,680 Most of the applications of these cameras now are cloud-based or pseudo-cloud-based. 27 00:02:34,660 --> 00:02:37,040 What's the first step in how we can get access to it? 28 00:02:37,180 --> 00:02:38,300 Let's find the IP address. 29 00:02:39,160 --> 00:02:44,100 First and easiest technique is open up a terminal on your system and let's use a broadcast ping. 30 00:02:44,300 --> 00:02:49,860 This will automatically find any devices that are open and answering ping bases on your system. 31 00:02:50,200 --> 00:02:56,000 Start with, in this example, and it may be a little bit hard to read, but we're looking for a... 32 00:02:56,660 --> 00:02:58,780 If you know your internal IP address at home, 33 00:02:59,320 --> 00:03:05,260 place the last digit with a zero, do a ping to that, and you'll usually get a couple of devices that are on your network automatically responding. 34 00:03:05,500 --> 00:03:07,640 This is one way to get an IP address. 35 00:03:09,600 --> 00:03:14,240 Second step, a number of cameras on the market support a standard called ONVIF. 36 00:03:14,440 --> 00:03:16,660 This is an industry standard consortium. 37 00:03:17,040 --> 00:03:25,460 There are regular free software programs out there called ONVIF browsers that will do local LAN discovery and can find IP addresses for you. 38 00:03:27,540 --> 00:03:32,780 There are also a whole set of cameras that support auto-discovery through NDNS or Bonjour. 39 00:03:33,200 --> 00:03:39,160 You can pull any free Bonjour browser and use that to look for an IP address. 40 00:03:39,400 --> 00:03:43,500 You'll find lots of systems on your network when you do a Bonjour scan. 41 00:03:43,680 --> 00:03:48,880 These are things like Apple computers, phones, TiVos, cable TV boxes. 42 00:03:49,380 --> 00:03:53,620 Most anything these days will support both auto-discovery through Bonjour. 43 00:03:55,460 --> 00:03:59,740 And lastly, if you still don't find your camera on the system and you have access to it, 44 00:03:59,780 --> 00:04:01,700 you can always log into your router's web interface. 45 00:04:02,020 --> 00:04:11,380 This will pull the DHCP client tables and is usually the last resort way to find the IP address of a device that's been auto-set up. 46 00:04:15,320 --> 00:04:20,500 First step that I like to do is take the IP address that you've discovered and plug it straight into a web browser. 47 00:04:21,680 --> 00:04:23,340 If we get the screen that shows up here, 48 00:04:23,480 --> 00:04:25,220 this means that the camera, 49 00:04:25,980 --> 00:04:27,380 whichever device it may be, 50 00:04:27,560 --> 00:04:29,220 is not running a local web server. 51 00:04:29,920 --> 00:04:31,680 Nothing on by default on port 80. 52 00:04:33,100 --> 00:04:35,460 So let's try one of the other IP addresses that we found. 53 00:04:35,780 --> 00:04:38,440 So this device is running a web server. 54 00:04:38,540 --> 00:04:40,720 Something comes up in Chrome when I plug its address in. 55 00:04:40,820 --> 00:04:43,600 In this case, I found my LaserJet printer at home. 56 00:04:44,520 --> 00:04:45,640 Not really what I want. 57 00:04:45,700 --> 00:04:47,540 That's a talk for another day on how to hack printers. 58 00:04:49,560 --> 00:04:53,000 Lastly, so I found one of the other addresses that I found via auto-discovery. 59 00:04:53,220 --> 00:04:55,440 It was 192.168.1.80. 60 00:04:55,460 --> 00:04:57,300 I pull up its web page address 61 00:04:57,300 --> 00:05:01,200 and suddenly I have what looks like the web login for a security camera. 62 00:05:04,280 --> 00:05:07,820 If you want to go move beyond standard port 80, standard HTTP, 63 00:05:08,800 --> 00:05:11,260 one of the best tools out there is called Netcat. 64 00:05:11,820 --> 00:05:14,380 Netcat is an automated Unix tool 65 00:05:14,380 --> 00:05:18,600 that will allow you to port scan programmatically any device on your network. 66 00:05:18,760 --> 00:05:20,620 You can either scan your entire home network 67 00:05:20,620 --> 00:05:22,440 or if you know the IP address, 68 00:05:22,700 --> 00:05:24,660 you can just scan a singleton one on this. 69 00:05:24,660 --> 00:05:29,740 So in this case, I probed the ports on 192.168.1.80, 70 00:05:29,840 --> 00:05:33,000 which was the IP address that showed up that web address like my camera, 71 00:05:33,100 --> 00:05:34,440 and I found two open things. 72 00:05:34,680 --> 00:05:37,780 The first is the HTTP. 73 00:05:38,060 --> 00:05:40,620 That was running the web server on port 80. 74 00:05:40,780 --> 00:05:43,260 And the second was port 554, 75 00:05:43,440 --> 00:05:48,880 which Netcat will tell me is the protocol port for a protocol called RTSP. 76 00:05:49,340 --> 00:05:51,620 RTSP stands for Real Time Streaming Protocol 77 00:05:51,620 --> 00:05:54,240 and is another industry standard 78 00:05:54,240 --> 00:05:55,060 for how to operate. 79 00:05:57,360 --> 00:06:00,040 Other cameras, some that are even less secure, 80 00:06:00,260 --> 00:06:03,060 will also be responding on ports 21 and 22. 81 00:06:03,400 --> 00:06:06,460 You can try telnetting into them or SSH-ing into them. 82 00:06:08,880 --> 00:06:12,920 Most of the common ports that you'll find for Wi-Fi cameras are on this list. 83 00:06:13,260 --> 00:06:14,920 One other thing to note is 84 00:06:14,920 --> 00:06:17,600 cameras that use dynamically assigned systems 85 00:06:18,030 --> 00:06:19,920 will advertise themselves via Bonjour 86 00:06:19,920 --> 00:06:22,760 and will use Bonjour dynamic records. 87 00:06:24,240 --> 00:06:26,220 Modern cameras that are supporting Apple's HomeKit protocol 88 00:06:26,220 --> 00:06:28,400 will have both a HAP TCP record 89 00:06:28,400 --> 00:06:31,760 and the controlling computers will have a HomeKit TCP record. 90 00:06:32,020 --> 00:06:34,700 You can usually then find the ports in there if you look 91 00:06:39,180 --> 00:06:40,700 inside of the dynamic area. 92 00:06:41,300 --> 00:06:45,800 And you can probe those directly with other tools as well. 93 00:06:47,100 --> 00:06:49,460 So now that you know which port it's listening on 94 00:06:49,460 --> 00:06:51,220 and which IP address you go, 95 00:06:51,340 --> 00:06:53,500 now we get to the fun and the interesting parts, 96 00:06:53,500 --> 00:06:57,040 which is we can start probing all the RTSP endpoints 97 00:06:57,040 --> 00:06:57,860 that a camera has. 98 00:06:58,060 --> 00:07:03,600 Now every manufacturer puts their RTSP 99 00:07:03,600 --> 00:07:06,260 usually on a slightly different URL in this system. 100 00:07:06,380 --> 00:07:09,740 What I've pulled here is the top five URLs on here 101 00:07:09,740 --> 00:07:12,880 and you then have a fully formed RTSP URL 102 00:07:12,880 --> 00:07:14,200 that you can then probe. 103 00:07:15,060 --> 00:07:18,640 Usually what you'll need to do is plug this into a piece of software 104 00:07:18,640 --> 00:07:22,320 that's capable of investigating and pulling up RTSP streams. 105 00:07:22,320 --> 00:07:25,200 VLC is a great open source piece of software. 106 00:07:25,440 --> 00:07:29,820 No charge, multi-protocol, RTSP support fully inside of it. 107 00:07:30,960 --> 00:07:33,120 So how do you know what those URLs should be? 108 00:07:33,460 --> 00:07:34,840 The internet has helped us. 109 00:07:34,980 --> 00:07:36,640 There's a company called Solartech, 110 00:07:37,080 --> 00:07:39,720 which has maintained a massive library 111 00:07:40,120 --> 00:07:42,260 of pretty much every camera ever manufactured. 112 00:07:42,960 --> 00:07:45,060 You can look by manufacturer's model 113 00:07:45,060 --> 00:07:50,300 and find out what the sub-piece of the RTSP URI that they support. 114 00:07:50,660 --> 00:07:51,960 So now that we have, 115 00:07:52,320 --> 00:07:53,060 an IP address, 116 00:07:53,300 --> 00:07:55,780 we have a path that we can go at it, 117 00:07:56,340 --> 00:07:58,620 we can start trying to actually experiment with it. 118 00:07:59,900 --> 00:08:03,020 Some cameras will stop us at this point 119 00:08:03,020 --> 00:08:04,040 because they'll want authentication. 120 00:08:04,640 --> 00:08:05,980 Most cameras won't, 121 00:08:06,120 --> 00:08:08,460 but even the cameras that do stop us, 122 00:08:08,620 --> 00:08:10,860 it's usually not that hard to get through. 123 00:08:11,840 --> 00:08:14,920 Most of these cameras have default usernames and passwords. 124 00:08:15,260 --> 00:08:18,560 The top six most common are on that list right there. 125 00:08:18,760 --> 00:08:21,240 Yes, admin, admin, admin password 126 00:08:21,240 --> 00:08:24,160 will get you in to most any camera by default 127 00:08:24,160 --> 00:08:26,660 unless you've gone and changed it. 128 00:08:26,840 --> 00:08:31,180 And most of these lower, earlier generation Wi-Fi cameras 129 00:08:31,180 --> 00:08:33,200 do not make you change the passwords 130 00:08:33,200 --> 00:08:35,220 and the usernames from the defaults. 131 00:08:36,800 --> 00:08:38,600 So now we're in business. 132 00:08:38,880 --> 00:08:44,100 So we plugged in one of the fully working RTSP URIs into VLC, 133 00:08:44,260 --> 00:08:47,640 and we pulled up my colleague Aaron's garage. 134 00:08:49,260 --> 00:08:52,280 So I generated this image about three days ago, 135 00:08:52,740 --> 00:08:54,840 and it's a fully working video URL. 136 00:08:55,000 --> 00:08:56,800 You can watch it, you can see it, 137 00:08:56,880 --> 00:08:58,000 you can interact with it. 138 00:09:01,240 --> 00:09:03,340 Now, one of the things that you'll notice is, 139 00:09:03,460 --> 00:09:07,380 even if cameras did put any forms of authentication, 140 00:09:07,860 --> 00:09:10,820 most of these are still going to be found on the open Internet. 141 00:09:11,000 --> 00:09:13,460 And this is where we get into how dangerous 142 00:09:13,460 --> 00:09:16,460 some of these devices, if they're not properly secure, can be. 143 00:09:16,460 --> 00:09:18,860 For those who don't know, Shodan is a tool 144 00:09:19,260 --> 00:09:22,600 for scanning embedded devices on the Internet. 145 00:09:22,920 --> 00:09:26,580 So what I've done here is plugged RTSP into the Shodan tool, 146 00:09:26,740 --> 00:09:28,540 and the picture may be a little small, 147 00:09:28,740 --> 00:09:31,360 but there are about 3.8 million devices 148 00:09:31,360 --> 00:09:35,000 that were found on the Internet that are responding on RTSP. 149 00:09:35,160 --> 00:09:39,140 That's a huge potential pool of systems that can be operated. 150 00:09:39,740 --> 00:09:42,660 These systems were actually what were exploited 151 00:09:42,660 --> 00:09:44,160 in the recent Mirai botnets, 152 00:09:44,300 --> 00:09:46,440 where using a list of RTSP, 153 00:09:46,440 --> 00:09:49,780 automated the default usernames and passwords, 154 00:09:50,340 --> 00:09:53,040 somebody built a worm which would connect to a camera, 155 00:09:53,240 --> 00:09:55,800 log in, self-propagate, 156 00:09:55,880 --> 00:09:57,580 and then turn that into a DDoS platform. 157 00:09:58,940 --> 00:10:01,080 So if you do play with a web camera, 158 00:10:01,180 --> 00:10:02,420 and especially Wi-Fi cameras, 159 00:10:02,540 --> 00:10:03,800 don't put them on the raw Internet, 160 00:10:04,060 --> 00:10:06,200 unless you know that they're locked down and secure. 161 00:10:06,780 --> 00:10:10,180 These are people who probably didn't know that they've done this. 162 00:10:10,280 --> 00:10:13,140 Remember that any IP address that you find from Shodan 163 00:10:13,140 --> 00:10:15,600 is from somebody else's device, and to be careful. 164 00:10:16,440 --> 00:10:16,900 Follow the creed. 165 00:10:18,660 --> 00:10:21,200 So my last little advertisement slide since we're here. 166 00:10:21,920 --> 00:10:24,920 So what makes Logitech secure and why are we in this business? 167 00:10:25,720 --> 00:10:28,240 All of our cameras are highly secured, locked down. 168 00:10:28,720 --> 00:10:33,160 If you scan us, if you search for us in any of the search engines, 169 00:10:33,260 --> 00:10:35,100 we don't run any open ports. 170 00:10:35,340 --> 00:10:37,560 We are a pure client-server model. 171 00:10:38,080 --> 00:10:39,900 We do everything fully encrypted. 172 00:10:40,360 --> 00:10:44,440 All of our encryption is AES-128-256 or better. 173 00:10:44,560 --> 00:10:46,080 Full perfect forward secrecy. 174 00:10:46,440 --> 00:10:48,600 All of our systems in our cloud-based cameras 175 00:10:48,600 --> 00:10:50,420 are used full data encryption at rest. 176 00:10:50,860 --> 00:10:54,580 We've designed the system so that even us, 177 00:10:54,640 --> 00:10:56,240 the Logitech employees, 178 00:10:56,500 --> 00:10:57,800 we don't have access to your video feeds. 179 00:10:57,960 --> 00:11:00,240 I, as the head of the engineering department, 180 00:11:00,540 --> 00:11:02,600 as the super admin in the systems, 181 00:11:02,740 --> 00:11:04,760 I can't access anybody's encrypted content. 182 00:11:05,020 --> 00:11:06,840 It's all blind encrypted. 183 00:11:07,020 --> 00:11:09,380 There are multiple layers of encryption algorithms and keys 184 00:11:09,380 --> 00:11:12,720 that are all protected by your account credentials. 185 00:11:13,480 --> 00:11:15,740 We also do full Bluetooth secure setup. 186 00:11:15,740 --> 00:11:19,860 We do full unique RSA keys in every single camera that we produce. 187 00:11:21,640 --> 00:11:22,680 Thank you, guys. 188 00:11:22,860 --> 00:11:23,760 Any questions? 189 00:11:24,020 --> 00:11:25,880 We're going to be running a workstation 190 00:11:25,880 --> 00:11:28,360 where you can play with some of the Wi-Fi cameras. 191 00:11:28,560 --> 00:11:31,020 We'll also be giving away a free web camera, 192 00:11:31,200 --> 00:11:32,700 one of our HD web cameras, 193 00:11:32,800 --> 00:11:33,760 for anybody who shows up. 194 00:11:33,920 --> 00:11:34,500 Thank you.