Rick's b.log - 2017/01/21
It is the 21st of November 2024 You are 3.146.178.81, pleased to meet you!

Camera scanning

The first task is to search for anything interesting in the DDNS range. The "xxx" part is a number. I presume from 000 to 999. The "yyyy" part are lowercase letters. I presume from "aaaa" to "zzzz". So I looked for 000aaaa, then 000aaab, 000aaac, you get the idea.

For this, I simply iterate the address space, passing the request to wget, throwing away the fetched result (if anything) and looking at what the header status says. The status will be one of two things. It will be 200 OK if the response is to say "OFFLINE", or it will be 302 Found if the response is a redirection; in which case the headers will also contain a "Location:" line that points to the IP address of the camera.

The command to do all of this is:

wget -PNull: -q -S -T 5 --max-redirect=0 <address> { > RAM:$.wgetlog }

From there, it is pretty easy to extract the IP addresses provided and build a page that lists them. I left mine running and I collected some three thousand odd links. I cheated slightly here as I was not seeing anything at all on 000xxxx addresses, so I noticed that my camera uses an 0005xxxx address, so I decided to try that and sure enough the links poured in. I left it running for about eight hours and scanned from 005aaaa to 005apgo.
Now the interesting thing is that I looked at the first sixty or so entries using port 80, on the basis that somebody who changed the port is going to be smart enough to also change the password, and I noticed that there was a lot of rubbish that was not an IP camera. I spotted a DVR login, a couple of IIS logins. But most of the links were dead. I looked up my own camera's DDNS and it was still listed using the bogus IP address. I wonder what determines when and if the server reports OFFLINE? Maybe that is reserved for DDNS entries that have never been set?

The nwsvr1.com address resolves to be 54.247.103.91 which is an Amazon AWS service, specifically ec2-54-247-103-91.eu-west-1.compute.amazonaws.com which is in Dublin.

I found one camera, when gave itself a way by being called "ipcamera_xxxxxxxxxx" where the x was the device MAC address, which was in the block assigned to Shenzhen Smarteye Digital Electronics Co., the same group that make pretty much all of these cheap cameras. The user, based in Germany according to the IP address, had changed the password away from the default (I tried several). So, one camera found and it is secured with a non-default password. That's good to see. Additionally, there is no telnet access to the device. Even better.

I've dumped my scan results here if you're interested (166KiB).

I could probably automate a further scan to see if anything responds, and keep only the IP addresses with something present, but to be honest it's a lot of bother for not a lot of payoff. I would imagine my chance of hitting an unsecured device (that hasn't already been hijacked by Mirai) when running a small scale scan from my Pi are about equal to my winning the EuroMillions jackpot. This was more a proof of concept, and I did create a DDNS list and I did find a camera on port 80. So, concept validated. I'll now shuffle off and do something else with my time, like watch DVDs. ☺

Glee!

Your comments:

No comments yet...