So, today I would like to talk about converting all some cameras giving them new life and
using them to post your pictures right to master them or maybe also other media.
So what do we have?
We have different cameras like this one or maybe even professional ones like this and we
would like to use the simple USB as he don't know to send photos from the camera
to master them.
In the last 15 years Samsung has created a wide range of different camera models.
So I have to example here but there were over 30 different models with built-in Wi-Fi
modules and starting from compact ones and up to rather professional high end cameras
which are still usable today and competitive for a secure and market situation.
The camera series by Samsung was officially discontinued in 2015 and the camera was
still available on the use market starting from 30 euros for smaller ones and going
to 300 euros and more for the professional models.
And given that they have a Wi-Fi module, I was interested to see how we can bring them
back to life.
Here's an example from a camera menu so you can use a vast number of proprietary services
to upload your pictures right from the camera.
This was provided by a Samsung hosted central API service that got discontinued in 2021
very unfortunately and the service was handling authentication forwarding of the pictures
to the respective social network and the supported model or the different models supported
different social services and they're usable for example for email and Facebook
is almost on every model but other models only support a smaller Samsung.
And my guess is that this was implemented through a Samsung API and not directly connecting
to the Facebook and other services from the camera because the API changed often in this
way Samsung didn't have to roll out new firmware versions whenever one of the upstream
API said to change.
Now how does it work normally?
The camera is connecting to a local Wi-Fi network or to a hotspot then it is establishing
a connection to the Samsung Cloud API locks in, uploads pictures and then it is done essentially.
Unfortunately due to the fact that the services were shut down in 2021, we don't have
this channel anymore and for we also cannot see what kind of response is expected from
this API service.
However what we can do is a hotspot or Wi-Fi network level to redirect this to our own
implementation.
Now the only thing we need to figure out is what kind of response format do the cameras
expect.
And I have done this based for two different model ranges.
One of them is an X300, 500 and an X1 which are actually Linux computers with a camera
module and it is rather easy to get root access on the Linux system however the camera itself
is run through a large blob binary with almost no debug symbols and other way so you can
access the operating system but you cannot access the camera itself in a meaningful way.
You can just inject key commands and see what kind of system calls it is running but not
do very much actually.
And based on reverse engineering the communication pattern I figured out there are two different
APIs.
One of them is for sending emails.
This is essentially just a standard HTTP post request that is sent by the camera to
a server run by Samsung and it contains an XML file with a metadata like from which address
to which address what kind of body text and image or images.
As a camera just expects an HTTP okay and this is rather easy to implement and has been
done in 2022 by me and has been working since.
However the social media API is slightly different so the camera is also doing an HTTP
request but it is quite a number of different encrypted payloads in it and following those
up was quite a challenge because username and password are encrypted with a session
key.
The session key is actually encrypted using RSA however it is generated using a function called
secure random which is just calling system run function in July to this time so essentially
it is just the current number of seconds at the clock converted into a fancy format.
And then the result is from a way and replaced by 40 bytes from the call stack.
This was an interesting adventure but it turned out that it was completely unnecessary
because the same XML message also contains the session key uninterrupted well it was yeah
really interesting and it also helped me understand the response format and to implement
it so this is a encryption the proof of concept and it
actually works and it is part of the API implementation which I have created using Python
flags of flags is a HTTP service and web application framework it is rather easy to use and
what you can see is a shortened version of the receive email payload and actually send
a real email so this can be re-implemented on this USB stick and can be used to send emails
from the camera to a real recipient.
There is a little bug because Rick Vest is actually my form it doesn't contain a final
terminator but instead just another boundary but this can be also worked around.
And so implementation is using a white list of email addresses because it is a proof
of concept not meant to be run on a public network on the one hand on the other hand
because the cameras are using plain text HTTP so no encryption and it doesn't make
much sense to actually deploy strong passwords that you have to type on the camera
de-pad and the API allows different routing mechanism so you can say you want to post
pictures that you have uploaded to Facebook instead to master don't or to store them on
the local size system and use something like I notify to upload them to something different
or actually send them out as email or ignore them and there is still one challenge
because the cameras are not announcing in advance how many pictures the user has attached
to the Rick Vest so essentially for every picture it is a dedicated Rick Vest and you
don't know how many will come but you need to know that in order to actually finalize
the post to master them so I had to do a little work around and I have used the message
body text and use the tilde character as a separator between the post content and the
image alternative text because it is anyway a good practice to upload images with
all text and so by the number of the tilde characters in the message body the implementation
knows how many pictures to expect there is a bit more of technical leaders like for example
master them post refariable which you can text and similar and the practical challenge
is that on most of the cameras the input box that you can see on the right side has a very
limited length so it's like I don't know 80 characters or something like that and so you
can write another there now there's another interesting challenge sometimes the camera
just locks up so to say it shows the screen and tells you hey do not enter personal information
and then switches into the browser this is a hotspot detection so in the past and right now
I think in some hotels as well you have hotspots where you log in into the wifi network
and need to register with wifi and what does the camera do based on the model again some
of them are asking for web response from a Yahoo server and the Yahoo server is supposed to
redirect to one of the Yahoo URLs luckily some some provided two of their models with a
partial image map file which is essentially a symbol map of the embedded firmware so loading that
into gidra and aligning the symbol positions with the firmware image actually helped to provide
the real functions and to decode the code and to realize that the camera is expecting one of
two answers one of them must be a cookie on the Yahoo something domain or another one must be a
redirect to Yahoo but Yahoo must be in position less than 11 and given that we are using
HTTP s now the prefix of HTTP s and www is too long fixing that actually helped us so
I'm going to skip over the details as this is just a 10 year old e-stick that can or that's run
Android on its own and can be converted to run dbn can be run can use to run Python code and network
manager and can be used to deploy this and use it on the go and I have a little demo
I wanted to do it live but we don't have very much time and we don't have very much wifi apparently
So this is how it works on a real camera this is one of the camcorder models which also supports
this API however they are using HTTPS without checking the server certificate
This is a fast forward because this play a touch screen is so bad that you actually need a minute or so to enter
a short text and in the end it gets posted through the API
Thank you very much
We don't have any time for questions so if you want to ask questions and just follow me
I'm going to leave the room to the side and give over to the next speaker