content: The Internet of Things - Part 3: Hacking a retina scanner I use the word "hacking" in the loosest sense of the term, because you can't really say that when there is almost no effort involved in doing it. This post is similar to my previous one on 3SVision cameras, as it also involves hardcoded credentials. For some inexplicable reason, a lot of companies making cameras and other things connected to the internet include hardcoded credentials in their products. Most of the time, these cannot be changed by an admin, meaning the vulnerability can only be fixed if there is a firmware upgrade to patch it. This almost never happens, and even if it does, nobody upgrades it anyway - why would you if it is working fine? Another big problem is a lot of these companies actually reuse the same software. For example, the 3SVision credentials that I talked about in my last post can be found in some Trendnet cameras in the exact same way, the only difference being that they changed the credentials. This is particularly worrying as it clearly shows they are aware of the vulnerability, they just can't be bothered to fix it. Both of these cameras are designed to be used as retina scanners, and both of them suffer the same problem. Like many other cameras, they have a web interface. A quick port scan on one of these cameras will show you that there are 3 ports open - 80 (the web interface), 21 (FTP server) and 23 (Telnet). In contrast to the 3SVision camera, the only thing I was not able to gain access to on the Iris cams was the web interface. The web interface has a directory called "/html/iCAMClient.jar". This is a file that basically contains the source code of the software the camera is using. Quite often, this can be found by browsing company websites as they put their source code up for download, for some ridiculous reason, but having it accessible through the web interface is something I haven't come across before. Within the code, you will find something that looks like this: I made a very short video of this process to show how easy it is. On first glance, this looks like hardcoded creds for the web interface that will give admin or user access so you can view the feed or mess about with whatever settings there are. These will not work with the web interface. Instead, you can use them to connect to the FTP server and will give you read/write access. On this particular camera, I couldn't really find anything interesting to do through FTP, so I did something different. If you recall the open ports, they were port 80, 21 and 23. Port 23 is telnet, so I tried connecting through telnet instead. Jackpot. Instead of these creds being user or admin creds, they give us a remote shell on the machine. From here, we can do anything we want. Viewing user creds: To view all the other web directories: Spreading important messages: As you can see, we can pretty much do anything. I did say that I wasn't able to gain access to the web interface, but we actually can now. All we need to do is add a new user and log in with those creds. It is mindblowing that people with the capacity to make a fucking retina scanner can screw up this badly. It would be interesting to see if it would be possible to add some sort of image/config file to add your own eye as authentication to unlock whatever is behind the scanner. This is probably beyond me though, and I couldn't test it unless I managed to find one of these things close enough to me to make the trip and try it out.