WiFi / Smart Ip Camera Tear down / a look from inside V380 smart ip camera type-01

 I bought my first Wifi/ip camera named " V380 Smart Wifi Camera ".

It is a very cheap camera (as compared to the others with similar functionality)but it is a 720p Day/Night Vision Camera with mechanical IR cut filter , LDR , multiple infrared L.E.D.s , On-board memory card slot , Mic/Speaker for two way audio , Alarm notifications and cloud based alarm pictures and it has Wifi which can work both in Station mode and AP mode.

First , I bought this, one camera (from one vendor) and used it for some time then after finding it useful I bought three more of these.(from the second guy)

After reading and watching videos on-line about "hacking ip cameras" and how they have "weak security" and "back-doors", I got really curious and first,I opened them all up to see "what's inside" as I am still new to these kind of electronics and SoCs.To be honest they are impressive and so tiny and beautiful. :-)  

Then after learning a little about "computer networking,ports and stuff",using Nmap on Computer and Fing,Connect-bot,Packet capture app on the phone I found a Telnet port (23), RTSP (554) and MMCC (5050).The MMCC(multimedia conference control) port only shows up in the Fing app when not streaming the camera video using the V380 camera app.

Using "Connect Bot" app I logged in as "Root" through the telnet port (23) using the login user name "root" and leaving the password empty.
It has some version of busy-box with "ash-shell".

I wasn't able to do much after that point except browsing the Linux file system which is "Read-only". All of this works only in the local network.

I also connected the USB to serial converter module (cp2102) to the Rx,Tx and Gnd (marked on the board) after soldering cut-out legs from some LEDs and using male to female jumper wires and if you turn the camera on after connecting the wires it doesn't work and nothing shows up in the serial monitor but if you connect the wires right after turning it on it boots up and it shows all the information in the serial monitor and if the Tx is also connected you can browse the file system as "root" right from the serial monitor but it's a read only system from what I understood because I tried a-lot of "things" but wasn't able to do/write/modify anything as it says "read-only".

However , I'll try to do it again after learning a little more.

When in Station Mode and connected to Internet the Camera automatically connects to the preprogrammed IPs/servers in China and the Android app also sends requests to multiple IPs and after the server responds it sends un-encrypted user name/password string (set from the app) for viewing the video.The server responds with an address and ports and the app connects to that and receives live images/audio.It also has alarm function which works only when connected to the Internet other than the alarm notifications/and alarm pictures (stored in the cloud) function, the live video works perfectly in the local network but all of this works using only the v380 app or the other ,comparatively less functional, apps from the same developer.

Following are the pictures of the first camera and I'll post the other camera's pictures too as there are many differences in their hardware and it seems like they are the later versions of this camera.
Although they all have the same main Soc.(the big grain media chip GM8135S)









 












No comments:

Post a Comment