POST http://www.ospserver.net/social/columbus/email?DUID=123456789033 HTTP/1.0
Authorization:OAuth *snip* 👆 unencrypted HTTP requestContent-Type:multipart/form-data; boundary=---------------------------7d93b9550d4a
-----------------------------7d93b9550d4a
content-disposition: form-data; name="message"; fileName="sample.txt"content-Type:multipart/form-data;
<?xmlversion="1.0"encoding="UTF-8"?>👈 XML payload with image meta-data<email><sender>Camera@samsungcamera.com</sender><receiverList><receiver>censored@censored.com</receiver>
</receiverList><title><![CDATA[[Samsung Smart Camera] sent you files.]]></title>
<body><![CDATA[Sent from Samsung Camera.\r\nlanguage_sh100_utf8]]></body></email>
-----------------------------7d93b9550d4a
content-disposition: form-data; name="binary"; fileName="SAM_4371.JPG"content-Type:image/jpeg;
*snipped JPEG payload* 👈 raw payload with JPEG file
-----------------------------7d93b9550d4a 👈 no multipart terminator!
Only expects “200 OK” as response ➛ first to be
implemented in 2022
Python Flask Service
E-mail API endpoint
(shortened)
@app.route('/social/columbus/email',methods = ['POST'])
defsendmail():
ifnot'message'in request.files:
abort(400, "No 'message' in POST or unpatched Flask")
xml = ET.parse(request.files['message']) # parse XML payload
sender = xml.find('sender').text
name, addr = email.utils.parseaddr(sender)
recipients = [e.text for e in xml.find('receiverList').findall('receiver')]
title = xml.find('title').text
body = xml.find('body').text.replace("\nlanguage_sh100_utf8", "")
msg = Message(subject=title, sender=sender, recipients=recipients) # create email
msg.body = body
for f in request.files.getlist('binary'):
msg.attach(f.filename, f.mimetype, f.read())
mail.send(msg)
return make_response("Yay", 200)
“Unpatched Flask” ➛ patch Flask to accept HTTP without multipart
terminator
username and password: encrypted with session key
(_secureRandom() 😰)
CameraCryptKey = RSA-encrypted session
key 🥵
char *_secureRandom(int *result) {
srand(time(0)); // initialize non-secure(!) RNG with time in seconds(!!)char *target = String_new(20,result);
String_format(target,20,"%d",rand()); // get "random"(!!!) number, format as stringreturn _sha1_byte(target,result); // return SHA1 of "random" number string
}
char *_sha1_byte(char *buffer, int *result) {
int len = strlen(buffer); // get length of string, throw it awaychar *shabuf = malloc(20); // allocate target bufferchar buf[20]; // intermediate buffer on stack
memcpy(shabuf, buf, 20); // copy stack buffer to target bufferreturn shabuf; // return 20 bytes from uninitialized stack(!!!!)
}
CryptSessionKey: session key + IV
encrypted with… nothing at all!
Between 2009 and 2015, Samsung released over 30 WiFi-equipped compact
and mirrorless camera models that could email photos or upload them to
social media. In 2021, they shut down the required API services,
crippling the WiFi functionality.
To revive the WiFi feature, the firmware of multiple camera models
was reverse-engineered to understand the protocol and to “circumvent”
the WiFi hotspot detection implemented by Samsung.
Based on the gained knowledge, a FOSS implementation of the API was
created using the Python Flask framework, allowing to post to Mastodon
right from the camera. The project supports ~75% of the camera models,
looking for hardware donations and better-skilled reverse engineers to
close the gap.
It was exemplarily deployed on an inexpensive LTE modem running
Debian, allowing on-the-go use of the camera WiFi.
HMX-QF20: It’s TLS SSL… v2!
HTTPS without certificate checks (SSLv2) 🥱
Same XML API, credentials not encrypted
obfuscated
SSLv2 disabled at compile time in every reasonable
code base
Social Media Upload Sequence
What the camera does:
POST /<site>/auth/(username, password) ➛ session (only once)POST /<site>/photo/(filename, album, message) ➛ upload URLPUT ...upload_url.../file(actual picture)Implications: