Indodakazi kaRusnano, eyathengisa izinkulungwane zamakhamera ezikoleni ezine-Rostec, yenza kanjani amakhamera "eRussia" ane-firmware yase-Chinese evuzayo.

Sawubona wonke umuntu!

Ngithuthukisa i-firmware yamakhamera okuqapha amavidiyo wezinsizakalo ze-b2b ne-b2c, kanye nalawo abamba iqhaza kumaphrojekthi wombuso wokugada amavidiyo.

Ngabhala ngendlela esiqale ngayo isihloko.

Kusukela lapho, kuningi okushintshile - saqala ukusekela ama-chipsets amaningi, isibonelo, njenge-mstar ne-fullhan, sahlangana futhi sakha ubungane nenani elikhulu labakhiqizi bekhamera ye-IP yangaphandle nasekhaya.

Ngokuvamile, abathuthukisi bekhamera bavame ukuza kithi ukuze babonise imishini emisha, baxoxe ngezici zobuchwepheshe ze-firmware noma inqubo yokukhiqiza.

Kepha, njengenjwayelo, kwesinye isikhathi kuza abafana abangajwayelekile - baletha ngokungananazi imikhiqizo yamaShayina yekhwalithi engamukeleki ene-firmware egcwele izimbobo, kanye nophawu olumbozwe ngokushesha lwefektri yezinga lesithathu, kodwa ngasikhathi sinye bethi bazenzele konke ngokwabo: bobabili. i-circuitry kanye ne-firmware, futhi kwavela ukuthi isiRashiya ngokuphelele.

Namuhla ngizokutshela ngabanye balaba bafana. Uma ngikhuluma iqiniso, angiyena umsekeli wokubhaxabulwa komphakathi “kokuthatha indawo yokungenisa kwamanye amazwe” ngokunganaki - ngivame ukunquma ukuthi asinandaba nobudlelwano nezinkampani ezinjalo, futhi ngalesi sikhathi siyahlukana nazo.

Kodwa-ke, namuhla, ngifunda izindaba kuFacebook futhi ngiphuza ikhofi lami lasekuseni, ngicishe ngalichitha ngemuva kokufunda izindaba ukuthi inkampani engaphansi kwe-Rusnano, inkampani i-ELVIS-NeoTek, kanye ne-Rostec, izohlinzeka amashumi ezinkulungwane zamakhamera ezikoleni.

Ngezansi kokusikiwe kunemininingwane yokuthi sizihlole kanjani.

Yebo, yebo - laba abafana abafanayo abangilethele i-China eshibhile futhi embi, ngaphansi kokuzithuthukisa kwabo.

Ngakho-ke, ake sibheke amaqiniso: Basilethele ikhamera ye- "VisorJet Smart Bullet", evela kweyasekhaya - yayinebhokisi neshidi lokwamukela i-QC (:-D), ngaphakathi kwakukhona ikhamera ejwayelekile yaseShayina esekelwe I-chipset ye-Hisilicon 3516.

Ngemva kokwenza ukulahlwa kwe-firmware, kwasheshe kwacaca ukuthi umkhiqizi wangempela wekhamera ne-firmware yinkampani ethile ethi "Brovotech", egxile ekuhlinzekeni amakhamera e-IP enziwe ngokwezifiso. Ngokuhlukana kwami ​​ngangicasulwa yigama lesibili laleli hhovisi “ezvis.net» inkohliso engaqondakali yegama lenkampani i-Ezviz, indodakazi ye-b2c yomunye wabaholi bomhlaba u-Hikvision. Hmm, yonke into isesikweni elingcono kakhulu lika-Abibas noNokla.

Yonke into ku-firmware iphenduke yaba ejwayelekile, ayinakuzithoba ngesiShayina:

Amafayela ku-firmware
├── alarm.pcm
├── bvipcam
├── cmdserv
├── i-daemonserv
├── ithola
├── ifonti
├── lib
...
│ └── libsony_imx326.so
├── setha kabusha
├── qala_ipcam.sh
├── sysconf
│ ├── 600106000-BV-H0600.conf
│ ├── 600106001-BV-H0601.conf
...
│ └── 600108014-BV-H0814.conf
├── system.conf -> /mnt/nand/system.conf
├── version.conf
└── www
...
├── ilogo
│ ├── elvis.jpg
│ └── qrcode.png

Kusuka kumkhiqizi wasekhaya sibona ifayela elvis.jpg - hhayi elibi, kodwa ngephutha egameni lenkampani - ukwahlulela ngesayithi abizwa ngokuthi "ama-elvees".

I-bvipcam inesibopho sokusebenza kwekhamera - uhlelo lokusebenza oluyinhloko olusebenza ne-A/V stream futhi iyiseva yenethiwekhi.

Manje mayelana nezimbobo kanye ne-backdoors:

1. Umnyango ongemuva ku-bvipcam ulula kakhulu: strcmp (iphasiwedi,"20140808") && strcmp (igama lomsebenzisi,"bvtech"). Ayikhutshaziwe, futhi isebenza embobeni engakhubazekile engu-6000

2. Ku-/etc/shadow kune-static root password kanye ne-telnet port evulekile. Akuyona i-MacBook enamandla kakhulu ephoqelele le phasiwedi ngaphansi kwehora.

3. Ikhamera ingathumela wonke amaphasiwedi alondoloziwe ngesixhumi esibonakalayo sokulawula ngombhalo ocacile. Okusho ukuthi, ngokufinyelela ikhamera usebenzisa i-backdoor log pass kusuka ku-(1), ungathola kalula amaphasiwedi abo bonke abasebenzisi.

Konke lokhu kukhohlisa ngikwenze mathupha - isinqumo sisobala. I-firmware yaseShayina yezinga lesithathu, engakwazi ngisho nokusetshenziswa kumaphrojekthi abalulekile.

Ngendlela, ngayithola ngemva kwesikhashana indatshana - kulo benza umsebenzi ojulile wokufunda izimbobo kumakhamera avela ku-brovotech. Hmmm.

Ngokusekelwe emiphumeleni yokuhlolwa, sibhale isiphetho ku-ELVIS-NeoTek ngawo wonke amaqiniso atholakele. Ekuphenduleni, sithole impendulo enhle evela ku-ELVIS-NeoTek: “I-firmware yamakhamera ethu isekelwe ku-Linux SDK evela kumkhiqizi wesilawuli u-HiSilicon. Ngoba lezi zilawuli zisetshenziswa kumakhamera ethu. Ngesikhathi esifanayo, isofthiwe yethu iye yathuthukiswa phezu kwale SDK, enesibopho sokusebenzisana kwekhamera kusetshenziswa izivumelwano zokushintshana kwedatha. Kube nzima kochwepheshe bokuhlola ukuthola, ngoba asizange sinikeze ukufinyelela kwezimpande kumakhamera.

Futhi lapho kuhlolwa ngaphandle, kungase kwakhiwe umbono oyiphutha. Uma kudingekile, sikulungele ukubonisa ochwepheshe bakho yonke inqubo yokukhiqiza kanye ne-firmware yamakhamera ekukhiqizeni kwethu. Kuhlanganisa nokubonisa ingxenye yamakhodi omthombo we-firmware. "

Ngokwemvelo, akekho obonise ikhodi yomthombo.

Nganquma ukungabe ngisasebenza nabo. Futhi manje, eminyakeni emibili kamuva, izinhlelo zenkampani yakwa-Elvees zokukhiqiza amakhamera aseShayina ashibhile nge-firmware yaseShayina eshibhile ngaphansi kwesithunzi sokuthuthukiswa kweRussia bathole isicelo sabo.

Manje ngiye kuwebhusayithi yabo futhi ngathola ukuthi babuyekeze umugqa wabo wamakhamera futhi akusabukeki njenge-Brovotech. Hawu, mhlawumbe abafana baqaphela futhi bazilungisa - benza konke ngokwabo, kulokhu ngokwethembeka, ngaphandle kwe-firmware evuzayo.

Kodwa, maye, ukuqhathanisa okulula kakhulu Imiyalelo yokusebenza "Russian" ikhamera imiyalelo ku-inthanethi unikeze imiphumela.

Ngakho-ke, hlangabezana nokwangempela: amakhamera asuka endaweni engaziwa yomthengisi.

Ngabe le mileight ingcono kanjani kune-brovotech? Ngokombono wokuphepha, cishe, akukho lutho - isisombululo esishibhile sokuthenga.

Bheka nje isithombe-skrini se-web interface ye-milesight kanye namakhamera we-ELVIS-NeoTek - angeke kube nokungabaza: amakhamera e-VisorJet "yaseRussia" ayi-clone yamakhamera ahamba phambili. Akuzona kuphela izithombe ze-web interfaces ezifanayo, kodwa futhi i-IP 192.168.5.190 ezenzakalelayo kanye nemidwebo yekhamera. Ngisho nephasiwedi ezenzakalelayo iyafana: ms1234 vs en123456 ye-clone.

Sengiphetha, ngingasho ukuthi ngingubaba, nginezingane esikoleni futhi ngimelene nokusetshenziswa kwamakhamera aseShayina ane-firmware yamaShayina avuzayo, aneTrojans kanye neminyango emfundweni yabo.

Source: www.habr.com