Upgrade to Pro — share decks privately, control downloads, hide ads and more …

GoPro or GTFO: An (Incomplete) Tale of (Kinda) ...

Zach Lanier
August 29, 2013

GoPro or GTFO: An (Incomplete) Tale of (Kinda) Reversing an Embedded System

"GoPro or GTFO" as presented with Todd Manning at NordicSec Conference 2013

Zach Lanier

August 29, 2013
Tweet

More Decks by Zach Lanier

Other Decks in Research

Transcript

  1. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc. All Rights Reserved. GoPro or GTFO An (Incomplete) Tale of (Kinda) Reversing an Embedded System
  2. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Agenda Intro GoPro Overview Previous Research Methodology/Findings Future Research/Next Steps Conclusion
  3. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. About Us •  Todd Manning a.k.a. “El Isleño” •  Sr. Research Consultant, Accuvant Labs’ Applied Research Consulting •  Previously Mgr. of Security Research at BreakingPoint Systems •  Zach Lanier a.k.a. “quine” •  Sr. Research Consultant, Accuvant Labs’ Applied Research Consulting •  (Net | App | Web | Mobile) pen tester type
  4. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Why the GoPro? •  Highly popular, consumer “rugged” camera •  WiFi-enabled •  Possible applicability to other Amberella-based devices •  Including commercial IP-enabled CCTV installations •  We focused mainly on GoPro Hero3 Black Edition •  So most details apply, but may be some HW differences •  Plus: IT’S EXTREEEEEEEEEEEEEEME!
  5. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  Ambarella A770 camera SoC •  ARMv6 1136J-S core (@528MHz) •  Sitronix ST7585 LCD •  Atheros AR6233GEAM2D 802.11n + BT controller (not used) •  and more... GoPro Overview
  6. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  H3B runs two operating systems: •  ITRON •  Embedded RTOS •  Manages most of the camera bits •  Runs the “GoPro” Webserver on 80/tcp •  “Internal” interface to Linux (10.9.9.9) •  Linux 2.6.38 •  Actually runs as a task within ITRON •  Resides on private/internal network (10.9.9.1) •  Runs Cherokee webserver on 80/tcp, but port fwd’ed from 8080/tcp externally GoPro Overview
  7. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Evil Wombat! •  O.G. contributor to GoPro forum •  ARM firmware developer (???) •  Discovered (and shared) autoexec.ash •  Script that runs on boot, can enable such fun things as serial console, telnetd, etc. •  Wrote firmware parsers, camera “unbrick” tool, and techniques for direct booting Linux kernel
  8. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. ambsh •  Amberella shell - limited shell accessible over serial/USB •  Discovery courtesy of Evil Wombat •  Drop the following into autoexec.ash on SD card, reboot camera: sleep 4
 t app test usb_rs232 1"
  9. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Side note: what not to do You have a successful failure, and now your camera is bricked.
  10. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  ITRON uses IPC message queue for bi-directional, inter-OS messaging (more on this later) •  lu_util is iTRON-to-Linux utility •  Execute commands within Linux, such as enabling telnetd •  Once again, discovery courtesy of Evil Wombat •  Drop the following into autoexec.ash on SD card: " " lu_util sleep 30" lu_util exec 'pkill cherokee'" lu_util exec '/usr/sbin/telnetd -l /bin/sh -p 80’
  11. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Root shell ;) With telnetd enabled, root shell!
  12. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  Recent blog post covering similar info as our DEFCON talk •  Detailed a few commands for camera’s webserver •  Also covered 30-pin Bacpac connector pinout Infobyte More at http://blog.infobytesec.com/2013/08/go-deep-pro-1-of-2.html
  13. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Overview - “GoPro App” Mode •  Camera acts as access point •  Mobile app connects to two webservers on camera: •  “GoPro” Web Server for control / config •  Cherokee for “real time” video preview (MPEG-TS via HLS) •  App retrieves playlist from Cherokee with eight (8) 0.3 second clips for “streaming” preview •  WiFi Bacpac uses 10.5.5.9
  14. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  First step was traffic analysis •  Captured comms between mobile device and camera •  Analyzed Android app using dex2jar, JD-GUI, apktool, & Androguard •  Discovered additional URLs/commands •  Scanned all the network things! Analysis - App Mode
  15. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Network Surface - App Mode •  Cherokee webserver (Linux) •  Runs as root, despite listening on unpriv’ed port •  No addt’l mitigations enabled (aside from NX & ASLR)
  16. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  GoPro webserver (ITRON), in Mobile App mode •  Control of bacpac and camera •  http://10.5.5.9/bacpac/... •  http://10.5.5.9/camera/... •  Passes WPA2 passphrase as auth token •  e.g. http://10.5.5.9/camera/cv?t=MYWPA2KEY Network Surface - App Mode
  17. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  /bacpac/pw?t=MYWPA2KEY&p=%01 •  Powers camera on/off (01 or 00) •  /bacpac/sh?t=MYWPA2KEY&p=%01 •  Activates shutter (records or takes picture) •  /camera/LL?t=MYWPA2KEY&p=%01 •  “Locate” camera using its buzzer •  And more... Some WS Commands - App Mode
  18. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  Remote acts as access point, camera acts as mobile station •  Remote/AP does not use any security - totally open •  Camera scans for HERO-RC-XXXXXX (where XX... are the last three octets of the BSSID/ MAC of the remote) •  Prefers known BSSID, but can be configured to “pair” with new remote •  Remote uses 10.71.79.1 Overview - “WiFi RC” Mode
  19. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  Remote acts as client, talks to camera(s) on 8484/udp •  Discovers (newly) paired cameras via broadcast to 10.71.79.255 •  Remote is basically a “dumb” client •  Sends command, receives response, displays what’s on camera LCD Analysis - RC Mode
  20. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Conversation (UDP) - RC Mode 8484/udp OO se lc lc lc + bitmap se lc lc + bitmap ... sh sh
  21. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Protocol 00 00 00 00 00 00 00 00 01 04 6f 6c 63 05 NULLs (8 bytes) Flag? 1 byte (00 or 01) Seq. Num 2 bytes Command 2 bytes Flag? 1 byte (00 or 05) Request (RC -> Cam) 00 00 00 00 00 00 00 00 01 04 6f 6c 63 01 05 00 00 00 ... NULLs (8 bytes) Flag? 1 byte Seq. Num 2 bytes Command (ACK) 2 bytes Flag? 1 byte Flag? 1 byte (00 or 05) NULL padding and/or cmd-specific data (Optional, up to 601 bytes) Response (Cam -> RC)
  22. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  LC response is interesting/neat •  Kept noticing “larger”, 615 byte responses after LC command request “LC” command
  23. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  LC short for “LCD” (?) •  Yep. •  615 byte response contains bitmap of camera LCD •  Quickly hacked up script to extract LC response body, “display” contents “LC” command
  24. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. Local Attack Surface - Linux •  No priv separation - everything runs as root •  ASLR enabled system wide, but no PIE or stack guard •  Decent slew of useful commands •  Busybox & GoPro-specific tools •  Numerous “interesting” commands/daemons •  amba_mq_handler •  ombra •  local_message_daemon •  Prepares/sends and receives/parses JSON messages •  network_message_daemon •  Amongst other things, parses JSON messages passed on 7878/tcp (not remotely accessible)
  25. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. IPC - Linux side Message queue Points to queue used by amba_mq_handler which handles IPC from Linux <-> ITRON Message processing API provided by libmsgprocess.so
  26. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. IPC - ITRON side Numerous registered IPC programs (viewable in ambsh with ipcprog command)
  27. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. FUTURE RESEARCH & NEXT STEPS
  28. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  Remote monitoring •  Legitimate, bespoke 3rd party clients •  Using the camera to spy •  Dumping firmware from WiFi Remote •  GoPro 30-pin bus interface •  Remarkably similar to Apple i-device connector •  Used for interfacing with product add-on devices •  Further analysis of IPC stuff and ITRON Future Research
  29. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. https://github.com/quine/GoProGTFO Watch this space! Will drop public scripts, tools, etc. here soon Code, notes, etc.
  30. Proprietary and Confidential. Do Not Distribute. © 2013 Accuvant, Inc.

    All Rights Reserved. •  [email protected] •  https://twitter.com/quine Questions / Contact •  [email protected] •  https://twitter.com/tmanning Greetz: snare, bNull, jono, aloria, cji, d0c_s4vage, KF, donb, k8em0 cmulliner, natron, tigerbeard, jduck, m0nk_dot, drspringfield, zek, marcinw, sl0w, drraid, amberalla, solareclipse, mckeay, katalyst, cd, sbit, awr, tkrpata, kingpin, thegrugq, eas, rumble, ddz, sa7ori, HockeyInJune, pof, rmogull, oxff, zenofex, hustlelabs, redpantz (Todd says he’s sorry), cmiller, chrisko, mcalias, rfp All of NORDICSEC! And the rest of the jerks in #busticati & #aha And to anyone we forgot: sorry.