Comments on: Hacking Linksys IP Cameras (pt 2)

By: Cam

Cam — Sun, 25 Apr 2010 16:55:17 +0000

Should have checked before posting – the latest 1.100R2 firmware includes a signed ActiveX control (finally!)

By: Cam

Cam — Sun, 25 Apr 2010 16:51:27 +0000

The more recent version of the firmware 1.100R2 resolves this important issue. Thanks for pointing it out – I’m sure that’s how Linksys/Cisco fixed the problem. The software on this camera is still a joke- unsigned activeX control for a security camera. That’s crazy.

By: Hacking Linksys IP Cameras (pt 6) | GNUCITIZEN

Hacking Linksys IP Cameras (pt 6) | GNUCITIZEN — Sat, 06 Mar 2010 18:06:53 +0000

[...] February 24th, 2010 This article is a continuation of the following GNUCITIZEN articles: here, here, here, here and [...]

By: kwharrigan

kwharrigan — Tue, 18 Aug 2009 00:00:29 +0000

Indeed. If you have any user accounts enabled, and they have weak passwords, you might as well have given up your admin account. Seems it is better to run with no passwords than with them as your admin account password is now tied to the strength of N users accounts.

Wow.

By: pagvac

pagvac — Tue, 11 Aug 2009 08:58:53 +0000

@balt: indeed you need to be logged in. BUT, you DON’T need admin privileges. You can login as a RESTRICTED user (video-viewing permissions only), steal the admin password and finally login as admin. Thus, this vuln serves as a privilege escalation vector as explained in the post.

By: Rayan

Rayan — Mon, 10 Aug 2009 22:47:33 +0000

Correct, that only works if you are logged in in another browser session. Try that by closing down all your browsers and then try again with a clean session, it will prompt for the Username and password, if you skip that it will error out.

By: balt

balt — Fri, 07 Aug 2009 22:05:54 +0000

That works indeed, as long as you’re logged in. As long as you only allow one admin user and that’s you, it is probably a non-issue.

By: Hacking Linksys IP Cameras (pt 5) | GNUCITIZEN

Hacking Linksys IP Cameras (pt 5) | GNUCITIZEN — Fri, 05 Jun 2009 08:36:54 +0000

[...] article is a continuation of the following GNUCITIZEN articles: Hacking Linksys IP Cameras (pt 1), Hacking Linksys IP Cameras (pt 2), Hacking Linksys IP Cameras (pt 3), Hacking Linksys IP Cameras (pt [...]

By: pagvac

pagvac — Thu, 07 May 2009 13:56:01 +0000

@A: that doesn’t work. thttpd’s default forbidden error page is returned when trying so.

By: chipxsd

chipxsd — Wed, 06 May 2009 10:24:18 +0000

It really works … damn, I’m throwing my camera under a VPN. Don’t want nobody catching me in an awkward situation :/

By: A

Fri, 01 May 2009 17:32:21 +0000

If you can encode the dot using its hexadecimal representation, what prevents you from doing the same with slash, so you can achieve directory traversal?

By: Hacking Linksys IP Cameras (pt 4) | GNUCITIZEN

Hacking Linksys IP Cameras (pt 4) | GNUCITIZEN — Sat, 25 Apr 2009 10:22:08 +0000

[...] an introduction to the topic and also some initial observations: Hacking Linksys IP Cameras (pt 1), Hacking Linksys IP Cameras (pt 2), Hacking Linksys IP Cameras (pt [...]

By: Linksys IP cam hacking - Hack a Day

Linksys IP cam hacking - Hack a Day — Thu, 23 Apr 2009 21:01:09 +0000

[...] Updated: Part 2 has been posted. [...]

By: Hacking Linksys IP Cameras (pt 3) | GNUCITIZEN

Hacking Linksys IP Cameras (pt 3) | GNUCITIZEN — Thu, 23 Apr 2009 07:42:29 +0000

[...] The Network Hacking Linksys IP Cameras (pt 3) published: April 23rd, 2009 This article is a continuation of the following GNUCITIZEN articles, which include an introduction to the topic and also some initial observations: Hacking Linksys IP Cameras (pt 1), Hacking Linksys IP Cameras (pt 2). [...]

By: Hacking Linksys WVC54GCA Cameras « Random Tech Stuff

Hacking Linksys WVC54GCA Cameras « Random Tech Stuff — Tue, 21 Apr 2009 21:04:37 +0000

[...] http://www.gnucitizen.org/blog.....eras-pt-2/ Possibly related posts: (automatically generated)Student’s new blogArchive – More reasons surveillance cams suckâ€¦ Posted by ourtechstuff Filed in Uncategorized Tagged: linksys, wireless camera No Comments » [...]