Comments on: Hacking Linksys IP Cameras (pt 5)

By: Hacking Linksys IP Cameras (pt 6) | SecurityGuy.org

Hacking Linksys IP Cameras (pt 6) | SecurityGuy.org — Fri, 07 Jan 2011 10:09:20 +0000

[...] This article is a continuation of the following GNUCITIZEN articles: here, here, here, here and here. [...]

By: ryan

ryan — Fri, 15 Oct 2010 23:49:47 +0000

hello ,

I am trying to mount this firmware so I can explore the other cgi options available within. Why?

I have a Sercomm wireless IP camera and the commands I HAVE unconvered are very similar to those in this article. Except, my firmware was already updated to prevent the exploits.

Therefore, if I can mount it and explore the filesystem, I may have luck decoding more cgi commands for my camera …

If anyone astill has access to or a copy of the firmware source code, I would love to host it publicly for all. All links provided in this comment thread no longer work as of the date of this post. Google turns up nothing. I see the BIN posted, but I need the source code!

Thanks for any help!

By: Hacking Linksys IP Cameras (pt 6) | GNUCITIZEN

Hacking Linksys IP Cameras (pt 6) | GNUCITIZEN — Tue, 24 Aug 2010 12:40:28 +0000

[...] The Network Hacking Linksys IP Cameras (pt 6) published: February 24th, 2010 This article is a continuation of the following GNUCITIZEN articles: here, here, here, here and here. [...]

By: Return Privacy

Return Privacy — Sun, 22 Aug 2010 18:07:46 +0000

I found the firmware v1.1.00 build 02 and it fixed all the problems with this camera. Do NOT use the newer v1.1.01 build 01, it breaks the motion detection recording completely! If anyone else wants the download link, it is a german drivers site, here it is:
http://translate.google.com/tr.....26rls%3Den

By: Return Privacy

Return Privacy — Sun, 22 Aug 2010 16:12:06 +0000

Hi all, I need firmware v1.1.00 build 02 for wvc54gca. Linksys tech support had me update to v1.1.01 build 01 and it totally broke the motion detection recording function. I need the v1.1.00 build 02, that worked fine. I found the problem was a router, I should have never called them. The v1.1.00 build 02 worked great. I did find a copy of v1.00R24 on another site, but that won’t work with wpa2, and some other things don’t work right. If you have v1.1.00 build 02, please share it with me so I can get this camera working again. Thank you.

By: Luke

Luke — Wed, 10 Mar 2010 08:41:36 +0000

In case anybody else needs it the command to software reset the camera:
http://ip_address:port/adm/reboot.cgi
The reboot command will respond with a simple OK.

Sometimes the camera blacks-out (there is no image) but you still can access the the built-in webserver. If you are in luck the reboot will restore the image. However if the camera really locks-up (the webserver doesn’t respond) you need to unplug the camera.

By: Nick

Nick — Mon, 08 Mar 2010 22:24:32 +0000

Bruno,

I had a go at doing this since I wanted hack the root password. However, the problem I had was that I could not generate a squashfs image that was the same size as the same size as the original. I gave up when the new firmware was made available, since seemed to solve the main issue I had with the previous f/w (motion detect ridiculously sensitive). Only problem I have with the camera at the moment is that it won’t stay on the wireless network for any length of time. Just drops off and has to be hard reset.

Digger/Valex. Linksys site appears okay at present. Current f/w is Ver.1.1.00 build 02.

Luke. I don’t know of a hack to reset the camera. When logged in with admin privs I thought that there was an option to reset it, but unfortunately, my camera is not online at the moment and I cannot get it to come up on the wi-fi network so I cannot check that – sorry.

By: Paul

Paul — Mon, 08 Mar 2010 20:33:27 +0000

The source code wvc54gca_v1.00R24.tgz is there… http://downloads.linksysbycisc......00R24.tgz

By: Luke

Luke — Wed, 13 Jan 2010 14:57:19 +0000

Very nice stuff you folks did but little beyond me. So could you help a mere mortal with what I think is a simple question. Would there be a command that would do a warm reboot of the camera (cf the reset to factory defaults). All the pieces seem to be there but I don’t know how to do that.

By: valex

valex — Wed, 13 Jan 2010 13:07:29 +0000

The ftp site is down, anyone with a stashed copy of the R24 firmware + code ?

By: digger

digger — Tue, 12 Jan 2010 06:05:01 +0000

Sorry to bother you, but on my side of the planet http://ftp.linksys.com seems to be broken so I can’t find any download source for R22 and R24 releases (both firmware and gpl code). If either of you have them backed up please give me a link, torrent, rapidshare, megaupload … whatever.

Thanks in advance.

By: Bruno

Bruno — Wed, 16 Dec 2009 13:10:27 +0000

You can disassemble the firmware binary and mount the filesystem. Q: can you assemble it back to a valid firmware binary?

By: nick

nick — Tue, 17 Nov 2009 22:13:12 +0000

Ricardo,

Unlikely. The device only has 32MB of onboard RAM and a not very powerful processor. To be able to “record” 10 minutes worth of video at any useable resolution and then send that by ftp (forget email due to the size of the video file) would require processing power and RAM that the device just does not have. Best scenario is to use the video stream produced by the device and feed that into a PC running security software that would detect motion and record the event. Such software is available.

By: Ricardo

Ricardo — Sun, 08 Nov 2009 14:33:01 +0000

I have a question. The camera has a surveilance mode that lets you record event-driven video of up to 5 (yes, five) seconds before/after the event itself. Is there any way to have the camera record something like, maybe 10 minutes worth of video instead of 5 seconds?

By: paul

paul — Sat, 01 Aug 2009 21:26:01 +0000

So one you have mounted the bin, cant you edit that to setup some back door to let you in, or better yet to enable telnet???

By: pagvac

pagvac — Fri, 24 Jul 2009 18:01:54 +0000

sweet, thanks for that josh!

By: josh

josh — Fri, 24 Jul 2009 17:05:52 +0000

Here are some pictures of the insides of the Linksys WVC54GCA Webcam along with liks to the data sheets for some of the chips…

http://www.flickr.com/photos/b.....otostream/

…just to save oneone the time of taking thiers appart.

-josh