Slashdot Mirror
Kodak Wireless Picture Frames Open To Public
Jaxoreth writes "The Kodak Easyshare Wireless Digital Picture Frame displays images via a per-frame RSS feed hosted by FrameChannel. Each frame's URL is identical except for a parameter matching its particular MAC address, enabling public browsing of users' feeds. And worse, if you reach the feed of a not-yet-activated frame, it gives you the code to activate it, allowing you to preload it with whatever content you choose."
Would this constitute a zero day vulnerability?
Havent thought about this for awhile, but IIRC the first three octets are supposed to indicate the manufacturer of the device, so if we can assume the NIC in these frames is always from the same manufacturer, the address space to search becomes much smaller. Still, it's going to be pretty huge, with probably the largest number of possible URLs invalid, and most of the valid ones full of normal junk no one but family/friends really want to see anyhow. The probability of one or two really nice racy pictures in there will no doubt motivate someone to search the space eventually though.
If you see anything good, or even just really strange, be sure and post it here!
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Best "you've been p0wned" slideshow set. Post URL when done.
for "the ring ii"
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
MAC addresses are in no way predictable based on the company producing the product in question, so we should be perfectly safe.
Sarcasm aside, how could they possibly have thought that this was a good idea? Nobody expects Joe Consumer to remember something as hostile as a MAC address, so there isn't a "user convenience" argument to be made, and anything with enough processor power and mass storage to run these sorts of web functions could have gotten away with cramming in an onboard GUID or some certs or something. WTF?
/. effect across the entire product line. Be polite and don''t load them with tubgirl.
How many people will get their brand new frame home, plug it in and find that it displays a "preloaded" goatse
It seems you get an RSS feed with an activation code no matter what you enter for the frameid (it doesn't even seem to have to be a valid MAC address) so it seems they're not filtering on the server for addresses that actually belong to frames
Help me! I'm turning into a grapefruit!
With the right script and an image recognition software, everyone in a few hours.
Take the links down, theres innocent peoples photographs being put up on the net. :\ I stumbled across some family photos, I know I wouldn't be happy if it was my kids. Poor form by the source of this article. :(
This innocent person has posted pictures of children and some recognisable locations. All it takes is for some pedo pervert to fantasise over the pictures and track them down.
Pheeeeww Sure am glad I keep my online photos safe on facebook, you know, where no one can see them without my.......What the!?!!
And of course, we live in a world where every 13 year old is going to look at this and go, "Sweet! When the next guy buys one of these things, he's going to see pictures of dicks!"
Support my political activism on Patreon.
The really sad thing here is that if some white hat wrote a script to find these and upload to them an image warning the owners of the vulnerability, said white hat would almost certainly get smacked down by a DMCA suit or face civil/criminal penalties. No good deed goes unpunished.
In theory, practice and theory are the same. In practice, they're not.
I'd pay a grand to see the system design behind the "frame" and what decisions were made on what grounds. The arguments like, -"Hey, there is this thing called a MAC address, it's like, globally unique and stuff!"
Kodak, you're toast!
Girls are strange. They don't come with a man page.
-- Michael Mattsson
http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:07:8a
Girls are strange. They don't come with a man page.
-- Michael Mattsson
1. Play with the MAC address to find a live frame. It took me 4 tries.
2. Scroll down and see if one of their images is the weather forecast, complete with the city and state for the forecast.
3. Now look at the userid. It likely contains a first initial and a last name.
4. City, state, last name, first initial -- that may very well be enough to get a street address.
5. Most people have pics of their family, including their kids. You've got a name, address, and photos of the fam.
It seems to me that goatse/tubgirl -ing these things is the only responsible thing to do. Sure, a few dozen (hundred?) people will have to gouge their eyes out, but it's a small sacrifice necessary to generate consumer push back on this kind of nonsense.
Given how rudimentary and just plain awful Kodak's interface was for their WiFi picture frames from 2 years ago when I bought a few for the family to share the same albums with each other across the nation, this story doesn't surprise me in the least.
I mean, who lets the frame go on the internet and builds in a timer for when to turn the frame off and on at night...but then when it comes back on it ONLY goes to its own internal memory and NOT the last gallery you were viewing via the WiFi?? Every morning you have to reconnect it to the internet galleries...and its ability to cache the pics from the internet is so poor that it will often claim it has an "error" and...REVERT BACK TO INTERNAL MEMORY! It's next to impossible to use it to view galleries on the internet...that can ONLY be on their website...AND that they're now CHARGING you to keep "active"!
So, no, it doesn't surprise me at all that they could screw even this basic security up.
Mordor...a magical, mythical land where women are more rare than dragons--but where every man would rather find a dragon
Oh god, it's happening already :(
http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:07:6a
"How many people will get their brand new frame home, plug it in and find that it displays a "preloaded" goatse"
I now have a gift idea my friends will remember.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
I was checking some of the links and noticed a few interesting parameters
http://www.framechannel.com/feeds/pair/index.php/r=1/frameModelCode=KD9372/frameModelId=1/frameId=PAPAPA/reset=0/language=en/7072.jpg
See that parameter named reset? I activated an account and verified it as activating. Then I triggered that reset parameter to 1 and it went back to the pre-activation state!
GPG 0x1B479C78
PwnDak
Que Deus te de em dobro o que me desejas
[May God give you double that which you wish for me]
http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:07:6A Have fun just changing ID... FrameChannel content for goatse2600 http://www.framechannel.com/ Channel for user goatse2600 2 Gaping Bunghole goatse2600 FALSE My Photos http://fs.framechannel.com/31c8c815fb7ed72689d48793be853def.jpg My Photos Tue, 05 Jan 2010 14:15:57 -0500
Could be funny to swap the default activation pics (with the activation codes) so you upload your photos to someone elses photo frame and you get some randoms...
3 is much easier -- users provide their first and last name for your convenience.
They deserve this for gutting their engineering operations in Rochester. This is what you get when you farm out your product design to the lowest bidder in a far off land.
I am becoming gerund, destroyer of verbs.
Too many 'junk' characters to post directly, however: http://pastebin.com/f16f4aedb
Its sloppy to do, but here's why they did it....
Each device needs a unique serial number, something to identify it. But at the same time, they didn't want to customize the firmware for each device to include a serial number.
So instead, some brilliant programmer observed that the embedded processor can get the MAC address from the NIC and use that as a serial number for accessing the web page.
This is an old and useful trick, but the only problem is although it gives you a unique serial number per device, it gives you a predictable serial number per device and because of the nature of the back-end service, they didn't just need a UNIQUE serial number, but also an UNPREDICTABLE serial number. Ooops.
Test your net with Netalyzr
Ow crap. Must get to living room...
I felt a great disturbance in the Force. As if millions of eyes all cried out in terror, and were suddenly blinded.
With a name like "EasyShare" what do you expect ?
N...
Can somebody mod this up please?
I like the sound of calling every security problem a "cloud feature". Suddenly it does not sound bad at all anymore!
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
Someone has a new baby (possible NSFW? baby nudity)
Someone recently graduated, and really likes hot air balloons
many random -- changed twice while posting this
Nice travel photography
Meh.
VERY NSFW - I'd hate to be the one who got this frame for grandma!
Stunning photography, too good to be theirs... damned image pirates
Cute kid; mom needs to wear sunblock
Cute baby pics
Wow. it's amazing what I'll do when bored, while WoW servers are down for patching.
NSFW - Change the example at the end from 6D to 6E for a nice viewing. Bet she isn't happy about her boyfriend's photostream.
"Error generating activation code. We are unable to activate your frame at this time. Please email support@framemedia.com for help resolving this issue."
Oh, and not to mention the streams near the example address (xx:B8:07:6C) seem to be having a high turnover in user name and content.
http://fs.framechannel.com/
returns an xml document with :
fs.framechannel.com
1000 .jpg
true
2008-11-12T18:43:37.000Z
"25b2916b5c49db617f52fa5ea48efee7"
4
STANDARD
0000193a728fd00b6cff91b8840bbf8d.jpg
2009-10-22T04:02:13.000Z
"3ec327314496f0d6d92467f399bfdba8"
http://fs.framechannel.com/0000193a728fd00b6cff91b8840bbf8d.jpg
gives you the image ..
This appears to be for all the "personal" content displayed in the frame..
All unregistered frames now go to an error image. It states that they can't provide a registration number at this time. Looks like they caught on.
I have Kodak's Easyshare EX811, one of their earlier models, and like some of the above posters, it's simply shocking how poor the firmware is in the device. It's a real near miss. The tech is there, the hardware is there, but the software feels like shackles on the user. Surely there are folks smarter than I in the open source community who've come up with their own, better firmware. I tried to Google some, but came up empty.
Thank goodness that's all solved now!
remember that framechannel also has plugins for ROKU boxes and many many other devices other than frames.
The hardware seems to be hardwired to framechannel.com. By using a (wireless) router that can either
1. do URL redirects, or
2. use a custom DNS service
it should be possible to use an alternative service, or setup your own RSS feed. There are lots of things you then could to.
Also, it would be possible to "hide" behind a hard-to-guess RSS URL, or possibly have the RSS server to only respond to certain IP numbers.
I have the Kodak W1020 10" WiFi frame. It does have a unique serial number which is available on the web interface. When I signed up for FrameChannel, I had to provide a 4-digit ID displayed by the frame (don't remember now what it was, or whether it was related to the serial number or the MAC address, and it can't be displayed again without re-initializing the frame). To connect to my Kodak Gallery online account, I had to provide the frame with my email address and password. To sign in to FrameChannel on the web, I have to provide a username and password. In the My FrameChannel Advanced Settings there is a 4-digit PIN number (purpose undocumented).
So, in summary, every bit of capability needed for security is there, awaiting a quick firmware update. It was just a bit of carelessness that FrameChannel didn't think hard enough about security in the first place. I'm willing to forgive this as long as they get together with Kodak quickly and issue a security update - it's a pretty new service, and they are still evolving rapidly. I certainly would never put any private/confidential photos on a web server of any kind. Anyone that does is naive to think it's secure. But I don't want morons defacing my frame contents.
And how many of them will realize they like it?
In the last 15 minutes the RSS url field has disappeared from the FrameChannel Advanced Settings dialog box. What good this will do I don't know, since the main vulnerability is that anyone can enter an existing predictable RSS url.
Well, someone sure is getting a jump on the pre-CES media hype. A conspiracy theorist would suggest that this Corey Halverson dude over in Seattle was slipped some info by his buddies over in Redmond working on a competing product, and looking to exclude a VC-funded startup right when they start gaining traction. That would explain why his blog only has three posts, and why he brought this up right before CES.
Me, I take this as an object lesson for what happens when you dump your product on woot, and when you don't bother to make even the slightest effort at security.
This truly is a PR nightmare, but will make a good plot mechanic in next season's procedural dramas.
I just picked up the URL on the blog and change last cipher... et voila!
http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:07:6E
Usually MAC addresses are progressive like serial numbers.
http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:07:6e
Get the word out to non-slashdot reading folks.. this is too ridiculous for this company not to have it spread all over the internet. http://www.facebook.com/pages/Wellesley-Hills-MA/FrameChannel/103020166321?v=wall http://twitter.com/FrameChannel
If you go to the framechannel website, you can find a link claiming you can share photos with a whole bunch of manufacturers' devices:
The FAQ here:http://www.framechannel.com/FAQ/#FRAME_LIST
sends you here: http://www.wirelesspictureframe.com/company-listing/
where you can see this list:
FrameChannel Wireless Digital Picture Frames
Kodak
D-Link
Philips Electronics
Samsung
Digital Spectrum, Inc.
PhotoVu
Edge Tech Corporation
InTouch
Motorola
Pix-Star
Toshiba
Other Digital Picture Frames
Bigeframe
Fidelity Electronics, Inc.
KoolVu
Pandigital
Parrot
PF Digital, Inc.
Polaroid Corpoation [their typo, not mine!]
Portable USA
Royal
Sungale Group, Inc.
Westinghouse Digital Electronics
http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:07:A6
A quick fix that would get 99.9% of us out of people's pics, if the User-Agent string is something unique to the frames. This would only allow HTTP requests from frames, not from desktop browsers. Yes, we can change our user agent string on the desktop browser to match, but like I say - 99.9% of people wouldn't know how.
To be fair to kodak, yes, their frames are "hackable". However, it is framechannel that is completely wide open. The frames also talk to the kodak gallery. I'm not sure how that part works as I've never set up an account.
So they're somewhat not to blame for that.
However, they *are* to blame for the fact that the web interface of the frame doesn't have a password, nor does it allow the user to set one.
So, if you connect this frame to any public-ish network, anyone can administer your frame (adding other rss feeds, changing settings ... ) by its http admin interface.
Or you could photoshop their existing pictures to put their subjects into compromising or illegal situations.
The resolution on these things and the typical images uploaded to the server is low enough that you could probably make it very hard for even an expert to detect that they were fakes, just by looking at the picture.
-- Terry
This one is long gone, as are the other two featuring nudity.
Ok, people, prove the old adage. If it's uploaded to the Internet, it's there forever. I expect links to a picture sharing site (that allows explicit pictures) before the day is out, with corroborating posts from those who saw them.
Aka pics or it didn't happen. :)
It seems they now redirect everything to there default National Geographic feed.. Did they already implement Bretski's idea and starting filtering on useragent ? Anybody got this model that can validate if its still working on the device and if so sniff and see what useragent it is using..
does anyonone know what software the useragent "AVOS/1.1" belongs to?