Samsung 'Smart' Camera Easily Hackable

An anonymous reader writes "The op-co.de blog has a post about the incredibly poor job Samsung did securing its new NX300 'smart camera.' One of the camera's primary features is that it can join Wi-Fi networks — this lets it upload photos, but it also lets you use your smartphone to access the photos on the camera directly. You can also connect with NFC. Unfortunately, the way they set it up is extremely insecure. First, there's an NFC tag that tells the camera where to download the app, and also the name of the access point set up by the camera. 'The tag is writable, so a malicious user can easily 'hack' your camera by rewriting its tag to download some evil app, or to open nasty links in your web browser, merely by touching it with an NFC-enabled smartphone.' Things aren't much better with Wi-Fi — a simple port scan reveals that the camera is running an unprotected X server (running Enlightenment). When the camera checks for new firmware, it helpfully reports your physical location. Its software also sets up unencrypted access points."

Comments

DMCA says this isn't so!

[Anonymous Coward]

It doesn't matter how trivial or good the protection is, the DMCA says that because it's protected, no matter how trivially, then it's illegal to hack it!

And because it's illegal, it's impossible to hack! Making it illegal always puts a stop to everything. That's why we have no murders, no thefts, once our brilliant politicians figure this out we can get on to business and make crime illegal too.

Anyways, the point I'm making is this was a foreseeable consequence of the DMCA.

Re:DMCA says this isn't so!

[ArcadeMan]

I also like that red traffic lights always physically protect me from incoming cars and trucks.

Re:DMCA says this isn't so!

[NatasRevol]

Please never leave your babied little home.

http://kottke.org/14/04/traffi...

Re:DMCA says this isn't so!

[ArcadeMan]

Uh?

Re:DMCA says this isn't so!

[canadiannomad]

Those videos reminded me so much of the various places I've traveled... Those aren't the only places where the normal rules don't seem to apply.

I'm Safe.

[Anonymous Coward]

I have this camera but it can't be hacked. I live in Denver, which is in the AFC.

Re:I'm Safe.

[preaction]

A sports joke might go over the head of this crowd.

Re:I'm Safe.

[ArcadeMan]

Indeed. WTF is a "Denver"?

Re:I'm Safe.

[Anonymous Coward]

A "Denver" is a type of omelet. Generally made with a couple of eggs, some ham, and some green onions, etc.

Re:I'm Safe.

[ArcadeMan]

Thank you.

Re:I'm Safe.

[TechyImmigrant]

No. That's "omelette à l'oignon et jambon"

I think the primary thing that makes a omelette a Denver omelette is that it is too large.

Is this really likely to happen?

[DrXym]

I've never seen one of these cameras and I doubt many other people have either. Nor does it seem likely that there are hackers standing by to "touch" the powered up, wifi connected camera with an NFC phone without the owner of the camera noticing. And when all is said a relatively trivial patch would correct the issue.

Re:Is this really likely to happen?

[jeffmflanagan]

>I've never seen one of these cameras and I doubt many other people have either.
Agreed.

>Nor does it seem likely that there are hackers standing by to "touch" the powered up, wifi connected camera
Agreed.

>And when all is said a relatively trivial patch would correct the issue.
Yes, but it should have been secure out of the box. Many manufacturers don't give a lot of thought to security, and that needs to change. If someone can own your camera over their WiFi, they can load an app that gives them access to YOUR WiFi when you get home. That's pretty serious.

Re:Is this really likely to happen?

[Anonymous Coward]

NFC happens to be a convenient technology. I have a Sony RX100M2 that does similar - it creates a connection to the app on my phone so it can download it there. All of this happens without password entry on my part. It automatically transmits the Wifi password to the app, so it sets up a WPA protected hotspot with my phone.

Is it insecure? Sure - anyone with an NFC based smartphone can be connected to it.

Do I care? No. Someone has to have the device in their hands to "hack" my photos, but why? You can simply pop out the memory card.

Makes it extremely convenient when I need to share photos with family tho.

Re:Is this really likely to happen?

[DrXym]

Yes it should have been secure out of the box but this really doesn't seem like a big deal either terms of liklihood of happening, or in the fix required to secure it - some kind of "do you want to remember device XYZ which is trying to talk over NFC?" dialog.

Re:Is this really likely to happen?

[Anonymous Coward]

I've never seen one of these cameras and I doubt many other people have either. Nor does it seem likely that there are hackers standing by to "touch" the powered up, wifi connected camera with an NFC phone without the owner of the camera noticing.

Both of these are simple "it will never happen to me because ..." cop-outs. Go shame yourself.

As for the latter one, you just have to "stumble into" someone to make that contact. You know, much like pick-pockets can "stumble into" you, and you only noticing your wallet (or camera :-) ) gone quite some time later.

Ofcourse, as in this case nothing physical is taken, you most likely won't notice it at all, up until the moment the stolen goods are used against you. And than its way to late (and good luck catching them, as they do not even need to be in the same country anymore).

And when all is said a relatively trivial patch would correct the issue.

And yet another cop-out.

Apart from how and when that "trivial patch" (nice PR, but I don't believe so) is supposed to get applied. And no, I do not expect a camera to need to go "on line" every patch-tuesday so it can stay abreast of this kind of stupidity.

Having said that, what is this affectuation of putting gadgets like that online (to the world!) ? As should be quite clear by now, we humans have no chance to see, and therefore defend ourselves against such attacks.
And as the article shows, you can't even depend on big-named companies like Samsung to keep the customer safe (for whatever reason, ranging from cheapskating thru incompetence).

shockedz

[Anonymous Coward]

you mean to tell me samsung flung some dung against the hung picture on the wall and rushed radio based features to market without evaluating its security? these guys are known for bloat and everyone should stay away from them until they smarten up...

OK and?

[Anonymous Coward]

OK, thats great. But does it matter? It is a camera. Not everything needs to be "secure" (whatever that means).

Re:OK and?

[Noah Haders]

the issue is the camera can act as a gateway into otherwise secure systems. kind of like how the target CC hack happened through the HVAC system.

Re:OK and?

[Anonymous Coward]

Um, no. The Target hack was from stolen credentials from a HVAC company. It wasn't through the HVAC system.

Re:OK and?

[Noah Haders]

I heard through back channels that it was a security hole in the hvac system itself.

Re:OK and?

[exomondo]

Well in that case it can be presented as fact. What exactly was the security hole?

Re:OK and?

[Noah Haders]

idk, it was kind of hush-hush. just a rumor.

Runs Linux!

[Anonymous Coward]

Samsung just doesn't support it. You'd figure for $750 they could have at the very least secured it.

Yes

[Anonymous Coward]

You shouldn't be adding security flaws to devices. I'm sure that were someone to have their pictures stolen and shared, they would be very upset indeed especially when it's such a trivial thing to fix.

Re:Yes

[Anonymous Coward]

There is a balance between making it easy to use vs secure.

In the real world no one is going to bother to use a NFC device to hack your camera, or even hack your camera. They would just steal the entire camera.

Re:Yes

[ArcadeMan]

If someone steals your camera, you know someone else has your photos.

If someone steals your photos without your knowledge, you assume your photos are safe.

Re:Yes

[Anonymous Coward]

and why do they need to steal your photos? I suspect your photos have been plastered all over fecesbook already, so why go to the bother of hacking a camera to get them?

Re:Yes

[Anonymous Coward]

Right.. Cause I'm sure some adolescent girls want all the photos that have been taken of them plastered all over facebook... And in the hands of some creepy nerd. /creep

Re:Yes

[Anonymous Coward]

It won't happen. Someone is going to come up with a "hack" to steal the pictures from this camera and then use a NFC device to attack one? For pictures? Not likely.

So to hack this camera....

[Anonymous Coward]

So if I have this TV at home... all it takes is someone having to break into my home and hook up their NFC enabled smartphone to it... they have to break into my home... Good luck, most hackers don't go outside...

That is not what open software means, you bozos!

[Anonymous Coward]

You're still supposed to make it secure!

Feature not a Bug

[WillAffleckUW]

It's part of the NSA Big Brother Watches America program of "value-added" services.

Hack Off!

[Mr D from 63]

I have begun to despise the term "hacked". As anything that can be used in any manner other than its purest fundamentally intended purpose, is considered to be hackable.

Not everything needs to be secure. My mailbox in not secure. I have photos printed at by others. When I start taking nude selfies, I'll make sure wifi is turned off.

Re:Hack Off!

[ArcadeMan]

Example: this is a hack.

Re:Hack Off!

[lister king of smeg]

then turn it on after you delete them, uh oh hacker used a file recovery utility your dick pics they are now a 4chan meme.

Re:Samsung = Korean state spy gadgets

[WillAffleckUW]

Actually, a former colleague of mine works for Samsung now, and that's not true.

Not saying the state doesn't have access to the blueprints and tech docs - they do. But who do you think makes half the stuff you buy from China?

Right, the Chinese People's Army.

(this is not a joke, follow the trail)

The takeaway

[93 Escort Wagon]

Wow, someone actually is still using Enlightenment...

Re:The takeaway

[Anonymous Coward]

Tizen (a Samsung/Intel collaboration to make 'something that isn't Android') uses Enlightenment for its UI.

A trivial thing impossible to do

[SuperKendall]

And when all is said a relatively trivial patch would correct the issue.

The patch is always trivial, the ability to get it to all people that have the device nearly impossible.

Re:A trivial thing impossible to do

[DrXym]

It's a wifi connected android device. Getting the patch to people is a matter of pushing an updated app or firmware next time it checks for updates.

Re:A trivial thing impossible to do

[SuperKendall]

It's a wifi connected android device.

In case you had not read before, that by itself means almost nothing in regards to updates.

no win situation.

[nblender]

Either the manufacturer produces a phone so locked down that you can only use it the way they want you to and everyone complains and RMS froths at the mouth... Or the manufacturer produces a phone full of holes and everyone complains... Only RMS is happy. RMS being unhappy is far more entertaining.

Re:no win situation.

[Anonymous Coward]

How about putting the user in control, rather than as in this case the entire bloody universe?

X11 you say?

[mx_mx_mx]

This would be pure awesomeness to show goatse on the screen of the camera to unsuspecting viewer while he aims for the shot....

Re:X11 you say?

[Type44Q]

This would be pure awesomeness to show goatse on the screen of the camera to unsuspecting viewer while he aims for the shot....

I'm told there are surgeons in Mexico and Brazil who can make that happen for you...

Re:X11 you say?

[phorm]

With an overlay so that you can see what's in the viewfinder through the *ahem* orifice?

Illuminade

[Anonymous Coward]

Cool conspiracy theory, bro.

Re:Illuminade

[Anonymous Coward]

Conspiracy fact, not theory. Evidence backs up my thoughts.

Yeah and MH370 is in Diego Garcia! It's conspiracy fact supported by evidence! Also Apple are Chinese government co-conspirators as evidenced by the products they make coming from China and Apple willingly adding flaws like goto-fail into them! It's all conspiracy fact!

Somebody get me some tinfoil, I need to build a hat!

As if Canon/Nikon do this better

[SirJorgelOfBorgel]

While this camera should of course be more secure - what exactly are we comparing it to ?

Do you think your Canons and Nikons are safe? Lots of models allow remote control using either USB or Wi-Fi. USB requires a cable from your smartphone running the malicious software, while Wi-Fi obviously does not. For Wi-Fi you need to get past the encryption, but the joke is, lots of people actually run their camera's Wi-Fi without encryption (surprisingly, some photo blogs advise it for ease of use). You're still not home free though as there's a pairing process when Wi-Fi is used, but if the camera owner's smartphone is active on Wi-Fi (not necessarily even the same network - just turned on), this is not hard to beat either.

If you can get connected to these cameras either via USB (completely unprotected) or Wi-Fi, it is not just possible to manipulate, retrieve, replace, wipe, etc all images present, you can fully control the camera's settings and even send malformed commands to completely disable the camera, only to be (potentially - it depends on the model) revived by a Canon/Nikon repair center. This while most users think the worst that can happen is someone copying their pictures ...

You think the NX300 is bad? Consider that pretty much nobody owns an NX300, while virtually all photojournalists active in countries with questionable rights to free speech have one of these affected Canons and Nikons ...

Re:As if Canon/Nikon do this better

[penguinoid]

If you can get connected to these cameras either via USB (completely unprotected) or Wi-Fi, it is not just possible to manipulate, retrieve, replace, wipe, etc all images present, you can fully control the camera's settings and even send malformed commands to completely disable the camera, only to be (potentially - it depends on the model) revived by a Canon/Nikon repair center. This while most users think the worst that can happen is someone copying their pictures ...

And if you think that's bad, they could also connect their hammer to your phone, and send commands that will permanently disable your phone.

Re:As if Canon/Nikon do this better

[Darinbob]

The thing is that you can't have high security and also have high convenience. Thus consumer devices are intentionally given insecure features in order to make them more usable. Thus, drivers that automatically install on your computer merely because you plugged in your phone to power it (damn you microsoft, you are not allowed to install random files without my permission). So similarly with this camera I assume the marketing people did not want to bother the computer illiterate user with all sorts of "are you sure you want to want to this into the ?" questions.

Re:As if Canon/Nikon do this better

[TechyImmigrant]

What difference does it make when after taking the photo, you just upload it to Facebook?

Re: As if Canon/Nikon do this better

[Anonymous Coward]

I have one you insensitive clod

Re:As if Canon/Nikon do this better

[thegarbz]

So what you're saying is that Nikon and Canon are as bad as Samsung, except for the lack of easy auto configuration providing this exploit, a reduced number of wireless attack vectors, and the ability to setup an encrypted connection on the camera.

Good argument! /sarcasm

Re:As if Canon/Nikon do this better

[Anonymous Coward]

People notice when someone takes a hammer to their expensive equipment.

But having cameras etc. bricked just because they took a bus where they get close to other people? Actually, that sort of thing need to happen. Hackers should overwrite camera firmware via WIFI just because they can. The support calls and lemon claims will then force manufacturers to do better. Similiar to how ms eventually is forced to improve windows security slightly, seemingly against their will. They invented virus-capable email clients, abuse happened, ...

Re:As if Canon/Nikon do this better

[SirJorgelOfBorgel]

Of course. I'm not even advocating the need for change - I'm just trying to point out that cameras like these not being very secure appears to be the rule, not the exception, though not everyone appears to be aware of this. I could see an article like this leading to talk that you shouldn't buy Samsung because it isn't secure, advising other brands instead - but those aren't necessarily any better.

Re:As if Canon/Nikon do this better

[SirJorgelOfBorgel]

Good job intentionally not seeing the point just to be able to make a trollish/sarcastic remark. You must do great at parties.

I Can't Get Past This

[carrier lost]

...a simple port scan reveals that the camera is running an unprotected X server (running Enlightenment).

And here I thought I was the only one running Enlightenment

Sounds like Opportunity

[bill_mcgonigle]

Remember when the 54G had craptastic insecure firmware, but interesting hardware?

If this thing is already running linux, X, and doing opportunistic wifi, there's a bunch of projects that are calling its name.