So you are in the the
act or GoPro or get the fuck
in the marketing promotions for this.
This is a fairly short talk.
But Todd and I have basically been
around with these cool awesome
TODD MANNING: For 20 minutes.
ZACH LANIER: For 20 minutes
TODD MANNING: Our entire
including this talk.
ZACH LANIER: Right.
So our agenda, the you know,
will cover Excuse me.
TODD MANNING: Entourage,
Only a 20 minute talk and
That's too bad!
TODD MANNING: This
You should have showed
ZACH LANIER: Shit.
Why are we here?
TODD MANNING: Here here First
We we we figure that
They have shot the n00b.
TODD MANNING: N00b has
of meanings and so there's only one
So we also need somebody
You, sir.
TODD MANNING: Preferably
He's Midway through the change.
Come on up.
TODD MANNING: I will take two.
You know, guys try to act
to make you drink
I don't know.
I guess ticket prices will be
Now you have four minutes left.
ZACH LANIER: Damn it!
TODD MANNING: That's
the material.
(Laughter).
ZACH LANIER: Shut up and drink.
TODD MANNING: GoPro GTFO!
Woo!
TODD MANNING: Thank you,
Do I get a GoPro.
TODD MANNING: You know
The young lady might have gotten
ZACH LANIER: Traffic.
TODD MANNING: Bring more booze
ZACH LANIER: Okay.
So continuing on.
So we'll have you're brief intro,
while drinking.
We'll talk a little bit
to time limitations we will gloss
We will cite previous research
to mess with this but, you know,
to give credit where credit is due.
We will talk
and we are certainly not finished.
As well as some
out of this research up to this point.
We'll talk a little bit
will conclude with a bunch
So first, Todd.
TODD MANNING: What's up?
I'm Todd Manning.
Senior research consultant
Horror for hire, you know.
I used to work
security research team and now I turn it
ZACH LANIER: Hi, I'm Zach Lanier
I'm also a senior research consultant.
Did I get a whistle?
That's awesome.
I'm not even wearing a dress this year.
TODD MANNING: He
ZACH LANIER: Backwards.
I'm also a senior research consultant
Just old timey net web app mobile app
Why did we pick the GoPro.
Because Todd wanted to.
TODD MANNING: Because I had one
ZACH LANIER: It's
I'm sure you have seen it
featuring scantily clad men and women,
on their skateboards and fall a lot.
It is Wi Fi enabled.
It's got all of these cool features that
to control the camera.
One of the more interesting facts
a company called Amberella who
not only in the GoPro
we found to be intriguing, and so,
another future research thing.
We focused
which is what we have up here.
So a lot of details that will be
of the hardware is a little bit different
a little bit later and plus it's really
I can't say that
TODD MANNING: I can.
It's fucking extreme!
ZACH LANIER: Mountain Dew.
It featured an Amberella, it's
JTAG and blah, blah, blah, blah,
for their light sensors
on this Atheros controller,
of stuff that's not relevant to security
it has a lot of stuff that's not used.
All packed
TODD MANNING: Okay.
I will do this one.
I figured it was my turn to talk.
One interesting thing,
of found when we busted this camera
not just one.
So two for the price of one.
One is the iTRON embedded operating
It's like this open source sort
standard really.
So the version that runs on here
to the standard developed
I guess.
So it's primarily responsible
So capturing images, doing encoding
And then it runs Linux kernel version
So the realtime the ox S system works,
of threads that are
One thread is dedicated
the Linux operating system
of higher order functions that deal
like, mobile application that kind
And so yeah.
Two operating systems.
There's a private network that runs
The networking address is given here,
The the realtime operating system side
of handles certain requests,
of the, like, preview mode files
the version
server that handles actually taking
from the mobile remote control
from that on to the realtime operating
describe shortly.
One second, I need some water.
Okay.
ZACH LANIER: This is your boy.
TODD MANNING: So some previous
Looking into this camera, it's like, oh,
to know something about it,
So the OG of like, you know,
is this cat called evil wombat
Likes to give information.
He's developed a number
on GitHub/evilwombat.
He's an ARM firmware developer
I know he lives on the West Coast.
Other than that, you know,
for more than just a few hours.
Stop dropping Docs.
Hey, wait, sorry about that.
So, yeah, in his repository,
the firmware updates that come
of do some further analysis yourself,
He's got a tool that
to USB and then boot your own custom
brick your camera like I have done,
ostensibly unbrick it.
There are some there's some cases
yeah, real nice guy that has made some
has we have stood on the shoulders
Evil Wombat.
If you are here, I will buy you
to a movie.
You are a real sweet person.
(Laughter).
ZACH LANIER: So one
was this ambsh script.
So if you put that on to the SD card
it will basically auto exec what you put
TODD MANNING: It wasn't that
It's rather he discovered that
a script called autoexec.ash that's
a number of commands and
into understanding what it was that we
by doing that.
ZACH LANIER: Right.
That's better.
And so one of the things
in the Amberella shell called T
of the low level control
the T app test, USB231, it
So it gives enthusiasm access
There's a slew
through even in 30 minutes.
One of the things you shouldn't do
Because it officially bricks your camera.
Don't do that.
TODD MANNING: I would say,
When you run that command
all the NANDs comes up,
but when you reboot,
Let me put it that way.
ZACH LANIER: One
at shared.
It allows the Arthos to talk
over an RTS channel and that allows
to execute any command, as root
So in this case, these snippets here,
by evil wombat chilled
80D goes to 80.
That's one of the external ports that you
So it kills Cherokee and has telnet
Hey, here, we got root on a camera,
Todd is a bad ass.
One of the first things we actually
was looking at the GoPro app mode
So it runs if one of two modes.
Wi Fi remote or GoPro app.
The first one is the GoPro app mode.
It allows you to install a Linux or IOS.
It acts as an access point.
You associate with it,
and it connects
The web server that it talks on 80
for a control channel
and on 8080 it receives it streaming
What is interesting about this and
Wi Fi backpack uses 10.5.5.9.
It uses MDS for discovery.
But it connects to 10.5.5.9,
I don't know if it's a fallback.
And it uses MPEG TS.
It continually receives this play list
And then that file,
that it retrieves.
So it's not really streaming
but it's receiving these .3 second files
the next one and playing it retrieving
a new set of files and this just rotates
You can actually just point Quicktime
player you like at the MUA file
the preview video from the camera.
Kind of turning it into a, you know,
if you so actually were able
TODD MANNING: We asked that
of that offensive technology, please.
ZACH LANIER: Right.
So the other mode that's notable
And this one we find
which we can discuss
In this case,
if we have with us, it's
the little key chain device.
It acts as a mobile device,
with the smaller device.
It goes to here rc xxxx which are
Once it's paired, it
and prefer that,
to a new remote.
So you can draw your own conclusions
possible there.
It's also totally open.
There's no security whatsoever.
So you can just associate
We're still sort of exploring what
about attacking the remotes.
But anyway.
Network attack surface.
The Cleroux key web server runs this
on an unprivileged port
We noticed there's absolutely no
The compiler options and
like on the file system of the camera.
So you can totally have fun there.
The executable base itself not
of the payload is not really difficult.
If you find
So we're like at five minutes.
So iTRON side TODD MANNING:
Okay.
So like we said, two web servers.
On the realtime OS side,
there were these URLs that
to engage different behavior
Some are configuration type commands
reconfigure capture settings
start recording, stop recording,
Basically, you know,
to the Wi Fi axis point,
and kind of reconfigure
We are working
acts as the control.
Let's see, and it actually passes
and I haven't found
and I'm not sure why that happens,
I mean, I guess it's the key
yeah, it seems kind of strange.
And basically once you you know,
in either the realtime OS or
from the realtime OS side,
If you find like a Cherokee bug,
to do there too to bridge the gap
So in terms of local attack surface,
and so there's to privilege exception.
Everything
all the libraries are loaded
The web server itself, so Cherokee
images at hex 8000 and there's actual
of sections that get mapped there.
Sorry, 8000 and then like hex 8300.
Let's see, it runs busybox
you know, busybox utilities there,
You know, sometimes you see that
I feel like you want to break in there,
ZACH LANIER: So basically it's just
but pretty much every executable base
or always mapped
terribly difficult to get reliable codex.
TODD MANNING: I feel
but, you know, maybe not.
So there are a number of, like,
quote/unquote services that are
A couple of them are listening
They handle JSON well, one
messages from the ISON side,
Basically, their mechanism
across like these two operating
So they share the same memory,
like this queue based message passing
And hey, it's a great time to talk
ZACH LANIER: So the we're
So we will probably breeze
Upping IPS,
are there and they point to the M
is the Amberella which
to iTRON worth exploring.
They are on the Amberella or
shell, you can run PRAG,
out all of these different programs that
It's like son IPC ish.
It maps to I aspecific program that's
and that's basically all we will talk
because we are running out of time.
Future research, remote monitoring,
like the spoke or
the camera to spy.
That sounds really cool.
Next thing would be
from the wire Wi Fi remote and
And it's remarkably similar
Back door persistence, blah, blah, blah,
maybe tomorrow when we are sober.
At GitHub.com/quine/GoProGTFO.
And finally if you want to reach us,
or quine on Twitter.
And these are really cool people
And if you are not
we are sorry.
We will take questions
Thank you for coming.
The lovely Todd.
(Applause) TODD MANNING: I love
ZACH LANIER: And
in the audience, you know where to go.
Outside.
TODD MANNING: I have one
I'm going to flip you.
Did anyone log
Fi password?
Did anybody if you can prove it
will fucking give you this camera.
I take that as a no.
None of you are hackers.
(Laughter).