Trendnet Security Issues, Updated Firmware & SSH / Dropbear

So, it seems that after several years of these cameras being on the market it appears there are some very basic security holes. To be honest I am not surprised, these cameras are *very* budget and so given that I was using them to watch over the little one I didn't expose them on the internet but have used a cracking piece of software zoneminder to host and record the video when I want to access it outside of the homestead.

However, in an effort to at least try and make them more secure, I have enabled telnet and inserted the boot script to version 1.1.1.74 of the firmware which was released by Trendnet as a result of  the excellent work done by Console Cowboys; you can download the new and improved firmware here. The upgrade procedure released by Trendnet suggests that you need to first install 1.1.0.67 before upgrade which can be found here.

Whilst we are talking about security, if you are concerned about telnet being open, I suggest you turn it off in the startup scripts on USB or SMB. You can then use dropbear to have ssh connectivity if you still want the command line as below:

I have also compiled dropbear with its associated support files (dbclient, dropbearkey and scp); it take a little bit of effort to get this running as you need to copy the libutil.so.0 into the lib directory, generate the keys and add users to the device. As user management is not included in the base busybox provided I have also compiled a more complete version. All these files can found here, I'll add more complete instructions to automate this when I get some time.

The Finished Article (or at least the first release)

So I actually finished the first release a couple of months ago but wanted to have it running for a while so I can be sure it is stable before releasing it.

I have modified the firmware with a startup script (which you can download for viewing here) which checks for scripts to be found on either the associated SMB share or a USB stick on startup; this should allow for the camera to load additional code at boot without the need to revise the firmware constantly. The other advantage is the firmware has very little available space, and there wasn't enough space for the graphics to be stored for the text and volume meters.

The firmware can be found here; as before, whilst it works great for me, your mileage may vary.

The firmware released by Trendnet has been updated due to the security holes found by Console Cowboys - I have a new version of the firmware here.

I have also included the files I have put onto USB sticks on the camera, if you extract the following files (found here) into the root directory of a FAT fomatted memory stick and insert it into the camera it will start the baby camera volume meter on reboot.

The additional files are very conservative with the timings so the camera boot time takes about 1 minute longer. I don't consider this to be an issue as they are rarely restarted.

You can also pop the files on a samba / windows share and connect to it from the camera's interface and it will load the files over the network on reboot - freeing up the USB (although as the network link is torn down when I unload the existing camera module to load my own so it doesn't work for me with my apps)

For visualisation I am using Jogglers from O2. I bought these from the O2 store when they went on firesale for £50 and they are perfect for the job. I have leveraged work done by far smarter folks than me and they are now running Ubuntu 11.04 and I am using VLC to display the video. I added a couple of shortcuts to the desktop so the other half can easily start the video if they are rebooted. We have had them running for about 2 months without a restart so I consider them to be perfectly stable enough for our use (they even survived my typical curse; whenever I go travelling for work it is inevitable that something I have hacked together fails - in this instance they have survived all trips without needing any assistance from me)

The URL's I use for VNC are:

http://admin:admin@nurserycam/cgi/mjpg/mjpg.cgi

- or -

rtsp://nurserycam/mpeg4

you will need to substitute the appropriate hostname for your purposes.


I still have some to-do's which I will get round to shortly and post updates:

Add OpenSSH Server:

This is compiled and tested, I just need to add it to the startup script

Update Busybox

This is compiled and tested, I just need to add it to the startup script

Add USB Temperature Sensor support

This is proving to be tricky, the USB support on the camera seems to be the bare minimum to support storage devices, I can't seem to get generic support working - if anyone out there has any ideas I would be grateful for suggestions

Add 2 way audio / mp3 playback

The little fella finds it easier to sleep with white noise and I would like to be able to fire it off with perhaps a gradual fade out over time to ease him to sleep. This does require adding an external speaker to the camera which is not ideal.

If any of you have any other suggestions, please let me know.

As ever, I welcome your feedback, please let me know your thoughts (good or bad).

Adding visual audio level monitors

With the ability to overlay images to the video stream tackled the next task was to analyse the audio and overlay VU meters to allow us to see how noisy the little tyke is without having to actually listen to him (it is a him btw, he popped out on the 22nd June).

The camera uses the linux open sound system (OSS), which has been replaced by ALSA in linux 2.5 and above and isn't particulary nice to work with. The camera streaming server (camserv) , for which there is no source code, opens the audio-in device on startup and as it can only be opened once (and without it being available camserv refuses to work) I had to look at other avenues to get the audio.

Fortunately, camserv actually offers the audio out in a mangled stream which can be found at http://[cam-ip]/cgi/audio/audio.cgi - this stream provides chunks of audio data in 16bit PCM stream at what appears to be about 8KHz (although the frequency is only being guessed at). The stream isn't presented in a friendly format (i.e. browsers don't recognise it and simply try and download it as a series of files) but it is quite easy to write a bit of code to connect to the port and analyse the audio.

I put together some code to connect to the stream and display the current, peak and average volume overlayed on the video stream. It uses some of the same code used for the text display on the previous entry and seems to run around 1/4 sec behind the actual audio (this is due to the audio being streamed locally, analysed and then overlayed onto the video).

I have included the source code and a compiled version here, and below is a short video of it being streamed to an iPad:




And here it is on Apple TV2 via XBMC:



To use the code on your camera it does need to authenticate to the local camera web server; it defaults to username:admin pasword:admin as do the cameras out of the box, if you are using your own username and password (and I strongly suggest you do) you will need to specify the base64 encode of the username and password on the command line via -a . There are a number of websites which can do is encode so I haven't included this in the code; the format needs to be a hash of the username:password (e.g. 'admin:admin' which has a hash of 'YWRtaW46YWRtaW4=')

Building a baby monitor

We have a baby on the way, and in her infinite wisdom (and knowing my love of hacking around) the other half has requested a baby monitor for the nursery. I have a love of all things gadgetry and decided we needed to be able to view and hear the baby as well as monitor the temperature.

I drew up a short list of the functions needed and then had a look around to see if anything ticks all the boxes.

The requirements are:

1. View and Listen to the baby on devices we already own

• This includes iOS devices such as the iPad, iPhone and Apple TV2
• PC's

2. View and Listen to the baby on a dedicated device (and ideally something else we already own)

• I have an O2 Joggler Picture Frame which I bought for doing other things with - this would be ideal

3. Allow us to view and listen remotely.

• I'm not planning to be a bad parent (honest), but i travel a lot for work do being able to virtually peek my head around the door and check in on the little might would be a bonus.

4.Monitor and alert on events; specifically:

• Temperature
• Noise

5. Be easy to use

• Unlike many of my hacks; it shouldn't require specific knowledge or constant pampering to operate, it should just work.

6. Be family friendly

• We don't want to have a maze of wires and dongles floating around - it needs to be self contained

7. Have a privacy setting.

• The last thing we want is guests to see the good lady breastfeeding before popping the little mite to bed; there needs to be an easy way to turn of the video and audio and for it to automatically restart should we forget to turn it back on
• Ideally, the other monitoring; i.e. temperature and volume should continue to be monitored

With all these requirements in mind I started hunting around for the perfect device. Whilst there are many good baby monitors (some with camera's, screens, temperature monitors etc) available, none of them ticked all the boxes (and to be honest I relished the challenge).

I then started to look around the market for an IP camera which could be modified to meet our requirements. Having had some experience with embedded devices (such as linksys routers, gumstix and pogoplugs) I thought it would be relatively trivial to enhance something out there based on an opensource Linux platform.