2

I saw a video about the hacking of CCTV cameras:

  1. He downloads the latest firmware from the internet.

  2. He uses some reverse engineering on it.

  3. He retrieves the password from etc/passwd file. And he logged in with root.

I don't understand why he downloads the latest firmware from the internet? As I understand it, the firmware is on the device, so we should do reverse engineering on that device.

  • 1
    I think your answer is found in the step that you condensed to: "He uses some reverse engineering on it." How that step works is what you really what you want to know. – schroeder Sep 10 '18 at 9:05
5

The reason he downloaded it rather than getting it directly from the device is simply because it is easier to do it that way. When you download it, all you have to do is figure out the format and unpack it. When you take it from a device, you have to physically open up the device and often plug in complex logic probes and digital interfaces to the flash chip or EEPROM containing the firmware and extract it manually. That takes time and effort that could be alleviated simply by getting the firmware online.

There is the additional factor that you do not usually need to be in possession of the device in question to download its firmware. This can be important if the device is rare, expensive, or can only be purchased in another country. It sucks to have to open up and potentially damage a perfectly good device when you could just download the same firmware it uses and get the same results.

See also How do I extract a copy of an unknown firmware from a hardware device?

  • To add to the above, the attacker might only have unauthenticated network access to the device and as such, does not have access to the device – James Sep 10 '18 at 8:54
  • Okay, so what should we remember when we download the firmware for device. For-ex I have a DVR and I want to hack it so what conditions should I remember when I download the firmware of it?. – Utkarsh Agrawal Sep 10 '18 at 8:58
  • @UtkarshAgrawal You only have to remember that not all devices have firmware available for download online, and that you need to be careful to download the correct firmware for your device. – forest Sep 10 '18 at 9:06
  • Okay, one last query:- if I undertand your above comment correct, for ex if I have "device version 2.3" then I have to download firmware for "device version 2.3"? – Utkarsh Agrawal Sep 10 '18 at 9:11
  • @UtkarshAgrawal Generally, yes. Sometimes it can be difficult to find the actual firmware download, especially if it's not intended to be downloaded manually in a browser but rather directly from the device during an update procedure. Not to mention, these websites do not make it that easy to find the updates in the first place... But yes, if you have device model X version Y, you need to get the firmware for model X version Y. – forest Sep 10 '18 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.