1

First, I am a beginner in IT security. I hope my question is not too dumb.

I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts and settings. After importing, you can log in with a user account and view the live feed (without the need of entering an IP address, ...).

I am assuming the scenario that several users can import the configuration file on different devices. The users should not be able to log in with the admin account.

The Question:

Since one logs in to the external camera, I am wondering why the password hashes, user roles and other parameters are contained in the configuration file:

"users" : 
    {
        "{0ab43b1b-0be3-4b96-b866-98039da06531}" : 
        {
            "active" : true,
            "key_base64" : "fh5PiI1MdkISYkypUwRWQVvJ4IQQYDQUPCg/GeChPpPrQAwOXp8CNM6aaV3YNz1+7Vqk0+fqVccZmZwHqDiE5EGPlzeXjI7v3G5QFEkBAgOpWq8o2yPeyLAJvTcin3r8",
            "name" : "Operator",
            "password-algo" : "SHA-512",
            "password-hash_base64" : "07jQ3zwUcqfwPcLjEd+N3m1swKLIsuI/kEah5BMwVzW/4n4pmk79gDNyhtTPBn0OR52Z+8vSRQtf9wrFbbl+AQ==",
            "role" : "user",
            "signature-private-key" : "-----BEGIN ENCRYPTED PRIVATE KEY-----\nMIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIy+cItmaOjw4CAggA\nMAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBCLOZXnPc+k2rTCdii3MjLDBIIE\n0NkCI8/H3MdTgwMybiHVp9dhGsk+qHTLxUwAsgPdvQechcdQrOb3wb13S620MtHk\nmvB8xHJCss15/NzkwUX7yJmjBdD9k8LsJU1tjX01YGP4F0oygALvfOQp27vbc3Mj\nmcxT41SnXOvvZndduZBkWndJEzNGQ7wH8m6VcB1A7EXna6josz8Kg4c9X3hP++r/\ncd7t8EX1n2JsKp6/3Wl5drPVw26Ajg8xxkhZKZyslGX6uf++b0xQSnQIMl3eRuWV\nmX8Fx5jzGynDQPgBa7naqr8tfaanBaeO4Xjni+fnteudA3uEMF+dwKbQ3m6r00GY\naV2mCiCaT5zhOvj1SB9vPAsM5whx/cgTNTvfNVOJGcbYJ2sJv8tGHboEYuXWVtAN\nkz5V3hz2/PZFubcEHrPwzMMAUxWNeiVNmH6cqNTHrOqCUhY6SbxjULS9EibkdGT0\nRoU4rwSdBEgoTQk1VB5gbjcAWt+iSiTwPQKyvVBdi9uzH7do3G7O/lg9IH6wNpw7\nodPWbPifxsoBSUY81wZkx4NO24PQ8+shb11a/vj/s/HHNwGBgkniLd2wam5bUiLZ\nhBtYNKVzk0obdJtj1IvWTXG3i5BBUqjvkcP3EXPWGZ2+LciCUNiapjQl5w8te6tT\ni04q3dV06vZPzRDGOaHpEXjyZMZLK1W8xAxLaBdXlo69GGatE4xxs3wEO/Cc9RvX\nREwcVaS2vKlFQSTW94QO/DllmJFJH/OgtkJHZKgctIYQsYTDC+BKG8jtWOrDGLQ4\n44PLdMTZ+c1wLtV0C+jta3WnEJYldYHH6wtoA7vJhCQBu825XNZ+H1oR6jGtXk7B\n+m+nrvMsPWZqpq7sd7XxL2aG4ZkIUlQMH0EF2Vw0F6ZvVKXLpMo3SJA4sFrWEr3B\nW7AxMj/ZlLQtt383X+RAGAgs8ncWIHtEMA4WloCSTFCTSeXlQadR2l2MnTRJaGJR\nCoS3BH/XoI01+Lc1Q6+/Z+0CkQgPV4RUyt78a4m2iMEt/DTxR/uJ5DfF+ptsdfVU\n1jLkjROCahYBemI+Ike/nH9JqeZWjwmWQuDBHueNKiobRoyp3dD5m1D7LbO/LWNu\ngbgUcHoVze7ciPew77LxrtE0PWTEgN0Dt41hdXja+JQTqGQojbPT2j+R3onSD1oD\n3zio9o3BuRet5Y7vyyLhasv/ayie2MEXBv2fhAyNgoKTH1k5Ag63XDQ8BdJav/L5\nmL6yhqjSeSs/t1/g1W3l49HY9i5sie8Be4yHojcFC8DIPBwg74f7/PcDSBlu942m\nARqVSxUkX202ChHJ5f6oqdHOU4eVL35Gj588vfpqDabrefo9PrMqozZ+KIe2gIOJ\nqCIW2R9J9T6+8WhMqIWZN1oxofYDdEKqlnmabIP+rlBmJRl6PoOY0LWKDzDAAWH/\nap3AKBTLLhDBGjZB5qmQQp0cDjNGTpM3wPFL8TeIbqLcTDT0z1LWua9jZqIocgt7\nRebKbR/NSioK9dLfyc4uA5kVw/kZool/1hSWLZZkm9YYHNVRMpGJAV+FyuwBsp/I\naWQvp+ZxPwGej0ezGFP2DpXfo1kZAmB/dGsbwxbZGE/RAsOBSH0ywIAzfwkmon4d\nbuS1Ir5rCTbTrbnHbXa9pZsV6JPwn+B7hUUsTZV/9T32\n-----END ENCRYPTED PRIVATE KEY-----\n",
            "signature-public-key" : "-----BEGIN RSA PUBLIC KEY-----\nMIIBCgKCAQEAuiAc8TiNgpkp6v6eELcuibJue6zMSGlZxTykrzmuGoU2BDVsUyNf\nelMM/7/hj7XGI6SDiNWthjAftv5zA9wdGENvTdWQus22XZYLcbWCQYpgp67IoJro\nRA9fibQm9UM34X4orLW71Op49WOkoTKGj2bGnlxPsMBcpY/VqAL7dWqus8JpJJPZ\nMFPZIoXWr97UAc81fgiQL9I/zkMhwu6Vo7MLiyCOmo5zCtp+5te5XDT84ixVJZ1v\n49OAHknCgy6Qr1lsQtRTm5Vejwpej6ZgTt9PKm4bzcy2YUeDHiiRl/keR93oRvh3\nS6OIrKI8Iqy11s+kGuCxgnWr4gs4e2Y5RwIDAQAB\n-----END RSA PUBLIC KEY-----\n"
        },
        "{24148871-5e96-471f-a6b9-2816dfaeb988}" : 
        {
            "active" : true,
            "key_base64" : "pCHX5ISbiAHe+ZsgHMJ91qTf+A+O/WB71OcWDnhd9nMBJRCq57FeP7v5XZfu3cMunfE5Wd8e67K+MydwCONPCe5HL4MFbYCDKBkoA7YaN2Orh3Rq8+v6gDya2fGV75Cp",
            "name" : "Admin",
            "password-algo" : "SHA-512",
            "password-hash_base64" : "yV0xT6cab2eUC3cdAcJTa/xvnbpfO6RnJBobnRAFS2LVeRoHm3uZv8jgl6sSnqdkBpX/swFTjVR79RCB/ldjGg==",
            "role" : "admin",
            "signature-private-key" : "-----BEGIN ENCRYPTED PRIVATE KEY-----\nMIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIcA34u9TY6bECAggA\nMAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBCYbgXDKYP3/zVUVeO5oXCnBIIE\n0IPPJ5K39MbEziEt7ppuMNRURLXrNbLicEiNKETnSyQfTFI2Ha7Rzvq6+wNRi5+x\nzCuYFD/1Gdtd5Om7Qr5kQ46HJmAwN9RDa0Dvx3xuY6/4J8BeRTyKjzxkwgH8VkVo\n5idh+oDb87A64qVMflGihLuKVMARhKLN0SFUlqlx7XD3Bc0AJbKDzjnotCot52wi\nxpi/JBXgHnpHZEEp7T45uf98+ERF9qFd6hF+ANMTSJz/oiudnVdk71AHVDxUsXhs\nf+6RSonZ4vakeB/FJc5vlw2wHVUYrOMQdovJ4gJYjUuqmOPygpbg8QTBczkXMzzG\n35nYFHd9nSVzyWPCy/fkewjPQB/eGk0DrhKvSqrcsICknOAphIiHsJyl8sVHUNXZ\nCLJHB+nGtRANtSdLYUkOM1v0rwtijBrRthweyUzoaQmoW5UPzyCKjObVLrGvXIqz\n7eoz4AhYYSllHb1nnuCtVX27TcqnQ8vxk6MGx5Ore4JUBLIRKg4OY9MGGq8Fd5qU\nbgg2ADEuaPK8vGTTNltExPdhhTf+Rw8PnlxdSSua3EKk0uGvceCdkYBJ4O5ws32r\nwtUpa7xEYIQvi3MsVOvPj/ShSzqNOUxX42PMwOXqzEpTbf/qZnF/Z0q3KkwbStzU\nfOu95SKtKLaNugI+e4zkF1Gkxfnb02nqD5TG2PIUDScGJsRCTzc8jua9KJiYUDNb\nsACDfIetjLQdDUgNkDG6GPbUOIzDjlFfvY9LrQnHj1m2GrYSUQKqSBsgR5QtXJzC\nVlka24G/58MGLVucUkyuu2OCmEuTB7QOa7I2RFrQVWqD+BhT276zeUwwET/z6nv/\neiwspThZyv1V9PJHy9vD4Loyr/o4cLi2LB7WnBG2uXpBoGbgpZqzF967NtVfyst+\niCPtKMM8cHkmtYM/6OtVF5YGjLbWoMYw3YBhCX9Ad+K/+UhR2DdkYWKbakLWXWdl\nhqr/dxzhy3RLDP9ZIjtzo/WiJHl6Y1djqSgqcIFVKMBR3jQmuJbhUppFjmO6ricO\nZszN7u/P4yCpsyNHtE8cuBdv1l2oI4UQPhgA2WNgs3zHyZKA3VDTbGSMPBRnt0WY\ncTAMG/HOV4YSG2IHLdFUPp8QNRrq52VeeEGBuV1m0eMBt89h8xMjBK6sEAH2PFFw\n9O1YwefMgf2qVk4LX3yKPb57elXlF/BUKYrVvXUH4rO56BsAJv9r5iPh5RLocymG\nFzzOPsY/i39GXtPSF/bbHyc20KYpOdK9JYLljCYr0cILuKeKbkslY/iCa+CggSZr\nytjhOPEYzkcwYCf+7lJxkeOB0S09rqG9pENFesHJLPkHFGw4lVVLS7AdprAxv1sf\niSXasc4Lh9O1IfD6DPNIBCneowxYCGC+JWCFjtDzp8jpUrEszWibybMq/sGBy2Oy\nHt3d8fo2h080Hc5bfbUmkBRTDbGZmMzLUwJCa1kOzdI3xiw5OAO3wZW4B0yn+gHP\nsNpNfXSnxb6hxQZ2aqesA0M5mAxQ4QPaxYNPNDlCXJC71KkqIphb/+H7MgJeGJPX\nYu3HN8q2I5K1Idp0Wu6jCKfjbwFZcGVIUa7Az7dH1Ufm9GyLYlknRHDebh48lTI6\nhSAcwj9hQPV6We0pxveBpJ7sWsACL84q+oYZg5m/6OkH\n-----END ENCRYPTED PRIVATE KEY-----\n",
            "signature-public-key" : "-----BEGIN RSA PUBLIC KEY-----\nMIIBCgKCAQEA2nmwRSuhJrSQlq92vgf6RMUOdqr0ea6J4bNQcjEDAtFhSirn/Dv7\ndS317cxmVGsAKKx33gCs89Qvyz86x0fvOSiK6YzH5KI3as9Mdz2FCG0M0pGtiXhI\nT23RHli3bgKolFGQGMj4P5Cup6Sj7VeCd1tXBwtjEsRplkjQk1l8wrJIxWtqfb6o\nNhuYInF58gtw26E3QQFQr1FHiIm2mPU6TD1poREL7oYdiTseUTuFFmsx7O3W1FET\n4UFQW1/gEJ8ySy+BGN8zdASLnn2+xtTRZw65OyCnQohXHnZzF9/JH5qNdEvS4NiD\nH9E07N/dHYSvrbdF9ZnQmnyp9stRXfqG5wIDAQAB\n-----END RSA PUBLIC KEY-----\n"
        }
    }

I don't see why this would me necessary.

What I tried:

I tried to set "role": "user" of the restricted operator account to "role": "admin". Before entering the password, the program displays the account like an admin account (different profile icon), but after login I still have restricted access to all features. I am assuming, that the permissions are controlled by the roles on the server. It does not make sense to me to include this information in the config file.

What I also tried is to switch the password hashes (Admin <=> Operator) but I was not able to login to the admin user with the operator password and vice versa.

I also tried to switch all other parameters, but I was not able to login to one account with a different password or change the user rights.

My question is: why should password hashes and user roles be included in a config file, if the passwords and rights are checked external by a server... Since all users can access and view this config file, is this a security risk?

Thanks for your answers!

1 Answer 1

1

You have to analyze the authentication protocol of the application.

Maybe the hashes serve indeed no security purposes and are here just for convenience to check the user's password before sending it to the server. Maybe the protocol is a mess and the hashes are sent to the server, the hashes becoming the effectively passwords and thus might be sent unencrypted, or stored unhashed (a 2nd time) on the server. Or maybe it's just a very poorly developed application with lots of stupid useless quirks.

We can only guess, and cannot help you further without more information. But then, once with more information you should be able to get your answers without our help.

To analyze the application's protocol you can start by intercepting it, and read the app's source code if you have access to it or reverse it otherwise.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .