Trying to Download Video on My Ipad From Google Photos and It Says Oops Try Again

I was recently given 3 rather locked-down network cameras. Each camera was pre-programmed to communicate with a specific website, and only attach to a predefined wireless access point. Naturally, in that location was no supplied username or password.

I thought about how I might get access. Using a man-in-the-heart assault to sniff the password, or trying to dump the firmware and examine that. Sadly, all the vulnerabilities previously reported no longer piece of work. After a little chip of idea, I went for decided low-tech solution; I hit the reset button! Aye, each camera had a recessed switch, accessible only with a paperclip, which reset the device to manufactory settings after holding it down for 10 seconds.

Anyway, this is my voyage of discovery with the three cameras. They are:

All of them are manufactured by Taiwanese OEM Sercomm. Annoyingly, Sercomm don't accept whatsoever customer services. They mostly resell the cameras to Linksys, Cisco, Xanboo.

SerComm don't offering any firmware, GPL downloads, or much information nigh the cameras - so it's all very much trial and error.

Defaults

After resetting the cameras, they'll happily attach upwards to any wired network via the Ethernet port. Visit the IP accost assigned by DHCP and you'll become to the admin panel.
The default username is "ambassador" - at that place is no password gear up.
You can now go and fiddle with all the settings.

Loftier Resolution Style

The cameras are meant to be able to record at 720p - yet the user interface doesn't seem to allow it.

Luckily, the API allows us to force the resolution.

http://192.168.0.42/adm/set_group.cgi?group=H264&resolution=4

http://192.168.0.42/adm/set_group.cgi?group=JPEG&resolution=iv

Wait! What? API?!

Oh yes, all the cameras come with a multifariousness of commands which can be controlled past simple a HTTP GET request.

Discovering The API

As I said previously, Sercomm provides no documentation. Luckily, their resellers do!
EyeSpy247 have the admin transmission for the RC8221.
Use-IP accept the admin manual for the OC821D.
I haven't yet found a manual for the RC8230 - only information technology uses most of the same API commands. The only main add-on is the ability to motion the photographic camera via its pan/tile functionality. Later a fleck of digging, I establish a discussion on how to activate this functionality.

Up:

http://192.168.0.42/pt/ptctrl.cgi?mv=U,10

Downwardly:

http://192.168.0.42/pt/ptctrl.cgi?mv=D,x

Left:

http://192.168.0.42/pt/ptctrl.cgi?mv=50,11

Right:

http://192.168.0.42/pt/ptctrl.cgi?mv=R,11

The manuals give all sorts of instructions, how to view video streams, get photos, set and get diverse options. In that location are, sadly, some omissions.

Sending Sounds

One of the tasks I wanted to accomplish was to make the cameras play some of the turret sounds from the video game "Portal". This is proving tricky, despite the manual'southward promises to the contrary.

Information technology should exist possible to POST an sound file to the cameras, either in Thou.726, or G.711 (a-police or u-law). Despite creating the sound files correctly, and POSTing them to the cameras - they make not a peep!

gyre -vv --data-binary @alaw8k.wav http://user:pass@192.168.0.42/img/g711a.cgi

curl -vv -10 POST -d @alaw8k.wav http://user:pass@192.168.0.42/img/g711a.cgi --header "Content-Type:audio/x-wav"

I get a 200 OK, and the volume is set on the camera. Near vexing!

If yous remember yous can help, delight get out an answer on StackOverflow.

Arming - or lack thereof

With my other cameras, I tin transport a control to arm or disarm. I don't demand the motion detection to send me emails every second of the day - only when I'thousand out of the house.

Looking at the source code of one of the pages, it looks similar it's possible to Mail service some data to /adm/file.cgi - but it's not conspicuously documented which parameters are required. It will take me some time to work through the tangled nest of JavaScript.

Email

The cameras volition send video when they detect motility - although getting this to work isn't at all obvious.

Firstly, the password is hard-coded to exist a maximum of sixteen characters. If your countersign is "StarTrekIntoDarkness1" you're out of luck.
Secondly, the "Test the Server" button doesn't really work. It randomly gave me errors nigh not being able to reach the server. I struggled for hours until I discovered that the error messages were lying to me! If you enter the details correctly, and the camera has access to the Net, it should just work.

That said, once enabled, it will happily send emails with big video attachments to yous.

Video Audio

All the cameras have microphones, and all do audio triggering (sending an alert when noise levels ascent). Yet none of the cameras would embed audio in with the video. When streaming over RTSP, information technology was possible to selection upward audio from the microphone. Lowish quality, 8kHz, mono - but better than nix.
Once more, if anyone knows how to get the alert videos to include audio, please let me know!

Motion Detection

Setting the motion detection expanse is very useful. You might desire to ignore movement on the floor if y'all accept a pet, or concentrate on a door handle. Sadly, with these cameras, y'all accept to use IE6 or greater to set the detection expanse.

You can try and use the API to set areas - but without being able to see the expanse in question, it's an exercise in frustration.

For my needs, having full screen video detection is fine. I may have to infringe a Windows machine if that changes.

Open Source

Each camera has an embedded Open Source page at /adm/Licenses.txt which includes all the text of the relevant GPL etc.

All iii cameras take the following Open Source components:
Davicom Ethernet driver
Linux kernel ii.vi.18
wireless_tools 26
busybox ane.sixteen.0
dhcpcd 1.3.22-pl1
ez-ipupdate 3.0.11b7
iptables 1.3.four
ppp ii.four.1
cron daemon
samba client three.06
glibc ii.8
alsa-lib-1.0.16
wpa_supplicant 0.4.5
NTP
thttpd-2.25b

Interesting to note that BusyBox is an unstable release version from 2010, thhtpd supports IPv6 even though the cameras don't announced to.
wpa_supplicant is aboriginal - that may explain why information technology can't cope with SSIDs with spaces in them. I presume it's the hardware which won't browse the 5GHz range.
The Linux kernel is from 2006 - that's common enough in embedded systems, but I exercise wonder if information technology presents a security risk.

Security

The cameras offer an SSL connexion. Still, the certificate is self signed and uses MD5 with 1024 bits. Basically, a security signing which was advised against in 2010.
There's no way to supplant the certificate without replacing the firmware. If you are willing to trust information technology, the connection is secured via SSL.

Assuming you can confirm the certificate is correct, the encryption should exist sufficient to cease anyone but the NSA peeking through your cameras.

That said, the RTSP channel isn't protected by SSL. You tin requite a username/password, set fourth dimension of day access, and restrict to specific IP addresses - but the video is transmitted in the clear.

For now, I'm keeping my cameras on my LAN with no external admission to them.

What Next

At the moment, I've set the cameras up, but I'm non actively monitoring them - it'due south simply as well much work to switch each of them on when I go out for work.

So, if you can help....

1. How do I send sound to the cameras?
2. How practice I become audio with the video alerts?
3. How do I arm the cameras via the API?

rinaldisionen.blogspot.com

Source: https://shkspr.mobi/blog/2013/11/hacking-around-with-network-cameras/