Finding (and exploiting) vulnerabilities on IP Cameras: the Tenda CP3 case study

Dario Stabili,Tobia Bocchi,Filip Valgimigli,Mirco Marchetti

2024-06-24

Abstract:Consumer IP cameras are now the most widely adopted solution for remote monitoring in various contexts, such as private homes or small offices. While the security of these devices has been scrutinized, most approaches are limited to relatively shallow network-based analyses. In this paper, we discuss a methodology for the security analysis and identification of remotely exploitable vulnerabilities in IP cameras, which includes static and dynamic analyses of executables extracted from IP camera firmware. Compared to existing methodologies, our approach leverages the context of the target device to focus on the identification of malicious invocation sequences that could lead to exploitable vulnerabilities. We demonstrate the application of our methodology by using the Tenda CP3 IP camera as a case study. We identified five novel CVEs, with CVSS scores ranging from 7.5 to 9.8. To partially automate our analysis, we also developed a custom tool based on Ghidra and rhabdomancer.

Cryptography and Security

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the security analysis of consumer IP cameras (especially the Tenda CP3 model), identifying and exploiting remotely exploitable vulnerabilities. Most of the existing methods are limited to relatively shallow network - based analysis, while this paper proposes a more in - depth method, including static and dynamic analysis of executable files extracted from IP camera firmware. This method not only considers the specific usage scenarios of the target device, but also focuses on identifying malicious call sequences that may lead to exploitable vulnerabilities.

Specifically, the goals of the paper can be summarized as follows:

1. **Propose a new security analysis method**: This method combines static and dynamic analysis techniques and pays special attention to the actual usage scenarios of the device.
2. **Identify new vulnerabilities**: Through the above method, the authors discovered five new CVEs (Common Vulnerabilities and Exposures) in the Tenda CP3 IP camera, with CVSS scores ranging from 7.5 to 9.8.
3. **Develop an automated tool**: To partially automate the analysis process, the authors developed a new tool based on Ghidra and rhabdomancer to identify data functions for handling network connections, build a list of call sequences, and correctly identify the threads responsible for each call sequence.
4. **Demonstrate practical applications**: Using the Tenda CP3 IP camera as a case study, the effectiveness and practicality of the proposed method are demonstrated.

### Overview of the main steps

1. **Information collection**: Obtain information about the target IP camera from public and open sources, such as high - resolution circuit board pictures provided by the FCC ID search service and firmware copies in the firmware repository.
2. **Physical disassembly**: Obtain physical access to the target IP camera, disassemble the device to obtain a direct low - level interaction interface (such as USB ports, JTAG or UART protocols) for the internal circuit board.
3. **Firmware extraction and analysis**: Extract the firmware from the memory chip through the diagnostic interface or an external reader, and perform common static analysis to identify relevant partitions, configuration files, scripts, executable files and encryption materials.
4. **Dynamic behavior analysis**: Combine the static analysis results to perform dynamic analysis of the device's behavior on the network, focusing on the main network services to quickly identify potential vulnerabilities.
5. **Reverse engineering and vulnerability identification**: Perform detailed reverse engineering on all executable files implementing network services, use the developed tool to automatically identify functions for handling network data and their call sequences, helping researchers quickly analyze the entire function call chain, identify potential vulnerabilities in the code and design corresponding exploitation methods.

Through these steps, the paper shows how to discover and verify multiple serious vulnerabilities through in - depth analysis of the Tenda CP3 IP camera, thereby increasing the understanding of the security of such devices.