Hacking the Samsung NX300 ‘Smart’ Camera

You can configure the NX300 to enter your WiFi network, it will behave like a
regular client with some open services, like DLNA. Let us see what exactly is
offered by performing a port scan:

megavolt:~# nmap -sS -O nx300

Starting Nmap 6.25 ( http://nmap.org ) at 2013-11-21 22:37 CET
Nmap scan report for nx300.local (192.168.0.147)
Host is up (0.0089s latency).
Not shown: 999 closed ports
PORT     STATE SERVICE
6000/tcp open  X11
MAC Address: A0:21:95:**:**:** (Unknown)
No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ).

This scan was performed while the “E-Mail” application was open. In AllShare
Play and MobileLink modes, 7676/tcp is opened in addition. Further, in
Remote Viewfinder mode, the camera also opens 7679/tcp.

Wait, what? X11 as an open service? Could that be true? For sure it is
access-locked via TCP to prevent abuse?

georg@megavolt:~$ DISPLAY=nx300:0 xlsfonts
-misc-fixed-medium-r-semicondensed--0-0-75-75-c-0-iso8859-1
-misc-fixed-medium-r-semicondensed--13-100-100-100-c-60-iso8859-1
-misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1
6x13
cursor
fixed

georg@megavolt:~$ DISPLAY=nx300:0 xrandr
Screen 0: minimum 320 x 200, current 480 x 800, maximum 4480 x 4096
LVDS1 connected 480x800+0+0 (normal left inverted right x axis y axis) 480mm x 800mm
   480x800        60.0*+
HDMI1 disconnected (normal left inverted right x axis y axis)

georg@megavolt:~$ for i in $(xdotool search '.') ; do xdotool getwindowname $i ; done
Defaulting to search window name, class, and classname
Enlightenment Background
acdaemon,key,receiver
Enlightenment Black Zone (0)

Enlightenment Frame
di-camera-app-nx300
Enlightenment Frame
smart-wifi-app-nx300

A short investigation using xev outlines that the physical keys on the
camera body are bound to X11 key events as follows:

When the camera goes online, it performs a firmware version check.
First, it retrieves http://gld.samsungosp.com:

Request:

GET / HTTP/1.1
Content-Type: text/xml;charset=utf-8
Accept: application/x-shockwave-flash, application/vnd.ms-excel, */*
Accept-Language: ko
User-Agent: Mozilla/4.0
Host: gld.samsungosp.com

Response:

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/html
Date: Thu, 28 Nov 2013 16:23:48 GMT
Last-Modified: Mon, 31 Dec 2012 02:23:18 GMT
Server: nginx/0.7.65
Content-Length: 7
Connection: keep-alive

200 OK

This really looks like a no-op. But maybe this is a backdoor to allow
for remote code execution? Who knows…

Two of the on-camera apps (MobileLink, Remote Viewfinder) open an
unencrypted access point named AP_SSC_NX300_0-XX:XX:XX (where XX:XX:XX
is the device part of its MAC address). Fortunately, Samsung’s engineers were
smart and added a user confirmation dialog to the camera UI, to prevent remote
abuse:

The DLNA service is exposing some camera features, which are queried and
used by the Android app. The device’s friendly name is [Camera]NX300,
as can be queried via HTTP from http://nx300:7676/smp_2_:

DMS-1.50
  urn:schemas-upnp-org:device:MediaServer:1
  [Camera]NX300
  Samsung Electronics
  http://www.samsung.com
  Samsung Camera DMS
  SP1
  1.0
  http://www.samsung.com
  20081113 Folderview
  smi,getMediaInfo.sec,getCaptionInfo.sec
  uuid:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
  
    
      urn:schemas-upnp-org:service:ContentDirectory:1
      urn:upnp-org:serviceId:ContentDirectory
      /smp_4_
      /smp_5_
      /smp_3_
    
    
      urn:schemas-upnp-org:service:ConnectionManager:1
      urn:upnp-org:serviceId:ConnectionManager
      /smp_7_
      /smp_8_
      /smp_6_
    
  
  
  

Additional SOAP services are provided for changing settings like focus and
flash (/smp_3_):

Another service is available for picture / video streaming (/smp_4_):

 version="1.0" encoding="utf-8"?>
 xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  
     xmlns:u="urn:schemas-upnp-org:service:ContentDirectory:1">
    
      
        54723648
        19201080
      
      
        offauto
        auto
      
      
        offauto
        off
      
      
        0
        1
      
      289
      1
      
        highlow
        high
      
    
    
      http://192.168.102.1:7679/livestream.avi
      http://192.168.102.1:7679/qvga_livestream.avi
    
    
  

After triggering the right commands, a live video stream should be available
from http://nx300:7679/livestream.avi. However, a brief attempt to get
some video with wget or mplayer failed.