camera-hack

KO | EN

gitlite — search

#typescript #ai-agents #ai #dsh-plugin #deepseek-harness #open-source #cli #claude-code #codex #developer-tools #react #windows

★ 17 Open GitHub ↗

🔓 Root shell + persistent hack on a Yoosee/Jortan IP camera (Anyka AK3918EV330) via UART serial + Arduino bridge

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<h1 align="center">
 
 <img src=".github/assets/logo.svg" alt="camera-hack" width="400">
 
 Yoosee Camera Security Research
 
 揭隐目之眼，破万物之网
 
</h1>

<a href="README.md">English</a>
 ·
 <a href="README-zh.md">中文</a>
 ·
 <a href="README-pt.md">Português</a>

<a href="#bookmark-about">About</a>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
 <a href="#warning-security-advisory">Advisory</a>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
 <a href="#shield-vulnerabilities">Vulnerabilities</a>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
 <a href="#globe_with_meridians-affected-brands">Brands</a>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
 <a href="#mag-attack-surface">Attack Surface</a>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
 <a href="#wrench-tools">Tools</a>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
 <a href="#memo-license">License</a>

---

## :warning: SECURITY ADVISORY — READ BEFORE BUYING

**DO NOT purchase Yoosee/Gwelltimes cameras for security-sensitive applications.**

These cameras have **critical architectural security flaws** that cannot be fixed with firmware updates:

- :red_circle: **All video streams are replayed to Chinese cloud servers** (`cloudlinks.cn`, Huawei Cloud, Tencent Cloud) — even on "local only" mode, P2P connections route through China-based relay servers
- :red_circle: **RTSP password = MD5(device_id)** — anyone who knows your camera's numeric ID can compute the stream password. Zero salt, zero randomness
- :red_circle: **No ONVIF authentication** — full camera control (video, PTZ, device info) without any credentials
- :red_circle: **DES encryption with hardcoded keys** — P2P password encryption uses `53a6c99d783a68b1`, same key for ALL devices worldwide
- :red_circle: **814,000+ devices with default passwords** exposed (SRLabs/DeepSec 2017) — `123`, `888888`, `123456`
- :red_circle: **Firmware signed with known RSA private keys** — malicious firmware can be crafted and deployed
- :red_circle: **Zero certificate pinning** — `usesCleartextTraffic="true"`, trivial MITM

**If you already own one**: isolate it on a separate VLAN with no internet access and use RTSP directly.

---

## :bookmark: About

Independent security research on **Yoosee (有看头)** IP cameras manufactured by **Shenzhen Gwelltimes Technology** (深圳技威时代科技有限公司). This project documents vulnerabilities found through independent testing on hardware **owned by the author** — no engagement, no contract, no bounty program. Same firmware, cloud infrastructure, and P2P protocol power consumer IoT cameras sold under multiple white-label brands worldwide.

Gwelltimes, founded in 2012 in Shenzhen, is an IoT video solutions company that manufactures cameras sold under **dozens of brand names globally**. Their Yoosee app has over **50 million downloads** on Google Play and claims **130 million users worldwide** across 209 countries ([source: Tencent Cloud PR, Aug 2025](https://www.prnewswire.com/apac/news-releases/tencent-cloud-announces-full-upgrade-of-aiot-2-0-product-solutions-setting-a-new-all-in-one-standard-for-intelligent-device-development-302525994.html)). Over **7 million cameras shipped annually**. The same firmware, cloud infrastructure (`cloudlinks.cn`), and P2P protocol power all devices — a vulnerability in one brand affects them all.

### Primary Target

| Property | Value |
|----------|-------|
| **OEM** | Shenzhen Gwelltimes Technology (深圳技威时代科技有限公司) |
| **Model** | SC-B21 Dual-Lens PTZ (It-Blue) |
| **Firmware** | 38.02.103, Hardware Ver 2.1 |
| **SoC** | Anyka AK3918EV330 (ARM926EJ-S) |
| **Video** | H.265 1920x2160 (dual lens stitched) @ 15fps |
| **Audio** | G.711 PCM A-law 16kHz mono |
| **WiFi** | RTL8188FU |
| **App** | Yoosee / YYP2P (com.yoosee) |
| **Cloud** | cloudlinks.cn (P2P V5, FPFQ protocol) |

---

## :shield: Vulnerabilities

Organized by **CVSS severity**. See [advisories/](advisories/) for full technical details and PoCs.

### Critical

| # | Vulnerability | CVSS | Description |
|---|--------------|------|-------------|
| 1 | **RTSP password = MD5(device_id)** | 9.8 | Any camera's stream password can be computed from its public device ID. Works for ALL Yoosee cameras worldwide. `tools/rtsp/rtsp_password_gen.py` |
| 2 | **ONVIF unauthenticated access** | 9.1 | Port 5000 responds to all ONVIF queries without WS-Security. Full device enumeration, video profiles, stream URIs |
| 3 | **DES key hardcoded for P2P** | 9.0 | Key `53a6c99d783a68b1` in `libp2pav.so` encrypts ALL device passwords. Same key for every camera on the planet |
| 4 | **Firmware RSA keys leaked** | 9.0 | Private keys for firmware signing available in public repos. Enables crafting malicious firmware updates |
| 5 | **CVE-2025-52085 — SQL Injection** | 8.8 | SQLi via `alarmId` parameter in cloud API. Authenticated users can extract entire database |

### High

| # | Vulnerability | CVSS | Description |
|---|--------------|------|-------------|
| 6 | **Cloud video replay to China** | 8.5 | All P2P connections route through servers in China (Huawei/Tencent Cloud). Video accessible to infrastructure operators |
| 7 | **DoS via ONVIF write ops** | 8.2 | CreateUsers, SetHostname, GetUsers crash the IPC process permanently. Requires physical power cycle |
| 8 | **SmartConfig keys hardcoded** | 7.5 | Realtek PIN `57289961` + Elian AES keys enable WiFi credential interception during camera setup |
| 9 | **Zero certificate pinning** | 7.4 | `usesCleartextTraffic="true"`, no cert pinning — trivial MITM of all app-cloud communication |

### Medium

| # | Vulnerability | CVSS | Description |
|---|--------------|------|-------------|
| 10 | **PTZ control without auth** | 6.5 | ContinuousMove via ONVIF works without credentials — remote camera movement |
| 11 | **Partial unauthenticated RTSP** | 6.1 | `/cam/realmonitor` path accessible without any credentials |
| 12 | **Information disclosure** | 5.3 | Firmware, MAC, DHCP, video sources exposed via ONVIF |

### Legacy / Prior Research

| Source | Year | Finding |
|--------|------|---------|
| **SRLabs/DeepSec** | 2017 | 814K+ devices with default passwords, firmware injection via DNS hijack |
| **SEC Consult** | 2020 | P2P protocol flaws enabling unauthorized access to baby monitors |
| **CVE-2025-52085** | 2025 | SQL injection in Yoosee cloud backend |

---

## :globe_with_meridians: Affected Brands

Gwelltimes operates as an **OEM/ODM manufacturer**. The same firmware and cloud infrastructure (`cloudlinks.cn`) powers cameras sold under many different brand names. **A vulnerability in one brand affects ALL others.**

### Confirmed White-Label Brands

| Brand | Region | Evidence |
|-------|--------|----------|
| **Yoosee** | Global | Official Gwelltimes brand |
| **It-Blue** | Brazil | Sold on Shopee/Shein as "Yoosee ItBlue" |
| **Jortan** | Brazil | Uses Yoosee app (e.g. JT-81610QJ) |
| **Kapbom** | Brazil | Models KAP-S068, KAP-S381 on Magazine Luiza |
| **Basike** | Brazil | 4K cameras with Yoosee app |
| **Dura Well** | Brazil | WiFi cameras with Yoosee app |
| **GNCC** | Global | Amazon bestseller, Yoosee firmware |
| **TECKIN** | Global | TC100 series, Anyka SoC + Yoosee |
| **LETSCEE** | Global | Budget cameras, Yoosee ecosystem |
| **Hiseeu** | Global | Some models use Gwelltimes firmware |
| **ANRAN** | Global | Select models with Yoosee/ICSee |
| **Ctronics** | Europe | Some models, Gwelltimes OEM |
| **BOAVISION** | France/EU | Products explicitly list "APP: iCSee" |
| **NINIVISION** | China/Global | Manual specifies Yoosee app |
| **MvpSecam** | China/Global | Manual: "APP Remote Viewing Yoosee" |
| **DiFang** | China/Global | Manual: "App Name Yoosee" |
| **LS VISION** | China/Global | Manual: "App Name iCSee" |
| **CAMCAMP** | Sweden/EU | Setup requires iCSee app |
| **Cugo** | Global | Manual: "APP YOOSEE" |

### How to Identify a Gwelltimes Camera

1. **WiFi SSID**: Camera broadcasts `GW-XXXX` during setup
2. **App**: Requires Yoosee, YYP2P, or ICSee app
3. **MAC OUI**: `4C:B0:08` (Gwelltimes), `A8:B5:8E` (Bilian/WiFi module)
4. **Cloud**: Connects to `*.cloudlinks.cn` or `*.cloud-links.net`
5. **ONVIF**: Device name starts with `IPC` on port 5000

---

## :mag: Attack Surface

### Network Architecture

```mermaid
graph TB
 subgraph LOCAL["🏠 Local Network"]
 CAM["📷 Yoosee Camera AK3918EV330"]
 RTSP["RTSP :554 H.265 • MD5 auth"]
 ONVIF["ONVIF :5000 ⚠️ NO AUTH"]
 P2P_LOCAL["P2P UDP FPFQ Protocol"]
 end

subgraph CHINA["🇨🇳 China Cloud Infrastructure"]
 RELAY["P2P Relay Servers Huawei Cloud 159.138.x.x Tencent Cloud 49.51.x.x"]
 API["cloudlinks.cn API + Auth + Analytics"]
 PLAYBACK["saas-playback ☁️ Video Replay"]
 FW["upg1.cloudlinks.cn Firmware OTA"]
 end

subgraph APP["📱 Yoosee App"]
 MOBILE["Android/iOS Zero cert pinning Cleartext HTTP"]
 end

subgraph ATTACKER["🔴 Attack Vectors"]
 MITM["MITM No TLS verification"]
 ENUM["ONVIF Enum No auth required"]
 STREAM["Stream Hijack MD5 password"]
 FWMOD["Firmware Mod RSA keys leaked"]
 end

CAM --> RTSP
    CAM --> ONVIF
    CAM --> P2P_LOCAL

style LOCAL fill:#0d1117,stroke:#30363d,color:#c9d1d9
    style CHINA fill:#1a0000,stroke:#f85149,color:#f0f0f0
    style APP fill:#0d1117,stroke:#30363d,color:#c9d1d9
    style ATTACKER fill:#1a0000,stroke:#f85149,color:#f0f0f0
    style RELAY fill:#2d0000,stroke:#f85149,color:#ff7b72
    style PLAYBACK fill:#2d0000,stroke:#f85149,color:#ff7b72
```

### Data Flow

```mermaid
sequenceDiagram
    participant U as 👤 User
    participant A as 📱 Yoosee App
    participant C as 📷 Camera
    participant R as 🇨🇳 Relay Server
    participant CL as 🇨🇳 cloudlinks.cn

Note over A,CL: ⚠️ All traffic unencrypted or weakly encrypted

U->>A: Open app
 A->>CL: Login (HTTP cleartext)
 CL-->>A: accessToken
 A->>R: P2P connect (DES hardcoded key)
 R->>C: Relay connection
 C-->>R: Video stream (H.265)
 R-->>A: Video stream
 Note over R: ⚠️ Video passes through Chinese cloud servers

A->>CL: Cloud playback request
 CL-->>A: HLS m3u8 URLs
 Note over CL: ⚠️ All recordings stored on Huawei Cloud China
```

### Firmware Update Chain

```mermaid
graph LR
    subgraph LEGIT["Legitimate Update"]
        APP2["📱 App"] -->|"Check version"| UPG["upg1.cloudlinks.cn"]
        UPG -->|"RSA + XOR firmware"| CAM2["📷 Camera"]
    end

style ATTACK fill:#1a0000,stroke:#f85149,color:#f0f0f0
    style EVIL fill:#2d0000,stroke:#f85149,color:#ff7b72
    style OWNED fill:#2d0000,stroke:#f85149,color:#ff7b72
```

### Cloud Infrastructure

| Service | Domain | Purpose |
|---------|--------|---------|
| API (China) | `api1.cloudlinks.cn`, `api2.cloudlinks.cn` | Main API |
| API (Intl) | `api3.cloud-links.net`, `api4.cloud-links.net` | International |
| Firmware | `upg1.cloudlinks.cn` | OTA updates |
| IoT API | `openapi-iot.cloudlinks.cn` | Device management |
| Cloud Playback | `saas-playback.cloudlinks.cn` | Video replay |
| Auth | `api-auth.zztfly.com` | OAuth/login |
| Analytics | `collect.cloud-links.net` | Telemetry |

### Extracted Cryptographic Keys

| Key | Value | Usage |
|-----|-------|-------|
| RTSP Password | `MD5(device_id)` | Stream authentication |
| P2P DES Key | `53a6c99d783a68b1` | Password encryption (ALL devices) |
| TEA Key | `UK*@3oKpFlVVnads` | Analytics encryption |
| SmartConfig PIN | `57289961` | WiFi provisioning |
| FW DES Key | `9CAE6A5AE1FCB088` | Firmware verification |
| API Sign Salt | `ExMPAeOctIQC1TeyCZx0WMGzlIJuBACPJpjmujhdghHGa` | Legacy HTTP signing |

---

## :wrench: Tools

| Tool | Description |
|------|-------------|
| `tools/rtsp/rtsp_password_gen.py` | Generate RTSP password for ANY Yoosee camera from device ID |
| `tools/cloud_api/yoosee_api.sh` | Authenticated cloud API access |
| `tools/cloud_api/cloud_dump.sh` | Mass download cloud recordings |
| `tools/onvif_fuzzer/` | ONVIF fuzzer with 52 templates + 364 payloads |
| `sdcard_hack/` | SD card exploitation for root shell |
| `arduino/` | UART serial bridge for hardware access |
| `esp32/` | ESP32 serial bridge + PTZ control |

### Quick PoC

```bash
# Discover Yoosee cameras on network
sudo nmap -sS -p 554,5000 192.168.1.0/24

# Generate RTSP password from device ID (visible in app)
python3 tools/rtsp/rtsp_password_gen.py 5893329321
# Output: b23e87419264687f73e03a88527c85dd

# Stream video (with computed password)
ffplay -rtsp_transport udp "rtsp://admin:b23e87419264687f73e03a88527c85dd@CAMERA_IP:554/onvif1"

# Stream video (no auth path)
ffplay -rtsp_transport udp "rtsp://CAMERA_IP:554/cam/realmonitor"

# ONVIF enumeration (no auth needed)
curl -s -X POST http://CAMERA_IP:5000/onvif/device_service \
 -H "Content-Type: application/soap+xml" \
 -d '<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
 xmlns:tds="http://www.onvif.org/ver10/device/wsdl">
 <s:Body><tds:GetDeviceInformation/></s:Body></s:Envelope>'
```

---

## :file_folder: Project Structure

```
camera-hack/
├── advisories/                 # Formal vulnerability advisories
├── docs/
│   └── sc-b21-recon.md         # Full reconnaissance report
├── evidence/
│   ├── admin_panel/            # Firmware admin panel (Swagger, CVE)
│   ├── apk/                    # APK analysis findings
│   ├── cloud_api/              # Cloud API captures
│   ├── mitm/                   # 120+ MITM flow captures
│   └── tablet/                 # ADB extraction data
├── tools/
│   ├── cloud_api/              # Cloud API scripts
│   ├── onvif_fuzzer/           # ONVIF vulnerability scanner
│   └── rtsp/                   # RTSP tools + password gen
├── sdcard_hack/                # SD card root shell exploit
├── arduino/                    # UART serial bridge
├── esp32/                      # ESP32 bridge + PTZ
├── firmware/                   # Firmware analysis & patches
├── CLAUDE.md                   # Project configuration
├── DISCLAIMER.md               # Legal disclaimer
└── config.example              # Configuration template
```

---

## :books: References

### Research & Exploits
- [t-rekttt/yoosee-exploit](https://github.com/t-rekttt/yoosee-exploit) — Firmware decrypt/encrypt, RSA keys
- [c0decave/yoosee-ipc](https://github.com/c0decave/yoosee-ipc) — Heap overflow PoC, filesystem dumps
- [zzerrg/gmfwtools](https://github.com/zzerrg/gmfwtools) — Firmware manipulation tools

### Prior Art
- [SRLabs — DeepSec 2017: "Next-Gen Mirai"](https://www.srlabs.de/blog-post/next-gen-mirai) — 814K+ exposed cameras
- [SEC Consult — Hacked Baby Monitor](https://sec-consult.com/blog/detail/true-story-the-case-of-a-hacked-baby-monitor-gwelltimes-p2p-cloud/) — P2P protocol analysis
- [CVE-2025-52085](https://nvd.nist.gov/vuln/detail/CVE-2025-52085) — SQL injection in Yoosee cloud

### Hardware
- [Anyka Camera Firmware](https://github.com/MuhammedKalkan/Anyka-Camera-Firmware) — SDK & kernel sources
- [TECKIN TC100 hack](https://github.com/ThatUsernameAlreadyExist/TECKIN-TC100-Anyka-AK3918-camera-hacks) — v4l2rtspserver for Anyka
- [OpenIPC](https://openipc.org/cameras/vendors/anyka) — Open firmware for Anyka SoCs

---

## :balance_scale: Disclaimer

This research is conducted on **personally-owned devices** for educational purposes only. All findings are disclosed responsibly. Do not use these techniques on devices you do not own or without explicit authorization.

See [DISCLAIMER.md](DISCLAIMER.md) for full legal disclaimer.

---

MIT — Gabriel Maia (<a href="https://github.com/gabrielmaialva33">@gabrielmaialva33</a>)

Who's watching you? And who's watching the camera?
 
 谁在看你？谁又在看它？
 
 Quem está te observando? E quem está observando a câmera?

camera-hack

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README