Quartz 4

Identified Attack Profiles

Sat, 23 May 2026 06:29:29 GMT

Hardware: UART Pads SOIC8 Clip/ flash dump SD Card Network: DNS Poisoning ARP…? .

File Contents

Sat, 23 May 2026 06:29:29 GMT

FileContents/ Summarysquashfs-root/etc_default/passwdroot:x:0:0:root:/:/bin/shsquashfs-root/etc_default/shadowroot:$1$d4.uNxFN$0pEViwVp/r2FObKP/LfTE0:15874:0:99999:7:::squashfs-root/etc_default-0/autoboot.shtempsquashfs-root/etc_default-0/anyboot.shtemp.

Flash Dump

Sat, 23 May 2026 06:29:29 GMT

There is no way to interact with the camera over the network by default. The flash chip contains the entire OS, application, and config.

Hardware Identification

Sat, 23 May 2026 06:29:29 GMT

Hardware Summary: ComponentDetailsSoCMStar SSC333 (Sigmaster i6b0)BootloaderU-Boot 2015.01 (August 24 2021)FlashWinbond W25Q64 - 8MB SPI NORRAM64MBKernelARM Linux 4.9.84, LZMA compressed Disassembled the camera: Bottom of camera Power and base motor controller Horizontal/base motor and vertical/ cam...

Initial Exploration

Sat, 23 May 2026 06:29:29 GMT

Camera was already configured to join an older Verizon router.

Network Discovery

Sat, 23 May 2026 06:29:29 GMT

Plugged Verizon router into PC, monitored traffic on that network using wireshark Camera had an IP of 192.168.1.157, MAC address of {TODO} (Xiamen Sigmastar) TLS 1.2, MQTT on Port 8883 Ran full port scan (all 65,535 TCP, top 100 UDP)- all closed.

Telnet Root

Sat, 23 May 2026 06:29:29 GMT

Cloud state: config.cfg: cloudtoken, clouddid, secret are all blank No connections to any cloud server (internet disabled) viCam Behavior: Port 9008 listening on localhost Custom binary protocol, not HTTP, something custom Won’t make cloud connection until registered on the app AP mode and QR code p...

UART Boot Logs

Sat, 23 May 2026 06:29:29 GMT

Wired CP2102 → Board: Ground → Ground RX → TX TX → RX Plugged CP2102 UART Adapter into PC Used MobaX Term to open a serial connection Used COM port on Windows with CP2102 Speed: 115200 Full Boot Logs: Autoboot requires password From binary, found bootstopkeysha256 Ran rockyou.txt through SHA256 to ...

index

Sat, 23 May 2026 06:29:29 GMT

Identified Attack Profiles Initial Exploration Hardware Identification Flash Dump UART Boot Logs Network Discovery Neat Things Found: in squashfs-root/etc_default/inittab, there is a line that says: Copyright (C) 2001 Erik Andersen and the site is still up Erik Andersen...