This particular password works on Firmware version V3.0.01. Different cameras may have different firmwares with different passwords - but I'd guess that they all follow a similar pattern. So the username is root and the password is Aq0+0009 Light Sensor This is hardware sensor to detect LUX. Squashfs-root$python -c 'import crypt print crypt.crypt('Aq0+0009', '9s')' Physical Details - iCamera2 Front - iCamera2 Figure 1: Front Panel 1. I double-checked it was correct by running I patched rc.sethost to skip the call to crypt. The string 9sXicXdz8JrVk is a traditional DES based hash Inside that, I saw root:9sXicXdz8JrVk:0:0:root:/root:/bin/sh Running rc.sethost does various things including writing a passwd file to /mnt/ramdisk/tmp/passwd etc/rc.sethost contains the string passwd Inside, it contains a symlink from /etc/passwd -> /mnt/ramdisk/tmp/passwd The firmware is a modified SquashFS filesystem. Over on my GitHub repo of Sercomm API commands, you'll find a copy of the firmware for the iCamera 1000.Ī contributor to the blog, Paul Chambers, describes how he deciphered the firmware. It depends on the firmware that Sercomm have pre-loaded, but you just need to visit the specially crafted URl: Firmware Trickery The process for enabling Telnet was first published in 2011. The default login name is ' administrator'.Stick paperclip in the reset hole for a few seconds.

As documented in my previous blog post, resetting the cameras is depressingly easy.

Most of the Sercomm cameras have a custom firmware which locks them down. The blog has since attracked 200 comments - as people try to unlock their cameras, and find out what flaws they have.ĭespite my best efforts at contacting Sercomm - the OEM who manufactures the cameras - and the 'security' resellers who irresponsibly sell them to unsuspecting customers, the flaws remain unpatched. Four years ago to the day, I wrote an exposé of the hideous security failings of Sercomm IP Cameras.

Sercomm ip camera software download