Wyze Cameras - Keeping Honest Vendors Honest - Part II – Test Results

By Tony Lee

Quick Recap from part I in the series:
It can be difficult for a security nerd to inherently trust cloud vendors and products that do not keep all data on-premises—especially when it comes to home automation IoT devices such as cameras since they can record sensitive data. One such product with excellent reviews, ample capability, and a very reasonable price is the ever-popular Wyze Camera. So, I snatched up a Wyze Cam v2 triple pack that went on-sale, but became concerned after reading reviews and even a Reddit thread found here (https://www.reddit.com/r/wyzecam/comments/beq0sk/do_you_trust_wyze/) and here (https://www.reddit.com/r/wyzecam/comments/7cykgf/wyzecam_sending_data_to_servers_other_than_aws/) mentioning the data is possibly going to China. Note: while no country is perfect, not all countries condone state-sponsored corporate espionage and mass general population data collection.  Just sayin...

One positive note at the time was that it seemed that the manufacturer was chiming in on the Reddit threads explaining that they attempted a fix and that they needed someone to test again. So, in order to test the validity of the reviews and to help answer WyzeTao in the second article:  “We are asking help from some Reddit forum helpers to help check.”, we needed to set up our own environment.  This blog series outlines both the setup involved and then the results.
If you are setting this up yourself, you should refer to Part I - Setup here:   http://www.securitysynapse.com/2019/07/wyze-cameras-keeping-honest-vendors-honest-I.html

Spoiler:
Our camera arrived with firmware version 4.9.2.52 (Release date: October 22, 2018) and we upgraded to the latest version at the time of: 4.9.3.64 (Release date: December 17, 2018). We found that the other reviewers were correct in that the data was going to China (and other countries) due to a content distributor that Wyze uses—however, after working with the very responsive manufacturer, Wyze corrected the issue for everyone. So a huge thanks goes to Tao And Martin at Wyze for their great handling of this responsible disclosure.  Now, please update your mobile app and camera to the latest version (or newer) found below :-)

Corrected Versions:
Mobile app:  V2.4.24 (release date:  July 9th, 2019)
Wyze Cam v2 Firmware V4.9.4.108 (Release date: July 8, 2019)  <-- Update your camera firmware!

Traffic Analysis

After completing the setup in Part I of this series and opening wireshark, it is now time to analyze the traffic. We mentioned previously that we set a display filter (ex:  ip.addr==192.168.8.214) to narrow in on only traffic to and from the Wyze Camera.

Figure 5:  Wyze Cam v2 traffic

As you can see, the Wyze Camera is making DNS requests for:

• gm.iotcplatform.com
• cm.iotcplatform.com

These FQDNs resolved to the following IP addresses:
gm.iotcplatform.com

• 52.79.197.188
• 50.7.98.242
• 198.16.70.58

cm.iotcplatform.com

• 120.24.59.150

Using MaxMind GeoIP2, these IPs are located in the following countries:

Figure 6:  GeoIP resolution

This leaves us with the following:
gm.iotcplatform.com

• 52.79.197.188 - Incheon, South Korea - Amazon.com
• 50.7.98.242 - Los Angeles, United States - FDCservers.net
• 198.16.70.58 - Amsterdam, Netherlands - FDCservers.net 

cm.iotcplatform.com

• 120.24.59.150 - China - Hangzhou Alibaba Advertising Co.,Ltd.

Traffic Sent

If you were wondering if actual camera traffic was sent through China (via 120.24.59.150), it was indeed.

Figure 7:  Traffic sent to China

That said, the data by default does not use RTSP and could not easily be interpreted. Per Wyze, “The contents are encrypted via AES 128-bit encryption to protect the security of the live stream and playback data. During the connection process, every device in the process has its own secret key and certification, so that we can validate their identity during handshake. Even if a hacker intercepts the data package, the data cannot be decrypted.”

Source:  https://support.wyzecam.com/hc/en-us/articles/360009314072-Security-Privacy- 

Working with Wyze

After reporting the issue to Wyze tech support, they were extremely professional and concerned that the previous patch did not work. They worked quickly to provide a solution and test firmware (test version 4.9.4.44) that appeared to fix the issue.

Instead of the previous firmware querying "gm.iotcplatform.com" and "cm.iotcplatform.com", the new firmware queries "us-master.iotcplatform.com".  Just to be thorough, we let it run a bit and monitored for other traffic and found the following:

api.wyzecam.com

• 34.208.107.136
• 35.161.164.220
• 35.167.190.246

wyze-iot.s3-us-west-2.amazonaws.com

• 52.218.160.49

a24rq1e5m4mtei-ats.iot.us-west-2.amazonaws.com

• 35.160.15.131

us-master.iotcplatform.com

• 50.19.254.134
• 50.7.98.242

Figure 8:  New GeoIP results

Conclusion

The initial contact took a little while, however over a one month period of working with the vendor, they were able to correct the issue. The level of detail and follow-through was greatly appreciated. Wyze engineers took our concerns seriously and delivered an acceptable solution. Based on our interactions, they appear to be an honest and transparent company that is focused on doing right by their customers. That is just one more reason in my book for us to purchase more Wyze cameras.


Disclaimer:  We do not work for Wyze (or any of the vendors mentioned) and do not benefit from this article in anyway. All cameras were purchased the same as anyone else.  We do like their customer service, quality of the goods, and prices though.  :-)

Wyze Cameras - Keeping Honest Vendors Honest - Part I - Setup

By Tony Lee

Background:
It can be difficult for a security nerd to inherently trust cloud vendors and products that do not keep all data on-premises—especially when it comes to home security/automation IoT devices such as cameras since they can record sensitive data. One such product with excellent reviews, ample capability, and a very reasonable price is the ever-popular Wyze Camera. So, I snatched up a Wyze Cam v2 triple pack that went on-sale, but became concerned after reading reviews and even Reddit threads found here (https://www.reddit.com/r/wyzecam/comments/beq0sk/do_you_trust_wyze/) and here (https://www.reddit.com/r/wyzecam/comments/7cykgf/wyzecam_sending_data_to_servers_other_than_aws/) mentioning the data is possibly going to China. Note: while no country is perfect, not all countries condone state-sponsored corporate espionage and mass general population data collection.  Just sayin...

One positive note at the time was that it seemed that the manufacturer was chiming in on the Reddit threads explaining that they attempted a fix and that they needed someone to test again. So, in order to test the validity of the reviews and to help answer WyzeTao in the second article:  “We are asking help from some Reddit forum helpers to help check.”, we needed to set up our own environment.  This blog series outlines both the setup involved and then the results.

Spoiler:
Since this is a two part series and we want readers to benefit from the latest security enhancements, we are providing a spoiler in the first article. Our camera arrived with firmware version 4.9.2.52 (Release date: October 22, 2018) and we upgraded to the latest version at the time of: 4.9.3.64 (Release date: December 17, 2018). We found that the other reviewers were correct in that the data was going to China (and other countries) due to a content delivery network that Wyze uses—however, after working with the very responsive manufacturer to test and retest, Wyze corrected the issue for everyone. So a huge thanks goes to Tao And Martin at Wyze for listening to customer concerns and their great handling of responsible disclosures. Now, please update your mobile app and camera to the latest versions (or newer) found below :-)

Corrected Versions:
Mobile app:  V2.4.24 (release date:  July 9th, 2019)
Wyze Cam v2 Firmware V4.9.4.108 (Release date: July 8, 2019)  <-- Update your camera firmware too!

Figure 1:  The ever-popular (and pretty awesome) Wyze Cam 1080p HD Indoor Wireless Smart Home Camera

Test Environment

The hardware and software in our environment is a mixture of what we had on hand and what was required to compensate for lack of existing features.  Also keep in mind that there are quite a few ways to test these devices, however we are presenting just one of the solutions here.

Hardware:

• Wyze Cam v2
• eero Pro WiFi System (Set of 3 eero Pros) – 2nd Generation
• GL-iNet AR750s
• Standard laptop
• USB Ethernet adapter

Software:

• Windows 10 base OS
• Kali Linux OS running in VMWare Workstation with USB ethernet adapter connected as pass through

Quick Note on Limitations of Mesh Routers (Including the Eero Pro WiFi System)

One potentially tricky scenario in monitoring wireless traffic on a mesh network is determining the AP to which the device connects and keeping it on that AP. To avoid that issue, ideally it should be simple to monitor the last hop AP that connects to the source of Internet (cable modem in our case), but this is not always a provided feature. It certainly isn’t a feature in the Eero Pro. Don’t get us wrong, the Eero hardware and reliability makes it one of the best mesh setups around, but the lack of advanced features is depressing—especially for the price tag (~$500) (https://www.amazon.com/eero-Home-WiFi-System-Beacon/dp/B071DWXLYL/). Maybe things will change after the semi-recent Amazon acquisition (https://www.theverge.com/2019/2/11/18220960/amazon-eero-acquisition-announced).  Fingers crossed!

Figure 2:  Typical Mesh network diagram (courtesy of Eero)

Work Around to Sniff Wireless Traffic

Since the Eero woefully lacks a way to route the traffic to a SPAN port, we purchased a GL.iNet GL-AR750S-Ext Gigabit Travel AC Router (https://www.amazon.com/GL-iNet-GL-AR750S-Ext-pre-Installed-Cloudflare-Included/dp/B07GBXMBQF) to do so.  The impressive stats on this compact device are as follows:

• Dual band AC750 Wi-Fi: 433Mbps(5G) +300Mbps(2.4G)
• QCA9563,@775MHz SoC
• 128MB RAM, 16MB NOR Flash and 128 MB NAND Flash
• Up to 128GB MicroSD slot
• USB 2.0 port
• Three ethernet ports (1 WAN, 2 LANs)
• Powered by Micro USB 5V/2A power supply
• And best of all:  OpenWrt pre-installed

Configuration and Setup

Now that we know the hardware, let’s jump into it.

Wiring:
 1) Cable Modem --> Wireless router --> Wireless Mesh receiver --> Hardwire to WAN port of AR750s
 2) AR750s Switch port --> USB ethernet adapter (connected to Kali VM)

Figure 3:  Wiring and configuration

First configuration of the router:

• Power up the router
• Connect wirelessly using the supplied wireless SSID and default password: goodlife
• Upon connecting to the web UI (ex: http://192.168.8.1) you will be required to set a password for the router admin

Figure 4:  Web UI that shows the Wyze Cam v2 target and the Kali host to send the SPAN data

Setting up a SPAN port:
 Putty or SSH to router (ex: 192.168.8.1) with proper credentials (ex:  root:<password set above>)
 - Run the following to set up a SPAN port:

Syntax to setup a SPAN port:
iptables -t mangle -A PREROUTING -j TEE --gateway <IP of Kali VM>
iptables -t mangle -A POSTROUTING -j TEE --gateway <IP of Kali VM>

Example (where our Kali VM IP is 192.168.8.217):
iptables -t mangle -A PREROUTING -j TEE --gateway 192.168.8.217
iptables -t mangle -A POSTROUTING -j TEE --gateway 192.168.8.217

NOTE:  If you get the following error:
iptables v1.6.2: unknown option "--gateway"

 - Run the following and then the iptables commands again
opkg update
opkg install iptables-mod-tee kmod-ipt-tee

Figure 5:  SSH into the AR750S and setting up the SPAN port to go to the Kali Linux host (192.168.8.217)

Sniff Traffic:

• Open Wireshark and sniff on the same interface specified above and you should now see all traffic to and from the AR750S.
• Pro-tip:  Use a filter in Wireshark to limit traffic to just the device you want to monitor (in our case it is the Wyze Camera)
• Ex:  ip.addr==<IP ADDRESS>

Conclusion

Now that we covered our hardware, software, setup and how to create a SPAN port of the AR750S wireless traffic… we are ready to cover our findings.  But, we will save that for Part II of the series found here:  http://securitysynapse.blogspot.com/2019/07/wyze-cameras-keeping-honest-vendors-honest-II.html

Microsoft Bug? Shift + Delete does not generate 4660 Event

By Tony Lee

If you have ever searched for anything along the lines of:  "How do I discover who deleted a file", you will probably find a dozen articles or more telling you to check for Windows Event ID 4660.

Some examples of excellent search results and resources can be found below (lmgtfy):

• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4660
• https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660
• https://eventlogxp.com/blog/tracking-down-who-removed-files/

Then the article will most likely mention that Event ID 4660 lacks the object name (son of a biscuit!) and you will need to map the event using the handle ID to Event ID 4656 or Event ID 4663 (with an Accesses=DELETE).  No problem, we've got this.  But what do you do if 4660 is not always created? This can happen!  (Dun... dun... duuuuunn.....)

Discovery

There are obviously multiple ways to delete a file such as the following:

• Delete key
• Right Click > Delete
• "del" from a command prompt
• Shift + Delete

Every single method above generates a 4660 (and 4663) except the last one, Shift + Delete, which happens to be my personal favorite way to to delete a file.  :-(  Delete it like you mean it...

Test Methodology

The discovery was frustrating and quite accidental. While deleting files, we noticed that no 4660 (or even 4663) logs were being created when we used Shift + Delete. In utter disbelief, we set up the following to prove our sanity:

• Enable all necessary auditing (lots of articles on this)
• Open Event Viewer > Windows Logs > Security > Filter Current Log > 4660 in the filter box
• Create 4 text files in which you will delete using the methods above
• Delete one file at a time and wait for Event Viewer to notify you of a new log
• Notice that Shift + Delete DOES NOT GENERATE A 4660!

Figure 1:  Test methodology shown above with Event Viewer, filters, notifications, and four files to delete

Conclusion

We all know that Windows logging is horrible, but this one takes the cake. It just seems scary that holding down shift while pressing delete will omit the log whose entry starts with: "An object was deleted." One possible work around is enabling the ever noisy Event ID 4656 and filtering that down--which still has its own pitfalls. Anyway, we hope this article helped debunk the myth that using Event ID 4660 for detecting file deletes is reliable (regardless of the name of the log entry).

Sample Logs

Some sample logs from our friend Randy Franklin Smith:

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663#examples

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4660#examples

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4656#examples

Forensic Investigator Splunk App - Version 1.1.4

By Tony Lee

Introduction

Our last release, version 1.1.3 was a pretty exciting release with new tools such as the chat program, link extractor, and various monitoring tools.  This time we focused on adding host enumeration tools that can be useful when trying to discover information about a remote host.  In addition, we have added a bulk search option that allows users to search on a list of items such as MD5 hashes, IP addresses or URLs for example.  Here is what we have in store for you in version 1.1.4 which is now available for free via the Splunk App store.

High Level

New Features in v1.1.4
 - Updated Investigator Chat 2.0!
 - Added Ping tool (Host --> Ping)
 - Added SMB Share Viewer (Host --> SMB Share Viewer)
 - Added NetBIOS Viewer (Host --> NetBIOS Viewer)
 - Added Port scanner (Host --> Port Scanner)
 - Added Banner grabber (Host --> Banner grabber)
 - Added Bulk searching of data using any field (Toolbox -> Bulk Search - Wild)
 - Added Bulk searching of data using a specific field (Toolbox -> Bulk Search - Field)
 - Added ASCII Table cheatsheet (Toolbox -> Cheat sheets -> ASCII Table)
 - Added Ports and services cheatsheet (Toolbox -> Cheat sheets -> Ports and Services)
 - Added subnetting cheatsheet (Toolbox -> Cheat sheets -> Subnetting)

Maintenance in v.1.1.4
 - Renamed the xml files to increase simplicity

Investigator Chat 2.0

The chat program received a pretty slick upgrade that makes it much more functional and easier to use.  Big thanks to Kyle for that upgrade.  It now lacks the annoying 5 second refresh rate.

Host Tools

Secure environments will lock down command prompts and restrict access to certain tools--thus it can be useful to have some host enumeration tools that can be activated through Splunk to query remote hosts.

Ping Tool

This is the simplest tool to reach out and see if the host is alive.  The assumption is that ICMP is not blocked at the network or host.

SMB Share Viewer

It can be nice to check for Windows shares as well.  If run from Windows, it will use net view and will not see "hidden" shares (those that end in a $ sign, such as C$, ADMIN$, IPC$).  If run from Linux, it will use smbclient and will see hidden shares.

NetBIOS Viewer

It is also useful to be able to pull NetBIOS table information from a remote host to determine function, users, domain and more.

Port Scanner

Determining the open ports can also be useful for determining the function of a host.  Unfortunately, nmap or other port scanners may not always be available... so we provided a python based port scanner exposed through Splunk.

Banner Grabber

Taking it a step further, we added a python based banner grabber as well.  It should be able to pull most banners, but let us know if it struggles against a particular service.

Bulk Searching - Wild and specific field

Often we have a large list of MD5 hashes, IP addresses, or URLs to run through Splunk.  We could search one item at a time, but that is slow.  We could create a complex boolean statement, but that takes time.  How about just copying and pasting that list into a search field?  Perfect!  This has been tested with Chrome and Firefox which seems to work best.  The file should contain one search item per line.  When copied and pasted into the Splunk Search list field, the browser should separate the terms with spaces.  There are two versions, one which you must specify the field and one that will search all fields (wild).

Cheatsheets - ASCII table, Ports and services, Subnetting

Finally, everyone can use some cheatsheets.  Quick references such as an ASCII table, ports and services, and subnet information.  No more wasting time searching the Internet--especially if you are on a closed network.  These are now local references available in Splunk.

Conclusion

Hopefully you will enjoy the new features of the app.  As always, we appreciate the great feedback we are receiving.  Please send more ideas from within the app using Help --> Send Feedback.

Forensic Investigator Splunk App - Version 1.1.3

By Tony Lee

Introduction

It has been a little while since we released new features in the Forensic Investigator Splunk App, so we are excited about the latest update.  We have received excellent feedback on the app and have also been brainstorming some ideas for new tools to include.  Here is what we have in store for you in version 1.1.3 which is now available for free via the Splunk App store.

High Level

New Features
 - Added a chat program for collaboration!  It is a first stab, but give it a try (Help -> Chat Program)
 - Added an additional whois lookup vendor - api.hackertarget.com - ex: http://api.hackertarget.com/whois/?q=splunk.com
 - Added a link extractor to rip links out of a page (URL/IP -> Link Extractor)
 - Added permalink information to VT lookup page
 - Added disk usage monitor (Help -> Disk Monitor)  (Uses REST API)
 - Added license analysis page (Help -> License Usage) (*Need to have _internal logs on indexer and role based access)

Bug Fixes
 - Fixed VT lookup script, incorrectly detecting MD5 hashes in URL - if (re.findall(r"(^[a-fA-F\d]{32})", sys.argv[1]))
 - Fixed VT Lookup script, removed leading white spaces lstrip()
 - Fixed bug in BulkWhois to provide state/province information

Chat Program

This is a first stab at a collaboration mechanism within Splunk.  It works for a quick and dirty.  The only annoyance is the refresh every 5 seconds.  I am sure it can be made fancier with some Java Script so if you do a little dev and want to contribute--we would appreciate it.

Additional WHOIS vendor

For a while, it appears that bulkwhois had an ISP issue.  Thus, we added a second provider as another option.  Big thanks to hackertarget.com.

Link Extractor

This is useful if you don't want to visit a potentially malicious site, but you want to know the links on the site.  This tool will rip all of the links from the page safely and quickly.

Disk Usage

This last tool is useful for those who need to monitor how much storage is left on their indexers.  This is customizable to your server name and volume that holds indexed data.  By default it is set to my development box which is a simple Kali VM.

Conclusion

Hopefully you will enjoy the new features of the app.  As always, we appreciate the great feedback we are receiving.  Please send more ideas from within the app using Help --> Send Feedback.