Ring Doorbell

From Exploitee.rs
Revision as of 14:15, 15 January 2016 by Zenofex (talk | contribs)
Jump to navigationJump to search

"Although the information we release has been verified and shown to work to the best our knowledge, we cant be held accountable for bricked devices or roots gone wrong."

Ring-doorbell.jpg

This page will be dedicated to a general overview, descriptions, and information related to the Ring Doorbell.

About

The Ring Doorbell is a wifi connected doorbell with an attached HD camera.

Disassembly

Below is our teardown of the Ring Doorbell.

  • Ring-Doorbell-Teardown-1.jpeg
  • Ring-Doorbell-Teardown-2.jpeg
  • Ring-Doorbell-Teardown-3.jpeg
  • Ring-Doorbell-Teardown-4.jpeg
  • Ring-Doorbell-Teardown-5.jpeg
  • Ring-Doorbell-Teardown-6.jpeg
  • Ring-Doorbell-Teardown-7.jpeg
  • Ring-Doorbell-Teardown-8.jpeg
  • Ring-Doorbell-Teardown-9.jpeg
  • Ring-Doorbell-Teardown-10.jpeg
  • Ring-Doorbell-Teardown-11.jpeg
  • Ring-Doorbell-Teardown-12.jpeg
  • Ring-Doorbell-Teardown-13.jpeg
  • Ring-Doorbell-Teardown-14.jpeg
  • Ring-Doorbell-Teardown-15.jpeg
  • Ring-Doorbell-Teardown-16.jpeg
  • Ring-Doorbell-Teardown-17.jpeg

Hardware Pinouts

Below is a pinout diagram of the debug pin headers on the Ring Doorbell. The labels correspond to the various Datasheets for the misc ICs.

  • Ring-Doorbell-Pinouts.jpg

Stealing WiFi Credentials

Prior to the start of 2016 it was possible to steal a users WiFi credentials if they had a connected Ring Doorbell. This was done by putting the device into "AP Mode", connecting to the "RING-####" provisioning network, then accessing a specific URL which was left over from the GainSpan SDK. The video below demonstrates the bug

Gainspan SDK Pages

The Ring Doorbell contains a number of pages still left in from the GainSpan SDK. The following pages are available after accessing the Ring's AP by pressing the connect button on the back of the doorbell.

  • /gainspan/system/sslcertupload - Upload new SSL Cert
  • /gainspan/system/fwuploc - Upload new FW
  • /gainspan/system/config/network - Network Connection Info
  • /gainspan/system/config/httpd - HTTPD Config Info
  • /gainspan/system/config/id - Hostname and UID/MAC
  • /gainspan/system/config/otafu - OTA Firmware Update Info
  • /gainspan/system/prov/ap_list - List Access points and WiFi info
  • /gainspan/system/prov/scan_params - Wifi scanning parameters
  • /gainspan/system/prov/wps - WPS setup
  • /gainspan/system/fsupload - File System Upload
  • /gainspan/system/firmware/version - Gainspan Firmware Version Info
  • /gainspan/system/api/version - Gainspan API Version
  • /eapcerts.html - EAP Certificate Upload
  • /gsap.html - Gainspan AP Configuration
  • /gsclient.html - Gainspan Client Network Settings
  • /gsprov.html - Gainspan Network Device Setup
  • /otafu.html - OTA Firmware Update
  • /smartplug.html - Gainspan Smartplug Web Application
  • /sslcert.html - SSL Certificate Upload
  • /tls.html - TLS Web App

Gainspan SDK Pages Video

Below is a video showing the pages accessible on the Ring Doorbell which are mostly just remnants from the GainSpan SDK.

Retrieved from "http://www.Exploitee.rs/index.php?title=Ring_Doorbell&oldid=2550"