home.social

#instar — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #instar, aggregated by home.social.

  1. Aktueller Status:
    - Allen Typen entfolgt, die mir nur die Zeitleiste vollkacken, aber auf nichts und niemanden reagieren. Frage: Warum sind die eigentlich hier?
    - Nur 17774 Pakete aus unfreundlichen Ländern sind in der letzten Woche in der Firewall hängen geblieben. Bin überrascht, dass das so wenig ist.
    - #freetube update. Alles funktioniert wieder ❤️
    - #Instar Kameras können keine Step-CA Zertifikate. Gemeldet. Wir arbeiten dran.
    - Endlich wieder #nuhr (und nächste Woche live)
    - Im #SAP sind Gruppenkonditionen mit Konditionsausschluss und Rundungsdifferenzen kaputt. Auch da sind wir dran ;)

  2. @northalpha I integrated an #INSTAR IN-8415 2K+ in my #HomeAssistant using the Generic Camera integration with a still image (HTTPS) and video stream (RTSPS). My understanding is that INSTAR can do much more than that with ONVIF and MQTT, but I didn't go there yet. I'm also happy with the features and the cloud offer (though there is no need to use online / cloud functionalities, it is fully functional offline).

  3. @northalpha I integrated an #INSTAR IN-8415 2K+ in my #HomeAssistant using the Generic Camera integration with a still image (HTTPS) and video stream (RTSPS). My understanding is that INSTAR can do much more than that with ONVIF and MQTT, but I didn't go there yet. I'm also happy with the features and the cloud offer (though there is no need to use online / cloud functionalities, it is fully functional offline).

  4. @alinuxexpert thanks! #INSTAR was unknown to mee, quick check the tech specs, i guess it is quite easy to integrate into #HomeAssistant right?

  5. @alinuxexpert thanks! #INSTAR was unknown to mee, quick check the tech specs, i guess it is quite easy to integrate into #HomeAssistant right?

  6. This Sunday is #DigitalIndependenceDay and it's a great opportunity to look at the security cameras which you use at home. Reolink, Aqara, TP-Link, Eufy and so on are all Chinese owned. Do you really want to give up your #privacy and #digitalsovereignty to those companies? I decided that I don't, which is why I #didit and opted for cameras from Germany based #INSTAR - and yes, it is pricier, but it is worth it and it is an integral part of my #smarthome now. #MadeInEurope #MadeInEU

  7. This Sunday is #DigitalIndependenceDay and it's a great opportunity to look at the security cameras which you use at home. Reolink, Aqara, TP-Link, Eufy and so on are all Chinese owned. Do you really want to give up your #privacy and #digitalsovereignty to those companies? I decided that I don't, which is why I #didit and opted for cameras from Germany based #INSTAR - and yes, it is pricier, but it is worth it and it is an integral part of my #smarthome now. #MadeInEurope #MadeInEU

  8. #hacking #RCE #ROP_chain #0day #IPcamera #instar #shodan

    3. Обход ASLR без утечки

    libc с PIE + ASLR = адрес system() неизвестен. Классические методы утечки не работают, поскольку любой ROP chain крашит бинарник, и утечка становится бесполезной после релокации.​ Тут помогла эксплуатация GOT/PLT. В уязвимой функции вызывается isalnum() из libc, ее адрес уже разрешен и лежит в GOT. Расстояние между isalnum и system — константа 0x13230 байт.​

    4. ROP-chain магия

    — Читаем isalnum@got через gadget ldr r6, [r3, #0x10]​
    — Добавляем offset 0x13230 через gadget add r6, fp, r6 и получаем адрес system​
    — Пишем вычисленный адрес обратно в GOT через str r0, [r4, #4] (GOT writable благодаря partial RELRO)​
    — Готовим аргументы в r0​
    — Вызываем isalnum@plt, который теперь прыгает на system вместо isalnum​

    ВУАЛЯ! UnauthRCE одним запросом на 12k камер. One-shot эксплойт без утечек и множественных запросов.

    Подробности: modzero.com/en/blog/no-leak-no

  9. Взлом INSTAR IP-камер (unauth RCE) через ARM ROP-chain без утечки адресов

    #hacking #RCE #ROP_chain #0day #IPcamera #instar #shodan

    Michael Imfeld из modzero нашел и проэксплуатировал 0day в немецких IP-камерах INSTAR IN-8401 2K+ и 4K. По данным Shodan, на текущий момент около 12к устройств INSTAR светятся в интернете. Исследователь построил целую ARM ROP-chain для обхода ASLR без единой утечки адресов с достижением unauthRCE.​

    1. Доступ к firmware

    Root через UART-интерфейс с прерыванием автозагрузки U-Boot и модификацией bootargs — добавление init=/bin/sh — создание root-пользователя — полный дамп файловой системы.​

    2. Находим баг

    В компоненте fcgi_server обнаружена кастомная реализация Base64-декодирования в обработчике basic auth. Декодированные данные копируются через memcpy в фиксированный стековый буфер 516 байт без проверки длины. Прям по классике, stack-based buffer overflow с перезаписью return address.​

  10. Instar bugs are in storms... they crawl up your nose and eyes. It's alien tech. Like the Vril worm it's nanotech. Who knows what other bugs they've been spraying. #instar #vrilworm

  11. Wunder geschehen....

    ...manchmal sogar recht schnell.

    wiki.instar.com/de/Downloadber

    "Implementierung von IPv6 DNS via SLAAC sowie Anzeige von Gateway- & DNS-Adressen in der WebUI."

    und die dahinter liegenden Dienste funktionieren sogar

    #ipv6only #ipv6 #webcam #instar
    Bisher habe ich nur einen Schönheitsfehler im Fernzugriff entdeckt - die öffentliche IPv4-Adresse, ob durch NAT64 oder DS-lite gehört dort nicht hin.

  12. Wunder geschehen....

    ...manchmal sogar recht schnell.

    wiki.instar.com/de/Downloadber

    "Implementierung von IPv6 DNS via SLAAC sowie Anzeige von Gateway- & DNS-Adressen in der WebUI."

    und die dahinter liegenden Dienste funktionieren sogar

    #ipv6only #ipv6 #webcam #instar
    Bisher habe ich nur einen Schönheitsfehler im Fernzugriff entdeckt - die öffentliche IPv4-Adresse, ob durch NAT64 oder DS-lite gehört dort nicht hin.

  13. This is the first #freeliving #instar of a #mite from the #Histiostomatidae (#Astigmata, #Acariformes) : named the #larva and being characterized by having only #3pairs of #legs, which is a phylogenetically old character. #Specific and thus #apomorphic for Histiostomatidae is that there is a #dorsalpattern of #sclerites, differing between subtaxa. The photo shows the species #Histiostoma sp. (H. feroniarum-complex) from rotting #lemonfruits in Italy (Sorrento).

    © #StefanFWirth Berlin 2024

  14. This is the first #freeliving #instar of a #mite from the #Histiostomatidae (#Astigmata, #Acariformes) : named the #larva and being characterized by having only #3pairs of #legs, which is a phylogenetically old character. #Specific and thus #apomorphic for Histiostomatidae is that there is a #dorsalpattern of #sclerites, differing between subtaxa. The photo shows the species #Histiostoma sp. (H. feroniarum-complex) from rotting #lemonfruits in Italy (Sorrento).

    © #StefanFWirth Berlin 2024

  15. INSTAR IN-8401 2K+: Neue HomeKit-Kamera aus Deutschland

    Der für seine maximal konfigurierbaren Kameralösungen bekannte Anbieter INSTAR hat mit der IN-8401 2K+ eine neuen HomeKit-Kamera im Programm, die sowohl in ein vorhandenes WLAN integriert (unterstützt werden WLAN-Netzte mit 2,4-GHz und 5-GHz) als auch per Ethernetkabel betrieben werden kann. Das in Hessen ansässige Unternehmen bietet die IN-8401 2K+ in zwei Farbvarianten als Überwachungslösung für […]

    iphone-ticker.de/instar-in-840

    #News #Apps #Homekit #Instar #Kamera #Zubehör

  16. We are starting to prepare 4 papers for 2023 - Exciting times! Can’t reveal anything yet 🤐🙊 I have listened to the bones’ whispers & its time to tell the #IrishCaveBones stories. We can’t wait to share more with you all later. #LoveIrishResearch #INSTAR+ We might just rock the archaeological boat so much it might capsize and we start again 🤭🫣