Vulnerable Systems:
 * GeoVision Digital Video Surveillance System version 7.0 and prior

Privilege Escalation 1:
When the GeoVision software is set to create JPEG images for use via the JPEG Image Viewer it can be seen that no authentication is required to view the JPEG images.

Using GeoVisions own demonstration as an example the following URLs can be used to access images. This is true even for servers who specify that a username and password is required for authentication. In the current GeoVision demonstration only a username is required to access footage. This method works on GeoVision systems which are configured to create JPEG images. It will also work on GeoVision systems which are not configured with the 'Enhanced Network Security' feature. This is understood to be the default setting.

Proof of Concept:
http://webcam.geovision.com.tw/cam0.jpg
...
http://webcam.geovision.com.tw/cam3.jpg

Privilege Escalation 2:
During the authentication phase using the live playback client it was seen that the username part of the authentication component is passed in plain text. In this partial dump taken using tcpflow the username is seen to be 'gvUser'.

Network dump of an authentication attempt:
--------------------- Network traffic sniffer ---------------------
192.168.105.136:01187-192.168.105.130:00514: ....
192.168.105.130:04550-192.168.105.136:01186: RDY.
192.168.105.136:01186-192.168.105.130:04550: ..7d6a6666636e.gvUser.
192.168.105.130:04550-192.168.105.136:01186: ...
192.168.105.136:01186-192.168.105.130:04550: 2.
-------------------------------------------------------------------

A simple transformation of the password based on hex values for ASCII characters is used to scramble the password. This scrambling is simple to do in reverse, as seen in the example below.

Sniff from network:
--------------------- Network traffic sniffer ---------------------
192.168.105.130:04550-192.168.105.136:01186: RDY.
192.168.105.136:01186-192.168.105.130:04550: ..7d6a6666636e.gvUser.
192.168.105.130:04550-192.168.105.136:01186: ...
-------------------------------------------------------------------

Here we see the username 'gvUser', still in plain text and the scrambled password '7d6a6666636e'. In order to go to the from the scrambled string to the original password a few simple steps are performed.

Split the string into pairs of hex strings:
0x7d
0x6a
0x66
0x66
0x63
0x6e

Each pair represents one character in the original password, so this scrambled string is for a password of 6 characters.

Iterate through the pairs subtracting a number from each pair starting with 0x6, for the first character as there are 6 characters in this password.

0x7d - 0x6 = 77
0x6a - 0x5 = 65
0x66 - 0x4 = 62
0x66 - 0x3 = 63
0x63 - 0x2 = 61
0x6e - 0x1 = 6d

Then use an ASCII table to translate into characters

0x77 = w
0x65 = e
0x62 = b
0x63 = c
0x61 = a
0x6d = m

So the original password was 'webcam'.

This issue is encountered for all the authentication options below:
Mpeg4 Encoder Viewer
56kMpegView0.htm