Holiday Hangover Hardware Hacking

Having too much cheer during the holidays? In this month's article, Colin offers a diversion from the jolly season by urging developers to retreat to the basement to brush up on hardware hacking skills. He shows how a low-cost Raspberry Pi Pico and a TP-Link Tapo C200 smart IP camera could become the next automated bird deterrent or a home automation server.

- Colin O'Flynn

Using a Raspberry Pi Pico to Hack an IP Camera

The holidays are a great time to pick up some lowcost IoT hardware for practicing or developing your hardware-hacking skills. In this article, I'll go over some work on the TP-Link Tapo C200 smart Internet Protocol (IP) camera. I use this camera as the basis for several labs in my undergraduate course on cybersecurity at Dalhousie University.

It's also a heavily attacked device. You'll find several nice websites and repositories that have similar work. In particular, I first used the work by DrmnSamoLiu on GitHub [1], but several other resources are also available [2]. Despite all the attacks, there is still lots of analysis left! One alluring feature of this camera is its very low cost-it often appears in sales, reducing the cost further. And it features some interesting hardware, including a camera with pan-tilt capability, a microphone, and a speaker. It also runs Linux with Wi-Fi connectivity, so if you could run your own software on this device, you could turn it into anything from an automated bird deterrent to a local, miniature, home automation server.

To make this as accessible as possible, I'll use the Raspberry Pi Pico as the actual hardware-hacking tool. Onto this board we'll load several different firmware images to give us the various interfaces we need to work with the Tapo C200.

FIRST LOOKS

When looking at a device to analyze, one cheat is to use the FCC-ID that any wireless device is required to have. Looking up the FCC-ID of this device (2AXJ4C200V2) [3] will give you internal photos of the main board. I often use this to check if the device appears to have some internal headers that might make attacking it easier, before even buying it.