søndag den 13. september 2015

The HotTub part 1

Disclaimer:
This and the following writeups isn't an attempt to miscredit the company that delivered the hottub or any of it's employees. I am sure that they have a lot of satsified customers around Europe, I really hope so.. But for me bying a tub, hasn't been the unbox and enjoy expeirience I had hoped for, there has simply been too many annoying details in the way for this to happen.

The new tub installed
It all started mid 2014, my old hottub had succumbed to fungi and rot, and could no longer hold any water, so I started searching the market for alternatives.  I really liked having a wood fired hottub, as it could be heated up in a few hours, but keeping it clean, and the need to always have some water in it, was a bit tidious, so I was looking for something inbetween a eletcric jet-set square tub, and a all wooden tub like the old one.

After a good deal of mail exchange, I ended up buying a tub from a company in Lithuania. From their multiple homepages in multiple languages it looked like it was a good product, and I couldn't find any negative about the quality of their products. I must admit that I couldn't find any positive either, apart from what could be found on their own homapages.
The tub was made out of polypropelene, isolated, with oak trim, an inside stainless oven like the old tub, and a lid to keep cats and dirt out.
 
 Some of the things I wrote with the factory about, was some minor customizations of the tub, for example I wanted the lights to be installed below the benches, and I had specified where I wanted the studs for connection to the sand filter, I also wanted the fence in front of the oven to completely cover the oven, and not stop level with the benches, like I had seen on some pictures of their tubs.

Delivery was on time, but on a huge truck with no lift, which was a bit of a challenge, though I own a lot of wierd stuff, a forklift isn't in my portfolio. Luckily I had some pallets and a trailer, and with the help of some neighbours we got the tub off the truck, so the trucker could get on with he's program. Now we just needed to get the tub off the trailer, and into it's dedicated spot.


Offloading challenges
After thinking a bit, calling a freind, drinking a beer, thinking a bit more, we managed to get the tub relocated to the right spot in one piece, without getting crushed.

When the plastic came off, the tub looked really nice, the oven had been glass blasted and had a silky appearence. The edge around the top was nicely fitted with tight joints, I did however notice that they had choosen to use glue and dowels to join the top edge, a bit strange I thought, the tub is after all going to be placed outside year round with rain, sun, frost and heat. But I thought that it wasn't the first tub that came out of that factory, so it would probably be fine. Unfortunately it wasn't, after one year the edge had disjoined 3 places.

Another detail was that the tub came with a stainless plate to cover the hole around the oven, this hadn't been trimmed tight enough from the factory, so it had rubbed against the light button, resulting in damage to the button, but it did still work. Also it was almost impossible to remove the plate, due to bad fitting.
 
Button damaged by the steel plate
 

Fence not covering the oven
The very first evening I had unpacked the tub I filled it up and heated it up, and it was fantastic, I couldn't however advoid to notice that the fence didn't completely cover the oven, but stopped level with the benches, just as I had requested it not to do, but hey, if that was the only thing, it would'nt be too hard to fix.
 Another annoying detail, is the wood below the benches...
Why isnt all of the trim oak?
 

Leaks
After my bath, when I wanted to chlorinate the water I noticed some wet spots next to the tub, but I figured that it must had been splashes from when I filled it up. But the next morning they were still there, and the next evening, and the next morning, and.. It soon became clear that the tub was leaking, not a lot, but enough to wet the wooden trim and the tiles. There was a few potiential sources for the leak, either it could be the lights or it could be the connections for the filter, the strange thing was that it leaked in both sides. 

After a few days, the water had turned red, like the ogger red you see in some swedish lakes, it turned out that the oven hadn't been rinsed after it was glass blasted, so it was still covered in metal dust, when I filled the tub. Couldn't they had told me that? grhmm..

When one of the lights started to fail after 2 weeks, I thought that I had found the source of the leak, in the meanwhile I had communicated with the factory via mail, and a bit on the phone. At some point they mentioned that they maybe wanted to have the tub back, to fix the problems that had arisen so far, but after talking to them we agreed that I removed the wooden trim, and had a look at the things, and then we took it from there.
At this point, also the lid for the tub had shown signs of problems, the bracing was made of sapwood with the result that it had wraped, the first time it ever got wet, also the screws that was holding the plastic backing in place, was sticking through. Later some the screws was pulled out, becaus of the wood expanding and contracting against the non flexible backing.
Screws sticking through
Too eager with the countersinker
 
When I got the trim off, the leak was quickly identified. The bottom of the tub was made out of 2 pieces of polypropelene, but this was only welded from the bottom, and not all the way through, and because the weld for the walls did not penetrate deep enough into the bottom, water could seep out between the 2 bottom pieces. Apart from that the rest of the weldings was really nice.
 
Only welded from one side.
 
Communication with the factory was at times a bit slow, but in the end we agreed that I found someone locally that could weld the tub , and the factory would cover the expenses.
 
The reason that the lights had stopped working, was because of moisture, the installation, was a really a strange comtraption. The light controller itself was a sealed plastic box with rubber sealed wire traps, so far so good, but outside the box the lamps was connected with ordinary molex connectors, that you would normally find inside a computer. I gave the connectors some tectyl and the problem was solved.
 
Behind the trim I also found this!
Aber nein!
 
Why on earth did they save those last few cents, and use normal nuts and washers, instead of stainless?!? And wouldn't a backplate to clamp things together, had been the correct way to do it? I mean.. polypropelene is flexible, and silicone does not adhere to it.. so too much movement, and we hava a leak.
 
Then after a couple of months, I noticed yet another problem, the legs for the oven had started to rust, the factory told me to jyst remove the rust with a wirebrush, and that it would not rust again, because it was stinless..?!?
Rusty legs
The oven in the tub is rather large, and has a volume of approx 120 liters, this volume is converted to 120kg of upward force when the tub is filled. The legs serves two purposes, they support the oven when it is not filled with water, and they makes sure that the oven doesn't pops out and hangs in the wall, when the tub is filled with water, this is the reason for the plastic weld bead around the leg. Unfortunetely this engeneering feat didn't work out very well, after 6 months the feets managed to pop themself out of the weld beads, tilting the oven outwards from the wall of the tub. This hadn't been too bad, had it not been for the chimney sticking up, which now led your thoughts towards a tower in the town of Pisa in Italy.
 
Winter was coming, and welding plastic when it is too cold, isnt optimal, and despite the slight leaking, the tub was useable after all. So I repressed all the problems, and just enjoyed taking warm soothing baths. but then.. If only the legs had been the only thing to rust...
 
Late this summer, I was hosting a party, and just in case we should end up in the tub, I decided to clean it up. It had been sitting idle for a couple of months with water in it, so it needed qiote a bit of love to be useable again, chlorine and filtering usually does the trick.
But once again the water had turned red! Very strange I tought, dust from the glass blasting should have dissapeared long ago. I ended up dumping the water, and the gates to hell opened up.
 
The legs was once again rusted, and the mounts was badly rusted. When I dumped the mounts into Oxalic Acid to clear some of the rust, some of the mounts turned grey:
WTF!
Not all of the stainless steel was of the same grade!?!
 
Long story short, most of the oven is made from 430 stainless, which isn't resistant to chlorine, the legs, tubes and one out of four mounts is made from 316 stainless.
One of the things that can happen when you expose 430 stainless to chlorine is pitting colosion, where the corosion creates a pit below the surface of the plate, a serverly example can be seen on the uppor mount in the above picture, and in the picture below, where the location of the pit is more of a problem, since it is located in the bottom of the oven.
The hole is approx 1mm across and 1mm deep
The oven wasn't yet leaking, but it would only be a matter of time, before it would rust through.
 
So far communication with the factory has been futile, they do not agree that this is a warranty issue, despite nothing was stated on either their page, or any of the documentation that followed the tub, that it was incompatable with chlorine.
The manager down there wrote to me, "The heater is suitable for the Tub, just we never know what people decide to do with the Tub." So apparently it come as a suprise to them that people uses chlorine in a hottub.
They have later added the option of ordering the oven in 316 stainless, but at the time I ordered the tub, this option didn't existe. And who would have imagined that a hottub would be delivered with anything else than a chlorine resistant oven, unless it would be clearly stated?
 
So currently I am discussing with the factory whether or not this is a warrnty issue, and the case will most likely end up at the european consumer organization, for them to decide. In my opinion I am entitled to a partial refound of the price, because of all the issues with the tub.
 
Such a case typically takes around 5 months, but fortunately I still have the the oven from the old tub, so stay tuned for part 2, which will cover rebuild of the tub.
 

fredag den 28. november 2014

The IPCC H03 "security" camera





 
One of my Foscam cameras has recently started to act up, so I decided that it was time for some new security cameras, so I went on eBay and ordered a pair of IPCC H03 HD Megapixel 720P IP Cloud Cameras ;)

These should be capable of streaming HD 720P h264 in 30 frames per second, plus has a lot of features build in, like motion detection, audio, onvif and whatnot, which I'm probably isn't going to be using. And.. btw.. this audio feature requires that you to connect a microphone, that you have to buy separate. But no big deal, I won't be using audio anyway.

Unboxing and installation went flawless, they were so kind to put the IP address, default username and password on a label on the box. The build quality of both the camera and especially the attached mount, was above what I had expected.

Also the web interface is both quite nice looking, and responsive, the first thing I did was to find the user setup, to change the default passwords.

 Getting a picture out of the thing was a bit more tricky, the camera want you to download a plugin for the browser, but since I will be looking at the camera via ZoneMinder, I fired up VLC and tried out different url's.
Eventually and with a bit of help from Google, I found out that the following url did the trick:
rtsp://user:password@ipaddress:554/11

And I was pleased with a decent quality picture, all in all a success.

I have later on encountered issues with ZoneMinder giving me a blue screen instead of a picture, after some hours streaming. I haven't had time to figure out why, and this might as well be a problem with ffmpeg.

So now for the security part...
Dodumentation for the camera is very sparse, but the manufacture did provide a CD with some basic well illustrated guides for setting up the camera and features. What stuck me, was that the url for the rtsp stream, didn't include username and password. A quick test confirmed that this could be accessed unauthenticated. But but I guessed that it was because it has cached my IP, stored a cookie or something similar, to keep keep track on who has access, and who has not..
But no.. this wasn't the case, the stream could be accessed unauthenticated from anywhere.. hmmm..


So what else is there I thought?

Curl'ing the front page unauthenticated reveals the whole IU script, containing links to a few CGI scripts.
[ralf@bistromath ~]$ curl -s http://172.22.22.55/web/index.html | grep cgi
<script language="JavaScript1.2" src="/cgi-bin/getwifiattr.cgi" type="text/javascript"></script>
<script language="JavaScript1.2" src="/cgi-bin/p2p.cgi?cmd=p2p.cgi&-action=get" type="text/javascript"></script>
<SCRIPT LANGUAGE="JavaScript1.2" SRC="/cgi-bin/hi3510/bconf.cgi" TYPE="text/javascript"></SCRIPT>


So why not try calling some of them, still unauthenticated..
[ralf@bistromath ~]$ curl -s http://172.22.22.55/cgi-bin/getwifiattr.cgi
var wifissid = "ErikSpandMand";
var wifikeytype = "3";
var wifiwhichkey = "0";
var wifikey="sm0keit";
var wifienable="1";
var wifimac="DE:AD:BE:EF:00:00"
var linkstatus="1";
var linkssid="ErikSpandMand"
var wifimode="STA";


Hey wait aminute.. this is my wifi settings.. well... it's not entirely true.. I changed some things, but.. i mean.. it was..

My first plan was actually to just download the firmware and explorer it, but I haven't been able to find it. The manufactures homepage is here, http://www.ipccam.com/ecp_view.asp?id=379 and I'll buy a beer to the first person that can post a link to the firmware, possible even a security updated version..

The camera has a telnet server enabled, but the passwords in the web UI isn't linked to the passwords in /etc/passwd. The only user on the camera is root, and the password isn't readily available on Google. So the next part will break the warranty.. ;)

Unscrewing the lid and removing the diode board, reveals a serial port, this is TTL levels, so they has to be converted to normal RS232, to do this I used part of an old project with a MAX233, baud rate is 115200.
 


From here it is is pretty straightforward, actually easier than I thought. The camera runs u-boot, and getting root access, is as simple as breaking the boot sequence, adding init=/bin/sh to the kernel parameters and boot it up. The flash is just mounted as jffs2 and a simple passwd did the trick. And after a reboot I was able to log into the camera as root.

From looking at the bootlog, there is some services logging on to the camera as root, but they failed with wrong password, even before I changed it, and the camera is still able to stream with a changed root password.

There is a good chance that there is another way to root the camera via the web UI, a lot of the cgi scripts is simple shell scripts, and the http server build into the camera is also flawed, but breaking out the soldering iron did the trick in less than 30 minutes. The camera isn't vulnerable to shellshock so that it at least one thing that is secure.. ;)

Now with the camera rooted I could explore the filesystem live. A lot of the magic happens in a big ugly binary called vs_server in the web root, you can download it with:
wget http://172.22.22.55/vs_server

Run a strings on it and explore... A lot of the camera functions is compiled into this file, and they are called from /web/cgi-bin/hi3510/some.cgi among some of the useful functions, you can call  is /cgi-bin/hi3510/getuser.cgi if you have forgotten your username or password. This script simply returns all users on the camera and their passwords.

/cgi-bin/hi3510/snap.cgi takes s snapshot which is stored on a temporary mount, and returns a link to the image, so if the camera you are exploring is behind a firewall, that isn't forwarding port 554, this is a way to get pictures out of the camera.

Oh.. btw, the camera supports UPNP. I haven't tested how well this works, and which ports actually gets forwarded.