Iptv Hacks Plus One Called

That might seem obvious, but its amazing how frequently default passwords seem to turn up.

The results were, as you can probably guess from the default password comment above, very interesting.

The box itself was branded as 2M-Locatel, which led to some interesting details on the web, but nothing that helped actually access it.

Next step was to get my hands on a small ethernet switch (US7 at a local computer store) to allow me to get my computer on the network at the same time as the STB.

From there it didnt take much to find the IP of the STB, and discover that it allowed telnet access.

Back to Google, and in a few minutes I had the full users guide for a similar Amino STB, including the details for the default root password.

Picking an IP address one higher than that from the STB in my room, I found I was also able to telnet to that system, and again login with the same root password.

That directory contained the binaries that were run to function as an IPTV, as well as some very basic configuration infromation - but unfortunately nothing very helpful.

Unlike the STBs this system didnt allow telnet access, but it did allow ssh - although not surprisingly the root password from the STBs didnt work this time.

With root access no password was required to access postgres, and to find that there was a table called users.

Iptv Hacks Plus One Called

Although the passwords in this table were encrypted it did show the usernames for all of the users, including a few local users - plus one called nice.

Back to the web interface, and not at all surprisingly the password for the nice account was the same as the unix account of the same name.

Whats more, this account appeared to be a full admin account.

From STB details and configuration, to guest details including name and room number for everyone staying in the hotel, billing information for pay-per-view movies (including the ability to change the price of such movies, or swap Toy Story for a Playboy movie).

At this point I had full control over the entire hotels IPTV system.

The nice account didnt work on this one, but the default root password did, giving access to a few hundred gigs of DVD-Rip movies without having to pay the US15 each to access them.

Making an outbound internet connection easily got me the IP address being used for outgoing connection, and connecting back to that IP address showed that both the SSH and web interfaces were fully accessible from the Internet.

A user anywhere in the would could carry out any action, from downloading movies, to recording occupancy rates and guest names, to falsely generating charges for on-demand movies - or just simply reformatting the entire environment taking it completely offline, likely for days or longer.

Despite their lack of action Ive decided not to name the hotel or even the country - other than to say that its somewhere in Asia.