nolan/oko_public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
master
oko_public/audit1.md
T
nolan 2998b478ca INIT
2026-09-09 21:44:05 -05:00

19 KiB
Raw Permalink Blame History

Security Audit — oko livestream/camera pipeline

Audited scope: all Go modules (frame, runCam, mofin, terp, coordinator, livestream-cache, oko-run), shell/launcher scripts, YAML configs, and everything tracked in the git repository.

Date: 2026-08-28 Method: full source review + targeted exploit verification (path traversal, malformed-clip crash, committed-secret history scan).

Executive summary

The oko pipeline moves live/captured camera frames over plaintext TCP between never-authenticated daemons. Anyone who can reach any of the default :808x/:8443 listeners can inject video clips, poison live feeds, crash daemons, or read live footage. The most severe problems are not crypto weaknesses but architectural ones: no authentication anywhere, no input validation on anything received from the network, no resource limits, and secrets/footage committed to git.

Verified during this audit:

  • A single crafted TCP clip crashes coordinator, mofin, and terp (index-out-of-range panic in Clip.Sublimate).
  • An attacker-controlled SourceData value lets a clip escape the storage directory (path traversal to arbitrary file writes).
  • TLS private key + real surveillance footage are present in git history.

Findings (most → least serious)

1. CRITICAL — No authentication on any network endpoint; all listeners bind 0.0.0.0

Location:

  • mofin/main.go:28,41,54-73 — listener, default :8083
  • terp/main.go:27,47,59-102 — listener, default :8081
  • coordinator/main.go:41,86,98-113 — listener, default :8082
  • livestream-cache/main.go:256-325 — TCP ingest on :8085
  • livestream-cache/main.go:327-347 — HTTPS MJPEG server on :8443
  • run-stack.sh:58-87 — launches everything bound to all interfaces

Description: Every daemon listens on :port (all interfaces) and accepts any TCP connection. There is no token, no shared secret handshake, no TLS client-auth, no IP allowlist — nothing. The config comments ("over Tailscale") imply the intended boundary, but nothing enforces it; the ports are also reachable on any other interface (LAN, Docker bridges, etc.).

Impact:

  • Remote clip injection: arbitrary video can be routed into the motion-detection / classifier / storage pipeline.
  • Live-feed poisoning: spoofed frames overwrite legitimate cameras in the livestream cache (livestream-cache/main.go:299-321), so a viewer sees attacker-chosen images on a real camera stream.
  • DoS: malicious peers can crash daemons and exhaust resources (findings #2, #3, #5).
  • Data theft: if any listener is exposed, an attacker gets fuller access than the camera operator intends.

Recommendation: Require authentication on every ingest endpoint (HMAC-authenticated messages or an API token), bind to loopback/Tailscale interface explicitly (configurable per service), and consider TLS with client certificates for inter-node traffic.

2. CRITICAL — Remotely-triggerable crash: malformed Clip causes index-out-of-range panic in Clip.Sublimate

Location: frame/frame.go:128-148 (Sublimate, indexing clp.Guids[i] at line 142 and clp.Timestamps[i] at line 143). CheckLenCorrelations exists at frame/frame.go:151-166 but is never called on any receive path.

  • Consumers that crash: coordinator/main.go:172-180, mofin/main.go:100-108, terp/main.go:117-126,138.
  • coordinator additionally indexes clp.Timestamps[0] / clp.Guids[0] at coordinator/main.go:193,217,327.

Description: A Clip with a non-empty PixelMats but an empty/short Guids or Timestamps slice causes Sublimate to panic. These structs are decoded straight from the network via gob with zero validation.

Impact: One small crafted packet kills any ingest daemon (coordinator, mofin, terp). No authentication means any reachable host can take the entire recording pipeline down, repeatedly. This is a remote crash / availability vulnerability.

Verified: unit test reproduced runtime error: index out of range [0] with length 0.

Recommendation: Validate Clip length invariants (CheckLenCorrelations) immediately after decode on every receiver, bound the number of frames per clip, and recover from panics in connection handlers (defer recover()).

3. CRITICAL — Path traversal in coordinator → arbitrary file write outside storage

Location: coordinator/main.go:191-196:

user, camera := splitSource(clp.SourceData)      // line 191
...
clipDir := filepath.Join(storageDir, user, camera, dateShard, dirName)
if err := os.MkdirAll(clipDir, 0755); err != nil { ... }

splitSource (coordinator/main.go:360-365) does no sanitization; SourceData comes verbatim from the network.

Description: filepath.Clean preserves .. elements that escape the root. A SourceData of e.g. ../../../../tmp/pwn--cam resolves clipDir to something outside storageDir and the coordinator then MkdirAlls it and writes clip.mp4 / clip.json inside.

Impact: Remote arbitrary file creation/overwrite anywhere the coordinator process can write. At minimum: fill the disk, clobber config/log files, plant files for operators to open, or stage payloads. Because the process runs as the service user (often root on Pis), this can become full host compromise.

Verified: filepath.Join("storage", "../../../../tmp/pwn", "cam", ...) resolves to /home/tmp/pwn/cam/..., comfortably outside storage.

Recommendation: Sanitize/whitelist SourceData (allow only [a-zA-Z0-9_-/]), strip .. segments, and resolve+verify the final path is within storageDir (EvalSymlinks / prefix check) before any MkdirAll.

4. CRITICAL — TLS private key for the livestream HTTPS server is committed to git

Location: livestream-cache/key.pem and livestream-cache/cert.pem (tracked; present in every commit since added). Used at livestream-cache/main.go:344 (ListenAndServeTLS).

Description: The key.pem is a live private key checked into the repository (mode 0644).

Impact: Anyone with repo access (or the public history) can operate the server identity and MITM the live camera streams served over :8443; combined with finding #1, the HTTPS layer provides no actual security for this deployment. Self-signed, so browsers already show warnings.

Recommendation: Remove both files from the repo and history (git filter-repo), rotate the key immediately, generate certs at deploy time or store in a secrets manager, and chmod 600 the key file.

5. CRITICAL — Real surveillance footage is committed to the git repository

Location: coordinator/storage/oko/front/0/2026-06-30/*/clip.mp4 + clip.json (tracked). The JSON exposes "source_data": "oko--front/0", timestamps, GUIDs, detections.

Description: Actual camera recordings of a camera labeled front are in the repo and history.

Impact: Permanent privacy/legal exposure of security-camera footage of people and property. Anyone who ever gets the repo gets the footage. This cannot be fixed by deleting the files — history must be rewritten.

Recommendation: Purge storage output from git history (git filter-repo), add coordinator/storage/** (and logs/) to .gitignore, and ensure no future clip data is committed.

6. HIGH — Unbounded resource consumption / DoS: no limits on decode size, connections, or goroutines

Location:

  • Unbounded connection + goroutine per accept: coordinator/main.go:98-113, mofin/main.go:52-73, terp/main.go:59-102, livestream-cache/main.go:269-279.
  • Unbounded gob.Decode with no stream/field size caps: coordinator/main.go:172, mofin/main.go:67, terp/main.go:74, livestream-cache/main.go:288.
  • No read/write deadlines on any socket (slow-loris friendly).
  • Per-clip processing goroutines with no bound on frames-per-clip: terp/main.go:141-151 (one goroutine per frame × one per classifier), mofin/main.go:79-88.
  • Livestream cache map grows per untrusted SourceData key until the TTL janitor runs (livestream-cache/main.go:66-73,235-254) — attacker can flood with millions of synthetic IDs in 30 s.
  • http.Server has no ReadHeaderTimeout/MaxHeaderBytes/connection limits (livestream-cache/main.go:332-336).

Impact: Memory exhaustion (gob-decode bombs, large PixelMats, giant maps), CPU exhaustion (frame/classifier goroutines), and connection exhaustion from a handful of sockets. All remotely triggerable without auth.

Recommendation: Enforce max clip size / frame count / dimension limits, io.LimitReader on connections, per-connection deadlines, semaphore-bounded worker pools instead of unbounded goroutines, and sane http.Server timeouts/limits.

7. HIGH — Live camera streams (/stream/...) served over HTTPS with no authentication

Location: livestream-cache/main.go:354-422 (handleMJPEGStream).

Description: Any unauthenticated client that can reach :8443 can fetch live frames:

  • GET /stream/oko--front/0 → live MJPEG stream.
  • Valid camera IDs are trivially enumerable (200 vs 404, main.go:361-364).
  • No auth headers, cookies, or originating-IP restrictions.
  • Because it's a plain <img>-loadable resource, any web page the victim visits can embed the stream (no CORS framing/canvas interplay blocks images), leaking the feed to third parties.

Impact: Anyone on the network can watch the cameras live — the very thing a home/office security system must prevent.

Recommendation: Require authentication (session cookie or per-camera token), serve on a Tailscale-only listener, hide whether cameras exist (uniform responses), and add X-Frame-Options/CSP framing controls.

8. HIGH — Encryption defaults off: clips are plaintext on the wire and at rest

Location:

  • runCam/main.go:39 — -passphrase defaults to "" (no encryption).
  • mofin/main.go:33, terp/main.go:31, coordinator/main.go:43 — decrypt enabled only when passphrase set.
  • All provided configs ship passphrase: "" or omit it (config.yaml, cam-only.yaml:12-13, livestream-cache/config.yaml:5, run-stack.sh).
  • No TLS anywhere in the pipeline; transport is raw TCP + gob (frame/frame.go:239-252, frame/network.go:24-70).

Description: The AES-256-GCM layer exists but is opt-in and off in every shipped config. Frames/clips traverse runCam→mofin→terp→coordinator as plaintext and are stored unencrypted. Even when enabled, there is no protection against replay.

Impact: On-path sniffers can reconstruct surveillance footage; anyone with storage read access reads plaintext footage; clips can be modified in transit without detection (GCM only protects when the passphrase is actually configured end-to-end).

Recommendation: Require encryption to be on (fail-closed), propagate the passphrase via environment/secret store rather than CLI flags, or use mutually-authenticated TLS. Add per-clip anti-replay (e.g., monotonic nonce/counter, unique clip nonce).

9. HIGH — Live-feed poisoning via spoofed SourceData on TCP ingest

Location: livestream-cache/main.go:299-321 (handleTCPConnection). passphrase := cameraPassphrases[sourceData]; with an empty passphrase the frame is accepted and stored under the spoofed key, overwriting a real camera's cached frames.

Description: The ingest server trusts clip.SourceData from the wire. Because there is no sender authentication (#1) and encryption is off (#8), an attacker connected to :8085 can impersonate any configured camera and overwrite what viewers see on /stream/....

Impact: Viewers are shown attacker-chosen images (denial of the real feed, social engineering, hiding the attacker's presence from the livestream while clips still may record differently).

Recommendation: Authenticate senders and validate SourceData against the configured camera list; reject unknown sources and never allow overwriting another camera's cache entry except from authenticated senders.

10. MEDIUM — Secrets in plaintext / visible in process listings

Location:

  • Passphrases and DB password passed as CLI flags: runCam/main.go:39, coordinator/main.go:43,47 (-passphrase, -db-password), mofin/main.go:33, terp/main.go:31. Visible to any local user via ps.
  • MySQL DSN is built inline (coordinator/main.go:56-57) and defaults to root with an empty password (coordinator/main.go:46-48).
  • Config files store passphrases in plaintext YAML (config.example.yaml:11,15 ships passphrase: "change-me" — a universally-known key if left in place).

Impact: Local privilege escalation/privacy loss on the host; a "well-known" default key if example config is lifted wholesale; database exposed if root/empty password ever connects to a reachable endpoint.

Recommendation: Pass secrets via environment variables or a secrets file with 0600 perms; stop defaulting to root/empty; never ship a default key.

11. MEDIUM — Compiled binaries committed to the repo

Location: livestream-cache/livestream-cache, terp/terp, mofin/mofin (tracked; terp/terp additionally shows uncommitted modifications in the working tree). The .gitignore lists them (runCam/runCam, etc.) but they were added anyway.

Description: Binaries cannot be audited or attributed; a modified, untracked terp/terp means the deployed binary may not match the source.

Impact: Supply-chain / integrity risk if such a repo is shared — someone could execute a trojaned binary with full pipeline privileges and never notice.

Recommendation: git rm --cached all compiled artifacts, keep .gitignore enforced (use git check-ignore/pre-commit), and always build from source (run-stack.sh / oko-run already build-if-missing).

12. MEDIUM — Live-stream endpoint is a CPU DoS by design

Location: livestream-cache/main.go:377-420.

Description: Every connected client triggers a full frameToImage + JPEG encodeJPEG every 100 ms regardless of whether the underlying frame changed (cache re-encode is per client, not per-frame). There is no client limit or rate limit.

Impact: A modest number of unauthenticated clients saturates CPU and starves the feed for everyone; no auth means trivially scriptable by an attacker.

Recommendation: Encode once per new frame and share the JPEG across clients (broadcast model), cap concurrent stream consumers globally and per camera, and add per-IP rate limits.

13. MEDIUM — No slow-loris / timeouts protection (all TCP services)

Location: accept handlers in coordinator/main.go:98-113, mofin/main.go:52-73, terp/main.go:59-102, livestream-cache/main.go:269-279; no SetReadDeadline/SetWriteDeadline anywhere; http.Server without ReadHeaderTimeout (livestream-cache/main.go:332-336).

Impact: Idle connections can be held open indefinitely by any local network peer, exhausting file descriptors and goroutines.

Recommendation: Set connection deadlines (e.g., 10-30 s idle timeout) and server timeouts; consider a small max-connections gate.

14. MEDIUM — World-readable storage and logs

Location:

  • coordinator: MkdirAll(..., 0755) dirs and clip JSON written 0644 (coordinator/main.go:196,316).
  • livestream.log (955 KB) committed to the repo, containing operational details of the livestream backend.

Impact: Any local account can read surveillance footage and logs; perms + repo history mean footage persists beyond the operator's control.

Recommendation: Use restrictive perms (e.g., 0700 dirs, 0600 files), and keep logs out of git (.gitignore logs/).

15. LOW — Camera enumeration & metadata leakage in responses

Location: livestream-cache/main.go:361-364 (404 vs 200 reveals configured camera IDs); stream/client IPs logged (main.go:380).

Impact: Enumerating which cameras exist over an unauthenticated endpoint; minor privacy exposure of viewer IPs in logs.

Recommendation: Return a uniform response for unknown vs known cameras (with auth in place), and consider not logging client IPs (or logging to an authenticated-only log).

16. LOW — mofin -threshold is truncated through uint8

Location: mofin/main.go:32,111 — flag is int (default 30) but processClip casts to uint8; shipped configs use threshold: 5000 (config.yaml, run-stack.sh:76, bots_readme.md), which silently becomes 5000 & 0xFF = 136.

Impact: Not a security break, but indicates config values are misinterpreted; behavior is not what operators think, which can cause unexpected motion-gating results.

Recommendation: Clamp or validate threshold to 0-255, or document it as percent-based math.

17. LOW — Replay of previously captured clips

Location: frame/frame.go:172-237 (AES-GCM without an anti-replay counter).

Description: GCM protects integrity/confidentiality but the protocol has no nonce-uniqueness enforcement across clips or sequence numbers, so a captured encrypted clip can be replayed into storage/livestream.

Impact/Recommendation: Low for a home system; add a unique per-clip nonce/preimage (e.g., GUID-derived) and monotonic counter if replay resistance matters.

18. INFO — genGuid panics on entropy failure; CfgData.PassHash is a misnomer

Location: frame/cameraFunctions.go:59-67 (panic on crypto/rand failure — turns a rare-but-recoverable condition into a crash), and frame/cameraFunctions.go:12-15,37,55 (PassHash holds the raw passphrase bytes, not a hash; SourceData embeds it as user--pass).

Impact/Recommendation: Entropy panic is a crash-under-adversarial-CSPRNG issue. The PassHash naming invites future misuse (embedding real secrets in SourceData); rename and ensure the actual passphrase is never serialized into SourceData (the current runCam path no longer does this — keep it that way).

Cross-cutting recommendations

  1. Zero-trust the wire: authenticate every peer and message (token or client-cert TLS), set explicit bind interfaces, and make encryption non-optional (fail closed).
  2. Validate everything decoded from the network: length invariants (CheckLenCorrelations), frame counts, dimensions, SourceData charset, and path containment.
  3. Cap resources: connection limits, decode sizes, worker-pool bounds, http.Server timeouts.
  4. Purge the repo: re-key TLS, remove footage from history (git filter-repo), drop compiled binaries and logs, harden .gitignore + pre-commit hooks (block *key*, *.pem, storage/log output).
  5. Secrets hygiene: environment-based secrets, no default root/empty DB creds, no examples with real-looking keys.

Repo hygiene summary (what's tracked in git that shouldn't be)

Item Risk
livestream-cache/key.pem (private key) TLS compromise → MITM of live streams
coordinator/storage/**/clip.mp4, clip.json Real surveillance footage in history
livestream-cache/livestream.log Operational data
livestream-cache/livestream-cache, terp/terp, mofin/mofin Unverifiable compiled binaries (one modified)
Reference in New Issue View Git Blame Copy Permalink