A security researcher from Israel has found that passwords for GoPro WiFi networks can be easily recovered via the reset mechanism available from the vendor.
Clips stored on GoPro cameras on the SD card can be accessed via a smartphone app, connected via a wireless ad hoc network set up by the camera.
Ilya Chernyakov tried to use such a device, but he did not have a password to connect from his mobile phone. Therefore, he started a password reset procedure, which consists of retrieving a ZIP file containing the firmware and a configuration file with the password and the name, for some camera models (SSID – service set identifier) of the wireless network.
It appears that the URL from which the files are retrieved can be altered to provide access to another network.
This is possible because the data is stored in folders that have been created sequentially and whose names are available without any encryption, according to information written in a blog post by Chernyakov.
In an update from the researcher last Tuesday, it was reported that the issue no longer existed. Currently, if the folder number for update files from other customers is changed, an error message appears.
According to Chernyakov, he was able to find over 1,000 names and passwords for other GoPro wireless networks. This could of course be exploited by someone looking to steal extreme sports footage, as most of the camera's users are adrenaline junkies.
