View RTMPS live stream access

[ryanwinter]

cam_object.live_streaming() provides the live stream which is returned as type rtmps://. This would indicate that it is an encrypted RTMP stream.

At this point, I haven't seen anyone successfully open the stream. I have tried to stream with ffmpeg however received errors of various types.

I suspect either a certificate is required, or some token is needed to access/decrypt the stream.

[ryanwinter]

I spent a little time on this yesterday. I install Android x86 and installed the Arlo app within the VM.

However when trying to launch the Arlo app, it crashes instantly. Everything else appears to work on in the VM, so I'm a little uncertain on why this decided to fail. Will take another look tonight.

[ryanwinter]

The second thing I noticed, while poking around in the Android APK, is that there are libraries for ffmpeg, x264. There is also a wowza certificate in the assets folder.

So hopefully they aren't doing anything funky and these libraries are all that's needed to decode the stream.

[jwillaz]

I did some inspection using Fiddler as a proxy for my phone while running the Android app and opening a live stream. The things you noted above are correct. There is a wowza secure stream player used. There are also 2 certs I noted in the trace. One was a Netgear Arlo cert. The other was an Amazon AWS cert. The stream is tunneled from AWS.

[ryanwinter]

I believe this is the documentation outlined the server side encrpytion:
https://www.wowza.com/docs/how-to-protect-rtmp-streaming-using-securetoken-modulesecuretoken

[ryanwinter]

So I believe the web interface and likely the android app are using a flash player to stream. Seeing as flash isn't possible on the apple devices, I'm wondering if they are using a different stream protocol instead.

If so, this might be an easier way to access the live stream.

I have an apple device and tried to use fiddler to view what was going on, but when I turn on https decryption, I get certificate errors on the device.

[ryanwinter]

By changing the user agent string to "Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_5 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Mobile/13G36 NETGEAR/v1 (iOS Vuezone)",

I get the following stream response:
"rtsp://52.38.114.182:443/vzmodulelive/<useid_cameraid>?egressToken=&userAgent=iOS&cameraId=<camera_id>"

So yes as I suspected, the iOS is using a different stream format (Android is possibly using this as well). I haven't successfully managed to stream this yet with ffmpeg, but will give it a try later tonight.

[ryanwinter]

I poked around with this the other night, mostly trying to play the RTSP stream with no success. I was able to connect to the rtsp server with openssl and validate that it did provide a correct certificate.

I also decided to snoop on the traffic from the camera itself, however it appears that the camera initiates all traffic, and its SSL encrypted.

Still want to investigate more, trying to understand how the netgear servers initiates camera requests. It appears that the camera keeps the encrypted connection constantly open, and this is used, however this seems a bit weird. Once I figure out how to do an SSL man in the middle attack with my setup I will post some results.

[jwillaz]

You are definitely onto something. I'm on a hotel network that seemingly does throttling / dropping of video connections. Whenever I try to connect to my live camera feeds through a web browser, the feed gets disconnected. However, if I use the Android app on the hotel network, it connects and streams no problem. Obviously something wonky about how the hotel filters connections, but it at least confirms that there is a distinct difference in how the site and apps are streaming. This is foreign territory for me, though.

[ryanwinter]

Foreign for me as well, been a crash course of hacking my network :) I have an android device which I will take home and have a look at what that is doing. I suspect it's probably using the same rtsp stream that the ios devices are using.

I will try and read up more on the wowza documentation on RTSP streaming, hopefully this will have some key on what I should be doing.

[tchellomello]

This is awesome guys

[chaddotson]

Any updates? I've been attempting to start the stream via librtmp unfortunately I keep getting a failure to start the stream. It does get connected however.

import librtmp

rtmp = librtmp.RTMP(url=camurl, token=arlo._PyArlo__token, live=True)
rtmp.connect()

stream = rtmp.create_stream()
data = stream.read(1024)

rtmp.close()