Kodak Easyshare picture frame sends all your photos to RSS feed

[spidey07]

LOL! Who in their right mind thought this was a good idea? Especially since the first 6 nibbles of the mac are always going to be the same. Heck it would be easy enough to write a little script that tried all the remaining combinations of the last 3 bytes and returned which ones were valid URLs.

http://seattlewireless.net/~casey/?p=13

What’s this at the bottom? Some strange little RSS URL?

Well, lets just plug it in and see what happens:

http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:07:6D

Look, its an RSS feed of what my picture frame is showing now! I can send this nice URL to everyone I know so they can look at all my private content I have configured for this device. Now, under no circumstances would I recommend changing the last digits of this MAC address frame ID to another number….because you would get someone else’s picture frame content. Why would you want to do that?

 

[mugs]

I have no interest in trying to find people's picture frames, let me know if you find anything interesting.

 

[Farang]

i found nothing in this thread but trivia questions and pictures of prepubescent asians

 

[Crusty]

That's pretty fail, the registration form doesn't even require a valid email address.

 

[SunnyD]

Mmm... pr0n fishing...

 

[spidey07]

Mmm... pr0n fishing...

I'm working on B8:07:XX. If somebody wants to grab the torch and pick up a different range. Some good pictures here but don't know if he took them.

http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:07:2a

 

[sygyzy]

I'm working on B8:07:XX. If somebody wants to grab the torch and pick up a different range. Some good pictures here but don't know if he took them.

http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:07:2a

You think you happened to stumble across a National Geographic photographer's digital photo frame? Yeah right. He likely subscribed to a feed.

 

[Zargon]

LOL no doubt

 

[Crusty]

Meet the Malloys.

 

[spidey07]

Meet the Malloys.

I'm liking the Malloys. Seem like good people to me.

 

[spidey07]

Lulz, bad programming is bad. Remember folks, you put in on the intarweb and folks will try to hack it.

http://www.reddit.com/r/reddit.com/...ak_easyshare_frame_might_want_to_read/c0i7odc

Something that wasn't made entirely clear on the article: you can use those feeds to take control over people's frames before they are even unboxed, since you can see their invitation code as seen here: http://www.framechannel.com/feeds/p...=00:23:4D:B8:07:60/reset=0/language=/7624.jpg

The kodak.framechannel.com site doesn't have any captchas, so it could be possible to write a script that creates an account for every single non-activated device and puts an ad for something else in there. Or just kiddie porn, much jailtime ensuing (who's going to return the frame while it's showing kiddie porn and say "it was this way when I got it!"?)

 

[brtspears2]

Did the B8:10:00 - B8:10:0F range for fun:

http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:10:00 - nothing of interest
http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:10:03 - guy makes out with laser printer fuser?
http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:10:08 - nothing of interest
http://rss.framechannel.com//productId=KD9371/frameId=00:23:4D:B8:10:0A - kitty, thanksgiving dinner

 

[Red Squirrel]

Woah that is sad. You'd think they would of thought of that. Why is it even putting the pics on the internet at all? It should only work lan base!

 

[Kalmah]

Well, if I ever want to spy or stalk someone I'll just send them one of these frames as a gift.