Hard-Coded TURN Credentials in Girafit Camera App

Executive Summary

The Girafit camera app (Android and iOS) versions 1.9.1 and earlier, along with Girafit camera devices, contain hardcoded credentials. Attackers can extract a static TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. The extracted username and session token are identical across all installations and not tied to any user or device, enabling potential tracking, impersonation, or further exploitation if combined with the TURN relay password.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unencrypted transmission of TURN relay usernames and session tokens during live view registration. Use packet sniffing tools like Wireshark to inspect traffic for static credentials. Decompile the Girafit app using tools like apktool (Android) or jtool (iOS) to check for hardcoded TURN usernames in the app's code.

• For Android: Use 'adb logcat' to capture app logs and look for TURN-related data leaks.
• For iOS: Use 'frida' or 'objection' to hook into the app and inspect network requests.

Useful 0 Not Useful 0

Impact Analysis

Attackers could intercept the static TURN username and session token to track users, impersonate devices, or gain unauthorized access to the vendor's relay infrastructure. If the TURN relay password is compromised, further exploitation may occur, potentially affecting live feed connections and user privacy.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Girafit app to the latest version if an update is available. Avoid using the app on untrusted networks to reduce the risk of credential interception. Contact Girafit support to confirm if a patch has been released for this issue.

• Disable live view registration on unsecured networks until the issue is resolved.
• Monitor network traffic for suspicious activity related to TURN relay usage.

Useful 0 Not Useful 0