Ring Doorbell - Revision history

Zenofex at 13:00, 5 August 2017

2017-08-05T13:00:44Z

← Older revision		Revision as of 13:00, 5 August 2017
Line 4:		Line 4:
	[[Category:Cameras]]		[[Category:Cameras]]
	This page will be dedicated to a general overview, descriptions, and information related to the Ring Doorbell.		This page will be dedicated to a general overview, descriptions, and information related to the Ring Doorbell.

			== About ==
			The Ring Doorbell is a wifi connected doorbell with an attached HD camera. The device functions by connecting to a VPN network, then using SIP to transfer H.264 video and audio as a VoIP call.

	== Purchase ==		== Purchase ==
	Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.		Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
	[https://www.amazon.com/Ring-Wi-Fi-Enabled-Doorbell-Nickel/dp/B00N2ZDXW2/ref=as_li_ss_tl?s=electronics&ie=UTF8&qid=1501937960&sr=1-2&keywords=Ring&linkCode=ll1&tag=exploiteers-20&linkId=8b5e43bdde613617169190742c58459a Purchase the Ring Video Doorbell at Amazon]		[https://www.amazon.com/Ring-Wi-Fi-Enabled-Doorbell-Nickel/dp/B00N2ZDXW2/ref=as_li_ss_tl?s=electronics&ie=UTF8&qid=1501937960&sr=1-2&keywords=Ring&linkCode=ll1&tag=exploiteers-20&linkId=8b5e43bdde613617169190742c58459a Purchase the Ring Video Doorbell at Amazon]

	~~== About ==~~
	~~The Ring Doorbell is a wifi connected doorbell with an attached HD camera. The device functions by connecting to a VPN network, then using SIP to transfer H.264 video and audio as a VoIP call.~~

	== Hardware ==		== Hardware ==

Zenofex at 13:00, 5 August 2017

2017-08-05T13:00:24Z

← Older revision		Revision as of 13:00, 5 August 2017
Line 4:		Line 4:
	[[Category:Cameras]]		[[Category:Cameras]]
	This page will be dedicated to a general overview, descriptions, and information related to the Ring Doorbell.		This page will be dedicated to a general overview, descriptions, and information related to the Ring Doorbell.

			== Purchase ==
			Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
			[https://www.amazon.com/Ring-Wi-Fi-Enabled-Doorbell-Nickel/dp/B00N2ZDXW2/ref=as_li_ss_tl?s=electronics&ie=UTF8&qid=1501937960&sr=1-2&keywords=Ring&linkCode=ll1&tag=exploiteers-20&linkId=8b5e43bdde613617169190742c58459a Purchase the Ring Video Doorbell at Amazon]

	== About ==		== About ==

Zenofex at 14:47, 15 January 2016

2016-01-15T14:47:45Z

← Older revision		Revision as of 14:47, 15 January 2016
Line 120:		Line 120:

	== Firmware Updates ==		== Firmware Updates ==
	The Ring Doorbell contains an OTA update process which consists of downloading and flashing 2 files. A "###_app.bin" file and a "###_flash.bin" file. The "###" portion is an integer which represents the current build number while the _flash or _app portion of the filename denote what the update file is used for.		The Ring Doorbell contains an OTA update process which consists of downloading and flashing 2 files. A "###_app.bin" file and a "###_flash.bin" file. The "###" portion is an integer which represents the current build number while the _flash or _app portion of the filename denote what the update file is used for. Updates require authentication but can be acquired by viewing the update URL through the UART port and using the supplied basic-auth along with the update url to download both parts of the firmware update.

	* ###_app.bin - '''This update binary is flashed to the MSP430 and contains the code which handles the Doorbell functionality'''		* ###_app.bin - '''This update binary is flashed to the MSP430 and contains the code which handles the Doorbell functionality'''
	* ###_flash.bin - '''This update binary is flashed to the GainSpan 2011MIE and contains the code needed to provision the device, handle firmware updates and general functionality for WiFi connectivity.'''		* ###_flash.bin - '''This update binary is flashed to the GainSpan 2011MIE and contains the code needed to provision the device, handle firmware updates and general functionality for WiFi connectivity.'''

Zenofex at 14:46, 15 January 2016

2016-01-15T14:46:01Z

← Older revision		Revision as of 14:46, 15 January 2016
Line 119:		Line 119:
	{{#ev:youtube\|wOFPfeYrlKo}}		{{#ev:youtube\|wOFPfeYrlKo}}

	== ~~Ring Doorbell~~ Firmware Updates ==		== Firmware Updates ==
	The Ring Doorbell contains an OTA update process which consists of downloading and flashing 2 files. A "###_app.bin" file and a "###_flash.bin" file. The "###" portion is an integer which represents the current build number while the _flash or _app portion of the filename denote what the update file is used for.		The Ring Doorbell contains an OTA update process which consists of downloading and flashing 2 files. A "###_app.bin" file and a "###_flash.bin" file. The "###" portion is an integer which represents the current build number while the _flash or _app portion of the filename denote what the update file is used for.

	* ###_app.bin - '''This update binary is flashed to the MSP430 and contains the code which handles the Doorbell functionality'''		* ###_app.bin - '''This update binary is flashed to the MSP430 and contains the code which handles the Doorbell functionality'''
	* ###_flash.bin - '''This update binary is flashed to the GainSpan 2011MIE and contains the code needed to provision the device, handle firmware updates and general functionality for WiFi connectivity.'''		* ###_flash.bin - '''This update binary is flashed to the GainSpan 2011MIE and contains the code needed to provision the device, handle firmware updates and general functionality for WiFi connectivity.'''

Zenofex at 14:45, 15 January 2016

2016-01-15T14:45:34Z

← Older revision		Revision as of 14:45, 15 January 2016
Line 6:		Line 6:

	== About ==		== About ==
	The Ring Doorbell is a wifi connected doorbell with an attached HD camera.		The Ring Doorbell is a wifi connected doorbell with an attached HD camera. The device functions by connecting to a VPN network, then using SIP to transfer H.264 video and audio as a VoIP call.

	== Hardware ==		== Hardware ==

Zenofex at 14:43, 15 January 2016

2016-01-15T14:43:22Z

← Older revision		Revision as of 14:43, 15 January 2016
Line 118:		Line 118:

	{{#ev:youtube\|wOFPfeYrlKo}}		{{#ev:youtube\|wOFPfeYrlKo}}

			== Ring Doorbell Firmware Updates ==
			The Ring Doorbell contains an OTA update process which consists of downloading and flashing 2 files. A "###_app.bin" file and a "###_flash.bin" file. The "###" portion is an integer which represents the current build number while the _flash or _app portion of the filename denote what the update file is used for.

			* ###_app.bin - '''This update binary is flashed to the MSP430 and contains the code which handles the Doorbell functionality'''
			* ###_flash.bin - '''This update binary is flashed to the GainSpan 2011MIE and contains the code needed to provision the device, handle firmware updates and general functionality for WiFi connectivity.'''

Zenofex at 14:37, 15 January 2016

2016-01-15T14:37:03Z

← Older revision		Revision as of 14:37, 15 January 2016
Line 7:		Line 7:
	== About ==		== About ==
	The Ring Doorbell is a wifi connected doorbell with an attached HD camera.		The Ring Doorbell is a wifi connected doorbell with an attached HD camera.

			== Hardware ==
			The Ring Doorbell's design is very similar to the "GS2011M HD Video Application Development Kit". The follow IC's perform a majority of the device's advertised functionality.

			* MSP430 - '''Low Power MCU Used to store Ring Doorbell functionality code'''
			* GS2011MIE - '''Low Power Gainspan IC Used for WiFi functionality'''
			* OV788 - '''Omnivision IC Used for HD Video Processing (Omnivision H.264 Video compression chip)'''

	== Disassembly ==		== Disassembly ==

Zenofex at 14:28, 15 January 2016

2016-01-15T14:28:35Z

@@ Line 36: / Line 36: @@
 File:Ring-Doorbell-Pinouts.jpg
 </gallery>
 == Stealing WiFi Credentials ==

Zenofex at 14:15, 15 January 2016

2016-01-15T14:15:20Z

@@ Line 9: / Line 9: @@
 == Disassembly ==
-Ring Doorbell Disassembly coming soon.
+Below is our teardown of the Ring Doorbell.
 == Hardware Pinouts ==

Zenofex at 09:14, 15 January 2016

2016-01-15T09:14:37Z

← Older revision		Revision as of 09:14, 15 January 2016
Line 7:		Line 7:
	== About ==		== About ==
	The Ring Doorbell is a wifi connected doorbell with an attached HD camera.		The Ring Doorbell is a wifi connected doorbell with an attached HD camera.

			== Disassembly ==
			Ring Doorbell Disassembly coming soon.

			== Hardware Pinouts ==
			Below is a pinout diagram of the debug pin headers on the Ring Doorbell. The labels correspond to the various Datasheets for the misc ICs.

			<gallery>
			File:Ring-Doorbell-Pinouts.jpg
			</gallery>

			== Stealing WiFi Credentials ==
			Prior to the start of 2016 it was possible to steal a users WiFi credentials if they had a connected Ring Doorbell. This was done by putting the device into "AP Mode", connecting to the "RING-####" provisioning network, then accessing a specific URL which was left over from the GainSpan SDK. The video below demonstrates the bug

			{{#ev:youtube\|bFJFOxVm7uU}}

			== Gainspan SDK Pages ==
			The Ring Doorbell contains a number of pages still left in from the GainSpan SDK. The following pages are available after accessing the Ring's AP by pressing the connect button on the back of the doorbell.

			* /gainspan/system/sslcertupload - '''Upload new SSL Cert'''
			* /gainspan/system/fwuploc - '''Upload new FW'''

			* /gainspan/system/config/network - '''Network Connection Info'''
			* /gainspan/system/config/httpd - '''HTTPD Config Info'''
			* /gainspan/system/config/id - '''Hostname and UID/MAC'''
			* /gainspan/system/config/otafu - '''OTA Firmware Update Info'''

			* /gainspan/system/prov/ap_list - '''List Access points and WiFi info'''
			* /gainspan/system/prov/scan_params - '''Wifi scanning parameters'''
			* /gainspan/system/prov/wps - '''WPS setup'''

			* /gainspan/system/fsupload - '''File System Upload'''
			* /gainspan/system/firmware/version - '''Gainspan Firmware Version Info'''
			* /gainspan/system/api/version - '''Gainspan API Version'''

			* /eapcerts.html - '''EAP Certificate Upload'''
			* /gsap.html - '''Gainspan AP Configuration'''
			* /gsclient.html - '''Gainspan Client Network Settings'''
			* /gsprov.html - '''Gainspan Network Device Setup'''
			* /otafu.html - '''OTA Firmware Update'''
			* /smartplug.html - '''Gainspan Smartplug Web Application'''
			* /sslcert.html - '''SSL Certificate Upload'''
			* /tls.html - '''TLS Web App'''

			== Gainspan SDK Pages Video ==
			Below is a video showing the pages accessible on the Ring Doorbell which are mostly just remnants from the GainSpan SDK.

			{{#ev:youtube\|wOFPfeYrlKo}}