# Storm on the Horizon: Inside the AJCloud IoT Ecosystem

AJCloud platform lacks auth on deviceId-based API and P2P commands, letting anyone with a camera serial access streams, control cameras, and brick devices.

- Payout: Research
- Severity: critical
- Program: AJCloud
- Credited: Mark Mager,Eric Forte
- Disclosed: 2024-09-20
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/blog/storm-on-the-horizon
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-blog-storm-on-the-horizon
- Tags: domain:cloud domain:iot impact:ato impact:data-leak impact:dos kind:research platform:threat-intel sev:critical technique:reverse-engineering technique:source-review vuln:access-control vuln:auth-bypass vuln:memory-corruption

**Target:** IoT Wi-Fi camera cloud platform, Windows app, and P2P protocol
**Root cause:** Cloud API endpoints and P2P MSG_DRW commands authorize solely by deviceId/serial number with no authentication or ownership check; syscfg_setAjySnParams uses strcpy on unbounded MSG_DRW input into fixed globals.
**Steps:**
1. Obtain target camera deviceId (printed serial sticker) or read from Windows app logs
2. Set breakpoint in Wansview Cloud Windows app where deviceId is sent to `https://sdc-us.ajcloud.net/api/v1/dev-config`, swap deviceId in memory, resume
3. App returns target camera metadata, connects to its video/audio stream and controls it
4. Alternatively send UDP `MSG_HELLO` to P2P server on port 60722, then `MSG_P2P_REQ` with target deviceId, follow `MSG_PUNCH_TO` and hole-punch with `MSG_PUNCH_PKT`
5. Send `MSG_DRW` commands to pan/tilt, reboot, play audio, or overwrite `/var/syscfg/config_default/app_ajy_sn.ini`
6. Craft oversized MSG_DRW string params to overflow strcpy in syscfg_setAjySnParams for potential RCE
**How found:** Android app resisted MitM due to cert pinning; pivoted to Windows 7 app whose verbose debug logs leaked cleartext credentials and full JSON POST traffic. Noticed deviceId in dev-config request, hypothesized no ownership check, and swapped it in a debugger. Hardware UART teardown (no secure boot) gave root shell and firmware for reverse engineering initApp and P2P protocol.
**Exploitation:** Attacker needs only a camera's deviceId (serial number on sticker). Swapping deviceId in the Windows app or speaking PPPP P2P directly yields full remote control: live video/audio, pan/tilt, config writes. Overwriting app_ajy_sn.ini with malformed product/model/vendor/serial breaks startup curl calls and permanently bricks the camera.
**Escalation:** P2P arbitrary file write to app_ajy_sn.ini plus unbounded strcpy enables buffer overflow toward remote code execution; affects all AJCloud-firmware devices across vendors.
**Insight:** When mobile apps are hardened, hunt the legacy desktop client: verbose debug logs often dump full API traffic and credentials, and deviceId/serial parameters sent to cloud endpoints are prime candidates for swapping to test missing ownership checks.