Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?

Other Devices & Integrations Door Locks & Sensors
1

I have had some limited success with the Iris (Sercomm) RC8221 camera (available at Lowe’s) so far.
Here is the spec sheet:
http://www.sercomm.com/SWI/downloads/product/data_sheet/RC8221_EN.pdf

Basic Capture
I have plugged it into vera’s LAN and I do get a capture picture with it.
It does provide a capture on a web page. 192.168.x.y is in Vera’s LAN subnet.
http://192.168.x.y/img/snapshot.cgi

Full Motion
It’s in full color and does produce motion video

Night Vision
It does have LEDs that light up the area in front of it to take IR shots. This is automatic according to the spec sheet.

Wireless
I have not figured out how to pair it over Wi-Fi with my Vera 2.
I have not found its admin web pages yet.

The camera has a motion detector
I have not figured out how this works with the rest of the camera.

Does anyone have anything to add?

2

I am very interested in these cameras too… I was hoping to find a lower cost camera that I could pickup locally for use in my personal DVR using the free software from ACTI (free for up to 16 cameras).

This is what I have been able to find out:

H.264 streaming @ 640x480, 5 fps (large delay), no audio, address:
http://<ip_of_camera>/img/video.sav

H.264 streaming @ 640x480, 5 fps (large delay), with audio, address:
http://<ip_of_camera>/img/media.sav

Audio only streaming, address:
http://<ip_of_camera>/img/audio.sav

H.264 streaming @ 1280x720, 30 fps (small delay), no audio, address:
http://<ip_of_camera>/img/video.sav?channel=2

H.264 streaming @ 1280x720, 30 fps (small delay) , with audio, address:
http://<ip_of_camera>/img/media.sav?channel=2

There does not seem to be any web interface… I think it was stripped out of the product…
There are some admin CGIs that are available under the http://<ip_of_camera>/adm/ folder but I have not been able to figure out the credentials yet.
Sercom documentation states the default username is “administrator” with a blank password… but it looks like Lowes changed the password.

I hope that helps a bit… if someone has the oppertunity to figure out the admin password, that would be great… I’m not great at password cracking myself.

I’m hoping the forum will allow me to attach the PDF I found for the exact same camera, just rebranded. All the user and admin API commands are listed in the couple last sections of the document. This shows a web interface… but I’m guessing it can be stripped out (or at least turned off) by the company that is OEMing the product.

Well, it won’t let me attach it… it’s toobig, even compressed. Hopefully you can still get it from the following URL:
www(dot)eyespy247(dot)com-site/media-support/docs-support_35.pdf

Please post back if you uncover anything… I’m curious to know if I can use this for my project too.

3

Your download URL for the spec sheet is somewhat messed up. The correct one is:

http://www.eyespy247.com/site_media/support_docs/support_35.pdf

I wonder if these camera’s can be re-flashed with the factory firmware to restore full functionality. Such as can be done for the Schalge/ADT ones. The firmware is on the website and there is the http:///adm/upgrade.cgi (Upgrade Firmware) admin command. It also appears to have a read and update config option. Only to wait until someone figures out the admin password and is willing to risk bricking a $129 camera. :slight_smile:

4

Sorry about that… the board would not allow me to post links to extenal sites so I had to try to mod it a bit… I’m guessing I have not passed a post threshold.

I’m thinking the flash would work just fine… it’s just a rebranded RC8221 from Sercomm… I ended up taking the camera back for now I was getting too tempted to open it up and see if there was a jtag port in it :slight_smile:

I’ll see if I can find anything out about these cameras… there is probebly some backdoor password we could use…

5

Search the FCC ID Grantee Code: P27 Product Code: -RC8221
on FCC’s website: [url=http://transition.fcc.gov/oet/ea/fccid/]http://transition.fcc.gov/oet/ea/fccid/[/url]
Yields this:
[url=https://apps.fcc.gov/eas/GetApplicationAttachment.html?id=1418905]https://apps.fcc.gov/eas/GetApplicationAttachment.html?id=1418905[/url]

6

I’ve been digging on the hub and the camera…

while monitoring with tcpdump, i found the UPNP traffic the camera sends out, including a link to:
it’s IP: 192.168.1.114 Port:6789 Path: /device.xml (the board thought i was posting a link when I wasn’t, so i had to modify it)

which contains:

<root xmlns="urn:schemas-upnp-org:device-1-0">
<specVersion>
<major>1</major>
<minor>0</minor>
</specVersion>
<URLBase>http : //192.168.1.114:6789</URLBase>
<device>
<deviceType>
urn:schemas-upnp-org:device:Wireless Network Camera:1
</deviceType>
<friendlyName>RC8221-RC82219278E2</friendlyName>
<manufacturer>Sercomm</manufacturer>
<manufacturerURL>http : //www.sercomm.com</manufacturerURL>
<modelDescription>Wireless Network Camera</modelDescription>
<modelName>Wireless Network Camera</modelName>
<modelNumber>RC8221</modelNumber>
<UDN>uuid:4d756c74-694d-6564-6961-000e8f9278e2</UDN>
<serviceList>
<service>
<serviceType>urn:upnp:service:BasicService:1</serviceType>
<serviceId>urn:upnp:serviceId:BasicServiceId</serviceId>
<controlURL>/upnp/control/BasicServiceId</controlURL>
<eventSubURL>/upnp/control/BasicServiceId</eventSubURL>
<SCPDURL>/scpd_basic.xml</SCPDURL>
</service>
</serviceList>
<presentationURL>http : //192.168.1.114</presentationURL>
<style type="text/css" style="display: none !important;">
object[classid$=":D27CDB6E-AE6D-11cf-96B8-444553540000"],object[classid$=":d27cdb6e-ae6d-11cf-96b8-444553540000"],object[codebase*="swflash.cab"],object[data*=".swf"],embed[type="application/x-shockwave-flash"],embed[src*=".swf"],object[type="application/x-shockwave-flash"],object[src*=".swf"],object[codetype="application/x-shockwave-flash"],iframe[type="application/x-shockwave-flash"],object[classid$=":166B1BCA-3F9C-11CF-8075-444553540000"],object[codebase*="sw.cab"],object[data*=".dcr"],embed[type="application/x-director"],embed[src*=".dcr"],object[type="application/x-director"],object[src*=".dcr"],object[classid$=":15B782AF-55D8-11D1-B477-006097098764"],object[codebase*="awswaxf.cab"],object[data*=".aam"],embed[type="application/x-authorware-map"],embed[src*=".aam"],object[type="application/x-authorware-map"],object[src*=".aam"],object[classid*="32C73088-76AE-40F7-AC40-81F62CB2C1DA"],object[type="application/ag-plugin"],object[type="application/x-silverlight"],object[type="application/x-silverlight-2"],object[source*=".xaml"],object[sourceelement*="xaml"],embed[type="application/ag-plugin"],embed[source*=".xaml"]{display: none !important;}
</style>
</device>
</root>
7

Do you have an Iris controller, or were you just hooking up the camera to your LAN and sniffing the traffic? I would be curious to see what the traffic to the camera looks like during setup.

8

Both. I’ve tried doing MITM stuff, and actually watching it on the Iris controller. I’ve made a lot of progress on the ‘internals’ of the Iris hub. It’s on another forum though, and i’m not sure if i’m allowed to link to the thread posts i’ve made. The traffic visible on the hub itself in the logs, is minimal… you just vanilla messages… If I actually run a ‘strings’ on the Iris ‘hubapp’ program, i see all the urls it’ll ever use to talk to the camera… I even have access to the certs and private key now for the camera, sitting on the hub… but i’ve yet to be able to get anywhere with any of it… I’ve emailed the manufacturer of the camera, twice. (Sercomm), no response. All traffic is SSL encrypted. (hence my attempts at doing a MITM attack on it)

All the Iris log shows is crap like this:
2012-11-14 14:20:18 :[GENERIC] CAM: 00-00-00-0E-8F-92-78-E2: Hub camera certificate
2012-11-14 14:20:18 :[GENERIC] PUBLIC KEY MEM 0
e2012-11-14 14:20:18 :[GENERIC] CAM: format_get_wireless
v2012-11-14 14:20:18 :[GENERIC] CAM: 00-00-00-0E-8F-92-78-E2: LQI 99

Update:

It would appear, they use passphraseless private keys on the hub for the camera, etc… That makes my job a lot easier all the sudden.

9

I found that the little 4 pin connector on the board of the camera is infact a TTL serial port, so i hooked up my USB->TTL adapter, and got a console on the camera… I tried to paste the output here, but there’s a 20k character limit…

10

Sorphin, it looks like you’ve made a bit of progress, having found the console serial port. What do you see?

11

usual console messages… kernel, apps starting, wifi / ethernet decision making… Unfortunately… the console doesn’t respond to input… (not sure if the hardware has been tampered with, or if it’s in their drivers… the same cable works just fine for the iris hub)… Also… The manufacturer is of no help, due to their contracts with Lowes… My contact DID however inform me, that in the coming months… “another major retailer” will be OEM’ing these same cameras, hopefully a bit more open than Lowes is. If you want the full log, i can provide that (since I can’t post it here, it’s too long)

12

I did run into this document, where the RC8221 is being used with a security server of some sort.
[url=http://buy.dmp.com/dmp/products/documents/LT-1249.pdf]http://buy.dmp.com/dmp/products/documents/LT-1249.pdf[/url]
They offer three ways the RC8221 can be setup, but none of them allow the WPA2 keys to be set. All Wi-Fi methods they present involve a WPS setup method.

13

[quote=“kgrr, post:12, topic:172788”]I did run into this document, where the RC8221 is being used with a security server of some sort.
[url=http://buy.dmp.com/dmp/products/documents/LT-1249.pdf]http://buy.dmp.com/dmp/products/documents/LT-1249.pdf[/url]
They offer three ways the RC8221 can be setup, but none of them allow the WPA2 keys to be set. All Wi-Fi methods they present involve a WPS setup method.[/quote]

Unfortunately, most things don’t support WPS now (insecurity), and these cameras, when IRIS’d, limit themselves to 720p @ 5fps max, and stuff like that.

14

Sorphin, I’m interested in where that thread is for the Iris Hub you have on another Forum. I have created an SDK for accessing all of their HTTPS cloud based api calls, in C#/.net 4.5. I’m about to open source it, it’s complete with the exception of Magic, Senior Care, and Energy (haven’t had the money to buy the devices).

Cheers!

15

[quote=“blakemanster, post:14, topic:172788”]Sorphin, I’m interested in where that thread is for the Iris Hub you have on another Forum. I have created an SDK for accessing all of their HTTPS cloud based api calls, in C#/.net 4.5. I’m about to open source it, it’s complete with the exception of Magic, Senior Care, and Energy (haven’t had the money to buy the devices).

Cheers![/quote]

It’s not directly for the Iris hub, but there are talks about it on there…
http://forum.alertme.org.uk/viewtopic.php?f=4&t=97&p=328

16

Thanks!

17

Where’s the SDK/API?

18

found strings for getting images and video from these cameras, unfortunatly without the iris hub i couldn’t figure out how to set it up for alarming (or some kind of admin console)

I port scanned it, and see that 6789 is probably port for an ibm db2 database, and wonder if maybe the values for the camera are stored that way, rather than some config file. The proper “client” would be able to change the values, and therefore the way the camera works.

Host is up (0.0064s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
554/tcp open rtsp
6789/tcp open ibm-db2-admin
MAC Address: 00:0E:8F:D5:40:A0 (Sercomm)

Unfortunately I didn’t really want to spend more time trying to hack it, so I returned it.

19

does anyone can will set up iris camera

20

For what it’s worth, in case anyone is trying to use this camera with Vera, I got it working.

To set the cam up in vera:

Manually create a device with device type: urn:schemas-upnp-org:device:DigitalSecurityCamera:1
input the IP and MAC address for the cam
use device file D_DigitalSecurityCamera1.xml
Direct Streaming URL /img/video.mjpeg
JPG URL /img/snapshot.cgi?size=3&quality=5
AutoArchivePreserveDays use whatever you want. I use 45
Pre-roll buffer size I use 1000

I ended up buying an Iris hub so I could update the firmware when updates are released, and set up wifi connectivity for the cam. If you keep your eye open on ebay hubs come up from time to time for $50 or so. It’s not necessary if you’re running the camera with an Ethernet cable or if you don’t care about FW updates. Probably not worth it for a single cam, but if you plan to run this one and their outdoor camera (which uses the same configuration for vera - and works very well), it might be worthwhile.