Hubble Motorola Focus 66-W Camera "CameraHD" setup

motorola_camera_setup.md

Use the Hubble app to get the camera connected to a wifi network.

Find the Camera's IP address:

> sudo arp-scan --interface=enp3s0 --localnet
Interface: enp3s0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.100	00:19:99:0f:6a:98	Fujitsu Technology Solutions
192.168.1.102	c4:6e:1f:53:f0:8b	(Unknown)
192.168.1.111	00:04:ed:01:72:da	Billion Electric Co., Ltd.
192.168.1.158	7c:2f:80:49:a4:de	Gigaset Communications GmbH
192.168.1.174	c8:1f:66:4b:f5:7f	(Unknown)
192.168.1.150	64:bc:0c:48:79:9d	(Unknown)
192.168.1.188	b8:27:eb:e4:1b:51	(Unknown)
192.168.1.214	38:2c:4a:bb:f9:9e	(Unknown)
192.168.1.234	c8:1f:66:b0:19:9a	(Unknown)
192.168.1.210	00:0a:e2:13:8b:e0	Binatone Electronics International, Ltd < this is the camera
192.168.1.253	7c:2f:80:7b:5b:61	Gigaset Communications GmbH
192.168.1.245	c8:bc:c8:e9:25:27	Apple
192.168.1.166	2c:f0:a2:7a:2a:c8	(Unknown)

Connect to the camera with VLC:

vlc rtsp://user:pass@192.168.1.210:6667/blinkhd

Using ip address from above

---

Urls:

• http://192.168.1.210:8080/fwupgrade.html
• http://192.168.1.210:8080/cgi-bin/logdownload.cgi
• http://192.168.1.210:8080/cgi-bin/haserlupgrade.cgi
• http://192.168.1.210:8080/cgi-bin/fullupgrade
• http://192.168.1.210:8080/test.html
• http://192.168.1.210/test.html

To issue commands quotes matter!:

curl "http://192.168.1.210/?action=command&command=plus_brightness"

links:

• https://github.com/Erliz/hubble-sniffer
• http://www.contextis.com/resources/blog/push-hack-reverse-engineering-ip-camera/
• https://www.ispyconnect.com/man.aspx?n=motorola - no use

Looks like the RTSP stream doesn't work anymore, currently on FW 0066-03.10.24.

Same here: model: 0335, version: 03.30.36

Same here, 0335 firmware 03.30.36.
Shame.

Same here, none of the URLs / protocols work
My camera is a Motorola Focus 66-b with firmware version 03.10.24.

I tried all combinations / options docummented below and none worked :(
https://github.com/jacace/onvif_rstp/blob/master/README.md

My guess is, given the age of a lot of this reverse engineering etc, that recent versions of firmware (^3.x.x) have hidden or "fixed" a lot of these easily reachable URLs.

My nmap results only show open ports 80 and 8080, the 8080 one is a BusyBox service.
Some of the general commands work on the root 80 server, but I haven't seen any obvious calls like "get video stream URL" or "open websocket connection to XYZ" etc, so a bit stuck.

Why the sudden increase in interest in this?

Why the sudden increase in interest in this?

@samuelcolvin I became a parent and we bought a Motorola monitor, and the Hubble app is still garbage 🤷‍♂️.
It's tolerable, but there's so much nonsense and poor UX with it that I'd prefer to make a minimalist one myself, basically just the video stream.
Controls for movement would be nice too but optional.

Why the sudden increase in interest in this?

Well I have had this Motorola focus 66-b camera for a while and now got some free time to try somethign on it but as things stand now it seems not posible.

@jacace , here's some random links that are similarly old/outdated but nonetheless kinda helpful for "hacking"/reverse engineering Motorola baby monitors.

• http://atom0s.com/forums/viewtopic.php?t=45
• https://www.sjoerdlangkemper.nl/2019/03/27/hacking-the-motorola-mbp88connect-wifi-camera/
• https://blok.tiyun.de/2015/view-your-hubble-camera-stream-whereever-you-want
• https://github.com/Erliz/hubble-sniffer
• http://www.surfrock66.com/improving-the-motorola-blink-baby-monitorcamera/
• https://simon.aldrich.cc/blog/2013/08/motorola-blink1-hacking/

I hope someone finds a new streaming solution for this. 03.10.24

Can we not stay on the old Firmware or does it automatically update itself?

@capsload2 You probably could. I've thought about doing that, but don't want to sift through changelogs and figure out if any critical security updates were made in recent versions.

Why the sudden increase in interest in this?

@samuelcolvin
Sorry, I couldn't find anywhere a solution to it so I posted a message about it not working, and I guess some people wondered the same thing while searching online.

I became a parent and we bought a Motorola monitor, and the Hubble app is still garbage 🤷‍♂️.
It's tolerable, but there's so much nonsense and poor UX with it that I'd prefer to make a minimalist one myself, basically just the video stream.
Controls for movement would be nice too but optional.

@rkdavidson
I bought a Foscam camera (FI9821P) that is configured for LAN/VPN-only access (considering their poor security track record). At least those have an RTSP stream available and the image quality is actually quite good even in night-mode.

Sucks that Hubble requires an Internet middle-man to work.

Any workarounds found? Is there anyway to get this to work via Tinycam Monitor and serve it that way?

Figuring out a way beyond the internet middleman services Hubble requires is beyond my skills :(.

I think a known route would be revert your camera's firmware to factory (or near it), to go back to the fairly insecure (i.e. open) setup outlined in this gist.

Motorola are real ****ards for this. Camera is useless without a paid subscription. Shame because that external antenna on my Focus 66 W was helpful when it worked. Would love to flash custom or original firmware.

I threw mine in the e-waste bin, not giving them a single penny.