Skip to content
Georg Lukas edited this page Nov 7, 2023 · 2 revisions

The NX series cameras are using Samsung's web services to send pictures via email over WiFi. The web services have been discontinued around January 2021.

OSS Implementation

There is a flask-based reimplementation of the Samsung NX Email Service that can be self-hosted to send emails from the camera, after redirecting DNS.

Protocol Analysis (NX300)

The camera will attempt the following when you try to send an email:

  1. HTTP GET http://gld.samsungosp.com/ -- this host is a CNAME to a non-existing AWS instance, causing the camera's "hotspot detection" to kick in and launch the browser to http://samsungimaging.com which is an empty 404 page. Redirecting this request and returning HTTP 200 is sufficient to continue the process
  2. HTTP POST http://www.ospserver.net/social/columbus/email?DUID=123456789033 with the below payload.
  3. The HTTP response for the POST must be 200 for it to "succeed" in the UI.
POST /social/columbus/email?DUID=123456789033  HTTP/1.0
Authorization:OAuth oauth_consumer_key="censored",oauth_nonce="censored",oauth_signature="censored=",oauth_signature_method="HmacSHA1",oauth_timestamp="9717886885",oauth_version="1.0"
x-osp-version:v1
User-Agent: sdeClient
Content-Type: multipart/form-data; boundary=---------------------------7d93b9550d4a
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Pragma: no-cache
Accept-Language: ko
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322; InfoPath.2; .NET CLR 2.0.50727)
Host: www.ospserver.net
Content-Length: 1321295

-----------------------------7d93b9550d4a
content-disposition: form-data; name="message"; fileName="sample.txt"
content-Type: multipart/form-data;

<?xml version="1.0" encoding="UTF-8"?>
<email><sender>Camera@samsungcamera.com</sender><receiverList><receiver>censored@censored.com</receiver></receiverList><title><![CDATA[[Samsung Smart Camera] sent you files.]]></title><body><![CDATA[Sent from Samsung Camera.
language_sh100_utf8]]></body></email>

-----------------------------7d93b9550d4a
content-disposition: form-data; name="binary"; fileName="SAM_4371.JPG"
content-Type: image/jpeg;

<snip>

-----------------------------7d93b9550d4a

There is a bug in the transmission, after the image there is no epilogue (----foo--) but just a boundary (----foo), so normal HTTP upload services will not consider this as a valid request.