Teardown of a Hidden Spy Camera

I’m continuously fascinated by how technology can be used, and abused, and also how it evolves and fills niches. So when I came across what, for me, was a whole new product category a few weeks ago I became rather fascinated.

One way of remaining hidden is to hide in plain sight, overlooked. So one way to hide a camera in a room is going to be to put it inside an everyday object. But the big problem with most cameras is that they need power, especially if you want or need one that will take continuous video.

So the obvious solution, perhaps, is to hide one inside a USB charger?

Measuring 30mm×28mm×35mm, and looking just like yet another generic cheap knock-off USB charger, there isn’t anything obviously different about this hidden camera. Plugging it into the wall it functions just as you’d expect.

Go ahead and plug your Kindle in to charge, it’ll work just fine.

Plugging the charger in you’ll see a blue LED pulse for a short time in the upper left, before going out. After that it just looks like and acts like a normal charger. However it’ll now be recording sound, and video footage at 1080P. When the built-in storage is full it’ll start recording over the oldest footage.

Flipping the charger around there isn’t anything obviously odd there either. Although if you get suspicious for some reason, and start to Google the model number, you’re going to be left much more suspicious afterwards.

Because if you take a second up close look at the front, in just the right light, you might just see something that makes you somewhat suspicious. A small circle just above the USB socket that’s just about visible if you tilt the charger.

Prying off the face plate from the front of the charger is trivial, it’s just tacked down with fairly weak glue, and doing so reveals the camera. The other hole in the backplate, to the top left, is there for the LED that briefly flashes when you plug the camera in and, perhaps oddly, after you remove it from the wall.

From here it is pretty easy to lever the casing of the phone apart with a metal spudger, there are no screws or glue, although if you pick one up and want to follow along you should be careful because the outside case is pretty fragile. Mine isn’t going back together, at least not seamlessly enough so that it’d be much use as a “hidden” spy camera any more.

Inside the charger are two boards hooked together by four wires—red, black, green, and yellow—which are the power, ground, TX and RX wires.

The two boards serve very different functions. The first, on the right in the picture, is the power board. It handles converting the mains supply down to something a bit more friendly to electronics.

It all looks pretty standard, if not amazingly well put together. Although as well as providing power to USB socket mounted on the board it also passes both +5V and the USB data lines through to the second board.

This second board is where everything interesting happens. This has the camera, a small microphone, a socket for a micro SD Card, a small LiPo battery connected to the board using flying leads, and the camera itself.

The camera is a Novatek NT99142, an HD CMOS image sensor. While I can’t find much information on this particular sensor, the sheets the NT99140 and NT99141 sensors are readily available. Both are 1/4 inch sensors with a two wire serial interface, and both have a resolution of 1280×720, or 720P.

Since this hidden camera is advertised as having a resolution of 1980 × 1080, or 1080P, it makes sense that the NT99142 is the big brother of the other two parts. Perhaps it is just newer, which would explain why the datasheet hasn’t leaked out onto the Internet quite yet?

The LiPo battery connected to the board is tiny, I don’t have one that small in my parts drawer. It’s less than half the size of the small 140 mAh ones I do have on hand, so I’m guessing it’s perhaps 60 mAh at best. My bet is that it’s there to make sure any footage in memory is saved to the SD Card and all the files are properly closed after you unplug the camera from its wall socket.

It’s also bulging rather alarmingly at this point, after a couple of hours usage. Which probably explains why the camera gets so hot during use. I’m not quite sure I’d plug it in again, even if I had any use for a hidden camera.

The included micro SD Card has a capacity of 32GB, and with that capacity it could well account for a quarter of the bill of materials cost. The small chip just to the left of the SD Card slot is a 25D40BTIG, a serial flash chip, which is presumably used for buffering footage onto the SD Card.

The way you get the footage off the camera is using a USB-A to USB-A male-to-male lead. Plugging one end into the charger, when it’s not plugged into the wall, and the other into your laptop, the SD Card will mount as an external drive and any footage that the camera has recorded will be on it. Neatly divided into 3 minute segments, which is presumably something to do with the maximum file size of the card, as it’s formatted in some form of MS-DOS FAT filesystem, although oddly not one that will directly mount under macOS as—when it’s removed from the camera and plugged directly into my laptop—it doesn’t mount at all.

Flipping the board over and we find the main chip, and here I’m stumped. Normally I’m pretty good at identifying interesting IC’s, but I don’t have clue about this one. I can’t find any information about it on the Internet, and I don’t immediately recognise the manufacturer’s logo.

The prefix prepending the serial number might well refer the to the Beijing Economic-Technological Development Area (BDA), but that’s really rather a stretch. Otherwise, other than this is the chip that handles the data from the camera, and mounting the SD Card externally. It sort of has to be, because there isn’t any other large footprint silicon in evidence.

Which is where our story ends, with hopefully someone else picking up the baton and going forward, because I’d really like to know more.

Because you don’t need to poke around on AliExpress, Alibaba, or Taobao — the Chinese facing site that’s increasingly being used by Westerners to find hard to source parts. These cameras are readily available on Amazon for $20 or $30, and show that the “peace dividend” smart phone wars can still be put to offensive use.

Update: It appears the logo on the mystery chip belongs to a company called AppoTech.