CCTV insecurity

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › CCTV insecurity

1 | 2

tripp

3848 posts

Uber Geek

Trusted

Lifetime subscriber

#1782191 15-May-2017 08:29

jnimmo:

It's a bit like when your building security company installs a card access system and leaves the card encryption key as the well known default, hmmm

Or leaves a card on string next to the door scanner :P

raytaylor

4014 posts

Uber Geek

Trusted

#1782301 15-May-2017 09:54

Exactly - like if i was the designer of the wannacry malware, I would have had it bitcoin mining rather than encrypting data, on every pc, security camera and DVR i can get it on.

Ray Taylor

There is no place like localhost

Spreadsheet for Comparing Electricity Plans Here

Oblivian

7300 posts

Uber Geek

ID Verified

#1782668 15-May-2017 16:00

sbiddle:

Oblivian:

With what little knowledge I have on this other than sorting a few routing issues with a mates NVR, I take it it's referring to cameras offering a cloud connect solution and or single IP units with the dodgy chinese-english firmware that they open up

Rather than a single point such as an NVR being the risky part with its built in password change requirements and NAT and such

It's not just cameras - NVR's are just as risky. The issue also isn't just people seeing your cameras, it's the fact that much of the Chinese hardware has such poor code there are well known backdoors for many brands so is also being utilised for DDOS attacks.

There was also even a famous hack a few years ago using NVR's for bitcoin mining.

Hrm. So using the Hikvision remote app with the router doing an external port change to non standard NATing to standard inside one is at least a start... right (hopes)

richms

28187 posts

Uber Geek

Trusted

Lifetime subscriber

#1782733 15-May-2017 19:31

Not sure why people think a non standard port helps. All ports get scanned and indexed by what answers.

Richard rich.ms

Oblivian

7300 posts

Uber Geek

ID Verified

#1782749 15-May-2017 20:06

richms: Not sure why people think a non standard port helps. All ports get scanned and indexed by what answers.

Well short of not putting it on for him to remotely monitor, I couldn't find any other such ideal solution to at the least deter pre-set 'default known' attempts. VPN endpoiont and client would be too-hard bin material with most generic users.

Everything points at firmware fixes for the open holes in Hikvisions it seems, it has the latest. The default credentials - changed on install to the point he no longer even remembers admin (but made an administration user at the time) and the cameras are all sitting behind it's own NAT. But if people wanna check up on the dog in the back yard I doub't they will be too phased.

freitasm

BDFL - Memuneh
79289 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1782753 15-May-2017 20:09

Oblivian:

Everything points at firmware fixes for the open holes in Hikvisions it seems, it has the latest. The default credentials - changed on install to the point he no longer even remembers admin (but made an administration user at the time) and the cameras are all sitting behind it's own NAT. But if people wanna check up on the dog in the back yard I doub't they will be too phased.

And we know John and Jane doe are highly skilled and system administrators and know that their crappy camera has a new firmware and even know how to update it...

Oblivian

7300 posts

Uber Geek

ID Verified

#1782756 15-May-2017 20:13

freitasm:

Oblivian:

Everything points at firmware fixes for the open holes in Hikvisions it seems, it has the latest. The default credentials - changed on install to the point he no longer even remembers admin (but made an administration user at the time) and the cameras are all sitting behind it's own NAT. But if people wanna check up on the dog in the back yard I doub't they will be too phased.

And we know John and Jane doe are highly skilled and system administrators and know that their crappy camera has a new firmware and even know how to update it...

Indeed, at least as soon as I knew one was on premesis I pointed it out and made an attempt to secure it up :) Wasn't a simple case of jane purchases a good idea and plugs in.

And to that point, its even harder when they sell them online as 'hikvision' then turn up in a white box and only support ONVIF protocols. Keyword nabbers clearly. Often don't have a visible model number etc to source updates

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

richms

28187 posts

Uber Geek

Trusted

Lifetime subscriber

#1782759 15-May-2017 20:17

There are many brands that hikvision OEM for, and they then become responsible for software updates, not hik. There are some white box varients of it available out of the US, but I have not seen any locally yet. Most are resellers of ones they get from aliexpress so have whatever hacked firmware to make it english on a chinese domestic model.

Richard rich.ms

Oblivian

7300 posts

Uber Geek

ID Verified

#1782763 15-May-2017 20:20

richms:

There are many brands that hikvision OEM for, and they then become responsible for software updates, not hik. There are some white box varients of it available out of the US, but I have not seen any locally yet. Most are resellers of ones they get from aliexpress so have whatever hacked firmware to make it english on a chinese domestic model.

Tis what I fear some of them are. Mostly sourced from ebay ala ali. Where I could I jumped on them and turned off most the default services so the NVR only got the RTSP feeds

freitasm

BDFL - Memuneh
79289 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1782766 15-May-2017 20:24

Like most things in IoT (Internet of Things), which I call Internet of Unsecure Things...

gzcwnk

23 posts

Geek

#1784279 18-May-2017 14:40

"I see there are now a few of the newer models of DVR on aliexpress now use a cloud system rather than port forwards so I am thinking of getting customers to request cloud connected models now instead of the ones that require port forwards

So your password now gets stored on a dodgy website in china, I guess that is an improvement to an actual open port. I wonder how long it will be before someone will be selling addresses and logins to the cameras so the crims can just take a peak and figure out your habits (blackmail you?) and even if the house has anything worth stealing in it. Maybe once you have a IOT enabled fridge they can figure out what day to call so they get a good feed as well........nice.

Its also not just the aliexpress stuff either, when you start to look named brands seem little if any better.

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1784305 18-May-2017 15:34

And a blog post I started a long time ago that I finally got around to updating and posting.

https://www.geekzone.co.nz/sbiddle/8941

linw

2849 posts

Uber Geek

#1786771 23-May-2017 14:20

Thanks for that Steve.

1 | 2