this post was submitted on 26 Jul 2024
237 points (99.6% liked)

Privacy

4285 readers
87 users here now

A community for Lemmy users interested in privacy

Rules:

  1. Be civil
  2. No spam posting
  3. Keep posts on-topic
  4. No trolling

founded 2 years ago
MODERATORS
iopq
237
Matt Brown Digs Deep Into an IP Camera's Firmware — and Finds a Hard-Coded Root Password (www.hackster.io)
submitted 4 months ago by [email protected] to c/privacy
16 comments fedilink hide all child comments
top 16 comments
sorted by: hot top controversial new old
[–] corroded 52 points 4 months ago (3 children)

This is one of several reasons why I keep all my cameras and any other IoT devices on a separate VLAN that has no access to the internet and no access to the rest of my home network. The only bridge is my DVR server, but that's something I can't get around.

Before it was set up this way, I saw a huge amount of requests on my DNS server from the cameras, each one resolving the manufacturer's domain name. It was probably innocuous, but why take the risk? There is absolutely no reason whatsoever that a security camera needs access to anything.

[–] [email protected] 16 points 4 months ago (2 children)

There is absolutely no reason whatsoever that a security camera needs access to anything.

NTP is useful to correct clock drift, but otherwise, I'd agree.

[–] kn33 7 points 4 months ago* (last edited 4 months ago)

That's true, but you could run NTP on the NVR or something. Or just whitelist the NTP server.

[–] haulyard 4 points 4 months ago (2 children)

Serious question here as I’ve been debating moving all smart home stuff to either its own vlan (never done this before) or a different wireless network. I’ve got some POE cams that run through Scryoted on my nas to get into homekit. Is this all possible if the NAS is on a different network? Would I then have to move all my HomeKit hub devices (Apple TV, HomePod mini, etc) then also have to move?

[–] [email protected] 4 points 4 months ago* (last edited 4 months ago) (1 children)

So, the way you would do this is creating separate VLANs, then using firewall rules to filter what communication is allowed between them.

In my home for example, I use a few smart devices that are controlled over the LAN from your phone. Think like a chrome cast. I would rather those devices be on my IoT network than my main, but they break if devices from my primary network can’t find them.

So I allow only those specific devices to communicate across my VLANs, with other devices (cameras, lights, etc) being dropped at the firewall.

That’s the basics and can be accomplished with any semi-decent router/firewall. If you have any more specific questions regarding what hardware you have available shoot me a message and we can talk through it

[–] sep 1 points 4 months ago (1 children)

Depends a bit on the device. But dor many it should be possible if you run a mdns repeater / proxy on the firewall.

[–] [email protected] 1 points 4 months ago

That’s way over complicating things for what ip is trying to accomplish

[–] [email protected] 2 points 4 months ago

Depending what's you router you can usually open communication between different VLAN for specific ip/port. So let's say your camera use rtsp to send video data to your NVR you could allow for port 554 to be opened between your camera ip and the NVR.

This means that even if someone has access to your camera they couldn't do an ssh (port 22) or http/https (80/443) requests to your internal network.

For PoE cams installed outside, creating a separate VLAN is an absolute must. Otherwise anyone could use the Ethernet cable to access your network and steal your data.

[–] [email protected] 4 points 4 months ago (2 children)

Any recommendations on cameras that work well local-only/don't seem to make peculiar DNS requests?

If I ever get around to installing cameras I'll have them on their own, no-internet VLAN, but would prefer having well-behaved devices.

[–] [email protected] 4 points 4 months ago (1 children)

I'm a big fan of the Ubiquiti security cameras - all local data, decent quality. The downside is the price and availability, but if you can swing it - they're pretty great.

[–] [email protected] 2 points 4 months ago

Nice, thanks!

[–] corroded 3 points 4 months ago (1 children)

I have always used Amcrest cameras; they're not expensive, and they tend to work well. They do make requests back to amcrest.com, but I don't know for sure if that's anything nefarious or if it's just part of their built-in "cloud" capability or perhaps they're looking for firmware updates. They integrate nicely with BlueIris or Frigate. I use BlueIris in a VM with virtual network adapters to my home network and my "camera" VLAN. BlueIris is accessible through a reverse proxy, but the cameras themselves have no access to the outside world.

If you're able to find a camera that doesn't try to "call home," I'd be surprised. At the very least, most manufacturers build in some kind of cloud accessibility into the camera's firmware. In their defense, I think that most consumers want this capability; it's much easier just to use the manufacturer's app than to set up a self-hosted DVR.

So to answer your question, no, I don't have a good suggestion, but I also don't think that what you're asking for really exists (as unfortunate as that is). You could always set up a small SBC (like a raspberry pi) with a USB camera, but at that point, it'd probably be more cost-effective to just buy off-the-shelf cameras and some VLAN-aware networking hardware.

[–] [email protected] 1 points 4 months ago

Thanks! That sounds like a good option. Mostly would want to avoid something that's flooding the network with DNS requests

a few attempts at phoning home now and then are, like you say, probably inevitable.

[–] [email protected] 1 points 4 months ago

Wouldn't a tunnel work for your dvr

[–] Blaster_M 22 points 4 months ago

slow clap

[–] [email protected] 0 points 4 months ago

Very cool. If telnetd is on there, maybe it's already running and just spinning it up could be enough to then log into it - dunno if he tried that already. That would be even worse because anybody with access to the WLAN could then log into the camera if it's on the same network.

Anti Commercial-AI license