Shitty Chinese WIFICAM cameras 0day root exploit alert

Fabio72

My chinese Dahua(!!) and Hickvision cameras and DVR are on a locked down VLAN. Remote access is done with VPN or a zoneminder streaming server on another VLAN.
They have only NTP access to pfsense. No DNS resolution or anything else.

Hickvision are pretty decent hardware, but often come from a grey market, with hacked chinese firmwares you cannot update without loosing english language.

Soarin

@johnpoz:

How do I bridge all the interfaces so everything is on 1 network ;)

That's hilarious

Guest

@Soarin:

@johnpoz:

How do I bridge all the interfaces so everything is on 1 network ;)

That's hilarious

It would be if it was not so worrying and true!

A Former User

???

iot.gif_thumb

Guest

Does it link to Alexa and order a new roll when there are only a few sheets left?

A Former User

@marjohn56:

Does it link to Alexa and order a new roll when there are only a few sheets left?

Still looking for the damn JTAG to see what crap firmware it has. Who knows what it is reporting. :o

Guest

@webtyro:

Still looking for the damn j tag to see what crap firmware it has. Who knows what it is reporting. :o

Perhaps if it all links together it will know when you've ordered a curry and will order extra rolls! ::)

Soarin

@webtyro:

???

Presbuteros

@marjohn56:

@webtyro:

Still looking for the damn j tag to see what crap firmware it has. Who knows what it is reporting. :o

Perhaps if it all links together it will know when you've ordered a curry and will order extra rolls! ::)

Any coder worth his weight in curry would write a proximity alert package to start pre-feeding sheets as your running towards it to tcpdump….

pfBasic

So I'm simple when it comes to IT, I read through this but most of it doesn't make much sense to me.

One of the main things I took away was this:

It’s useful to note the tunnel bypasses NAT and firewall, allowing the attacker to reach internal cameras (if they are connected to the Internet)

I certainly don't understand how the tunnel just "bypasses a firewall"? Either way it sounds like so long as the device doesn't have internet access then this is a non-issue?

I have a cheap IP Cam, I believe that my configuration for it is secure but having seen this I'd like to ask here to get some feedback from those who know what they are talking about.

My IP Camera is on my LAN
My LAN rules are whitelist & IPv4 only
The only remote access to the Camera is over my OpenVPN server
The first three rules (after pfBlockerNG) are for the IP Camera(192.168.30.13):

Pass/IPv4/UDP/192.168.30.13/any/192.168.30.1/123/any
Block/IPv4/any/192.168.30.13/any/any/any/any
Block/IPv4/any/any/any/192.168.30.13/any/any

Is this secure?

Fabio72

Since my IPCAM use also ipv6, I choose to put them all on a dedicated vlan with no internet gateway at all.
My first solution has been put them on a blacklist alias.

jahonix

@Jailer:

Good lord after looking at that list is there ANYONE that makes a decent IP camera?

Bosch and Dallmeier probably

doktornotor

Also the dummy plastic ones should be pretty safe.

silverJ

@Jailer:

Good lord after looking at that list is there ANYONE that makes a decent IP camera?

I believe foscam are originally made from Canada. Not just sure about its video quality.

pfBasic

Company Profile
ShenZhen Foscam Intelligent Technology Co.,limited is a leading professional high-tech company which provides IP video camera and solutions in China.

Foscams are well known for their awful security. I wrote the above firewall rules to try to secure my Foscam.
Still interested in any feedback on if I can consider my Camera secure or not?

johnpoz

"Block/IPv4/any/any/any/192.168.30.13/any/any"

That is on your lan interface tab, and your lan network is 192.168.30 and your camera is .13??

That rule is useless on the lan interface.. Nothing on the lan would be talking to pfsense to talk to your camera. And if the traffic was coming from the internet or another vlan the rules on the lan interface are not evaluated.

If you would like your rules exampled - them post them.. not this ascii art..

""bypasses a firewall""

You don't understand how tunnel through a firewall outbound can be used to talk to the client behind the firewall without the firewall doing anything about that traffic??

pfBasic

I don't have access for screenshot right now, but is the attached screenshot clearer for the rules?

I'm not trying to block the IP Camera from the LAN, I access it with devices on the LAN. I'm trying to block it from the web.

Untitled.png_thumb

kpa

The third rule is entirely non-functional assuming you have correct WAN rules that are not allowing incoming connections to the camera.

And yes, pfSense does stateful filtering and that means you'll never need the kind of rules the the third rule is now. Return traffic for connections is automatically handled by the state mechanism and you don't have to take it into account either when writing block rules, block only on the side where the connections are coming from.

pfBasic

Yeah that's what I thought, I put them on there while jsut starting out pfSense, deleting that rule.

silverJ

@pfBasic:

Company Profile
ShenZhen Foscam Intelligent Technology Co.,limited is a leading professional high-tech company which provides IP video camera and solutions in China.

Foscams are well known for their awful security. I wrote the above firewall rules to try to secure my Foscam.
Still interested in any feedback on if I can consider my Camera secure or not?

Thanks for the heads up about foscam poor security features.