Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Shitty Chinese WIFICAM cameras 0day root exploit alert

    Scheduled Pinned Locked Moved Off-Topic & Non-Support Discussion
    40 Posts 19 Posters 6.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      "Block/IPv4/any/any/any/192.168.30.13/any/any"

      That is on your lan interface tab, and your lan network is 192.168.30 and your camera is .13??

      That rule is useless on the lan interface.. Nothing on the lan would be talking to pfsense to talk to your camera.  And if the traffic was coming from the internet or another vlan the rules on the lan interface are not evaluated.

      If you would like your rules exampled - them post them.. not this ascii art..

      ""bypasses a firewall""

      You don't understand how tunnel through a firewall outbound can be used to talk to the client behind the firewall without the firewall doing anything about that traffic??

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • P
        pfBasic Banned
        last edited by

        I don't have access for screenshot right now, but is the attached screenshot clearer for the rules?

        I'm not trying to block the IP Camera from the LAN, I access it with devices on the LAN. I'm trying to block it from the web.

        Untitled.png
        Untitled.png_thumb

        1 Reply Last reply Reply Quote 0
        • K
          kpa
          last edited by

          The third rule is entirely non-functional assuming you have correct WAN rules that are not allowing incoming connections to the camera.

          And yes, pfSense does stateful filtering and that means you'll never need the kind of rules the the third rule is now. Return traffic for connections is automatically handled by the state mechanism and you don't have to take it into account either when writing block rules, block only on the side where the connections are coming from.

          1 Reply Last reply Reply Quote 0
          • P
            pfBasic Banned
            last edited by

            Yeah that's what I thought, I put them on there while jsut starting out pfSense, deleting that rule.

            1 Reply Last reply Reply Quote 0
            • S
              silverJ
              last edited by

              @pfBasic:

              Company Profile
              ShenZhen Foscam Intelligent Technology Co.,limited is a leading professional high-tech company which provides IP video camera and solutions in China.

              Foscams are well known for their awful security. I wrote the above firewall rules to try to secure my Foscam.
              Still interested in any feedback on if I can consider my Camera secure or not?

              Thanks for the heads up about foscam poor security features.

              1 Reply Last reply Reply Quote 0
              • S
                silverJ
                last edited by

                Has anyone tried the brand Net gear? How is it?

                1 Reply Last reply Reply Quote 0
                • M
                  MasterX-BKC- Banned
                  last edited by

                  a lot of these cheaper cameras use the same software, and pcb boards inside varying shaped and branded housings ive noticed, amazon is a good place to look and see identical cameras listed under 10 different brand names.

                  1 Reply Last reply Reply Quote 0
                  • S
                    silverJ
                    last edited by

                    I bought a Go pro 3 black edition and a couple of truck accessories at 4WheelOnline. In the box it stated it has an IP Camera function/capabilities. Anyone tried it yet?

                    I found a link how to have it done; http://www.instructables.com/id/Gopro-Hero-3-Black-Edition-IP-camera/

                    1 Reply Last reply Reply Quote 0
                    • K
                      kapara
                      last edited by

                      Many cameras are made by hikvision though they have their own firmware versions.  I generally recommend going with hikvision since they put out new firmware versions on a regular basis.

                      Skype ID:  Marinhd

                      1 Reply Last reply Reply Quote 0
                      • JailerJ
                        Jailer
                        last edited by

                        Heh, where I live a hick vision camera would be very appropriate.  ;D

                        1 Reply Last reply Reply Quote 0
                        • B
                          bilbo
                          last edited by

                          Is it possible to securely access the cameras via the vpn server, blocking outbound over the normal wan gateway or is that still to much of a risk?

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            What do much of a risk - a vpn to access your iot devices.  That would be fine.  If your worried about them phoning home or some bad place then block their outbound access.  This has nothing to do with your accessing them via a vpn connection.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • D
                              divsys
                              last edited by

                              If your worried about them phoning home or some bad place then block their outbound access.

                              Fully agree - 99% of the connection risk with any of the current IP cameras (good or bad) comes from the network design (or rather lack of).
                              The notion that you can attach these things willy nilly to your LAN, give them a random IP address via DHCP and let uPNP setup all your router's external port forwarding is Not Going to End Well.

                              Give the cameras and NVR their own network isolated from other traffic.
                              Add internal access only as necessary.
                              Allow external access through some means of VPN (NOT port forwarding!).

                              In other words apply some best network practices for potentially insecure devices that might have valuable information

                              -jfp

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                The notion that you can attach these things willy nilly to your LAN, give them a random IP address via DHCP and let uPNP setup all your router's external port forwarding is Not Going to End Well.

                                lol

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • T
                                  Temido2222
                                  last edited by

                                  If only IoT devices connected to a smart home system, and that connected to the internet. Eliminate the dozens of appliance specific attacks and eliminate the security issues

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    AR15USR
                                    last edited by

                                    @bilbo:

                                    Is it possible to securely access the cameras via the vpn server, blocking outbound over the normal wan gateway or is that still to much of a risk?

                                    Thats how i did it. 12 Hikvision IP cams connected to a Hikvision POE NVR. The NVE is connected direct to its own interface on my pfSense appliance with all outbound blocked (as well as access to/from any of the other interfaces). I VPN in to the network to view the live feeds when needed…

                                    FYI the industry is starting to wake up.

                                    http://z-wavealliance.org/mandatory-security-implementation-z-wave-certified-iot-devices-takes-effect-today/


                                    2.6.0-RELEASE

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.