Billy_ICU 0 Posted October 22, 2016 Change your security camera and security camera DVR passwords! Or disconnect them from the internet. Or both! Story about how the latest internet attack (10/21/2016) was caused by people connecting security cameras and security camera DVR's to the internet and not changing the factory default password. Story here.. https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/ List of devices... https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/ Larger... https://krebsonsecurity.com/wp-content/uploads/2016/10/iotbadpass-pdf.png Share this post Link to post Share on other sites
tomcctv 190 Posted October 22, 2016 Hi. It's not down to the security product as many of these reports say. Home networks or commercial networks can be made safe and it's simple to do. But the last 2 years free p2p and free cloud service is the main problem for Friday's attack. Buy any CCTV product and set it up yourself ignoring the makers instructions and your network will be safe. P2p and cloud .... This type of connection is plug it in to your network and it will auto config and setup..... But what IT truly means is. .... Plug in and it makes a big hole in your network take down your firewall and leave open for in out traffic Friday's attack took MAC address from 1000s of open networks and directed them to Dns.com. But people need to be educated quick ..... News reports blame CCTV equipment ..... But there is nothing to hack on a NVR DVRS or IP systems .... It's the free ease of setup p2p and cloud ..... That make it easy for your network to be open to anything. Share this post Link to post Share on other sites
StefanB 0 Posted October 25, 2016 The way I read this, the vulnerability is not a user settable parameter/password? Manufacturer backdoor of some type? Is it still possible to secure your network is a case like this? “The issue with these particular devices is that a user cannot feasibly change this password,” Flashpoint’s Zach Wikholm told KrebsOnSecurity. “The password is hardcoded into the firmware, and the tools necessary to disable it are not present. Even worse, the web interface is not aware that these credentials even exist.” Share this post Link to post Share on other sites
tomcctv 190 Posted October 25, 2016 The Chinese Ministry of Justice has threatened legal action against "organisations and individuals" making "false claims" about the security of Chinese-made devices. It follows a product recall from the Chinese electronics firm Hangzhou after its web cameras were used in a massive web attack last week. The attack knocked out sites such as Reddit, Twitter, Paypal and Spotify. The Chinese government blamed customers for not changing their passwords. LOVE IT. legal action against anyone making false claims a Chinese company admits too. But there fixed on customers not changing passwords....... But people have to start thinking on how it got passed your network to get to the device the password was not changed on .....which means it still attracts network. P2P is the problem. It's like locking up your car with windows open ..... P2P is the window switch to your router Share this post Link to post Share on other sites
annoyednow 0 Posted November 21, 2016 Mine got hacked and I didn't have P2P. Mine was set up on a DNS and I had a password for that which I'd changed. Unfortunately I later found out that the installer hadn't changed the main password when he installed it, and he didn't tell me there was another password to change until I did some digging around recently and realised about it. Is there any way of making p2p more secure, since I'm dubious about the DNS anyway since it obviously got past my router! Or have I not understood this correctly? Share this post Link to post Share on other sites
tomcctv 190 Posted November 21, 2016 Mine got hacked and I didn't have P2P. Mine was set up on a DNS and I had a password for that which I'd changed. Unfortunately I later found out that the installer hadn't changed the main password when he installed it, and he didn't tell me there was another password to change until I did some digging around recently and realised about it. Is there any way of making p2p more secure, since I'm dubious about the DNS anyway since it obviously got past my router! Or have I not understood this correctly? Hi. I read your other post and I don't think you were hacked. Who did the DNS setup who did your port forwarding Your installer should know basic port forwarding .... Yet everyone I go to or see on here people port forward port 80 ..... To recorders which is not needed. Share this post Link to post Share on other sites
thewireguys 3 Posted November 21, 2016 If telnet is open and default user/pass is used the cameras/DVRs can/will be hacked Share this post Link to post Share on other sites
annoyednow 0 Posted November 21, 2016 Mine got hacked and I didn't have P2P. Mine was set up on a DNS and I had a password for that which I'd changed. Unfortunately I later found out that the installer hadn't changed the main password when he installed it, and he didn't tell me there was another password to change until I did some digging around recently and realised about it. Is there any way of making p2p more secure, since I'm dubious about the DNS anyway since it obviously got past my router! Or have I not understood this correctly? Hi. I read your other post and I don't think you were hacked. Who did the DNS setup who did your port forwarding Your installer should know basic port forwarding .... Yet everyone I go to or see on here people port forward port 80 ..... To recorders which is not needed. My security guy did all the port forwarding and Dns set up. I'm curious, why don't you think I was hacked? My box was demonstrating both the issues on the article link I found? Is the article wrong, do you think? http://www.securitycameraking.com/securityinfo/your-cctv-system-was-hacked-can-you-prevent-it/ Share this post Link to post Share on other sites
tomcctv 190 Posted November 21, 2016 My security guy did all the port forwarding and Dns set up. I'm curious, why don't you think I was hacked? My box was demonstrating both the issues on the article link I found? Is the article wrong, do you think? http://www.securitycameraking.com/secur ... revent-it/ I was going to guess your installer supplied your ddns. Because your problems might be just that. Forget about the securitycamking stuff your reading ... That is not your problem. Who owns your ddns account ..... You or your installer ??? Also do you use the ddns account to connect all the time with all your devices at home and away ? Share this post Link to post Share on other sites
annoyednow 0 Posted November 22, 2016 My security guy did all the port forwarding and Dns set up. I'm curious, why don't you think I was hacked? My box was demonstrating both the issues on the article link I found? Is the article wrong, do you think? http://www.securitycameraking.com/secur ... revent-it/ I was going to guess your installer supplied your ddns. Because your problems might be just that. Forget about the securitycamking stuff your reading ... That is not your problem. Who owns your ddns account ..... You or your installer ??? Also do you use the ddns account to connect all the time with all your devices at home and away ? Yes, my installer owns my ddns account - is that a problem? I use the device home page on the network to view while in the house and apps while out of the house. Would you mind explaining what you're thinking please? Also what is "telnet" that someone else described? Share this post Link to post Share on other sites
tomcctv 190 Posted November 22, 2016 Well your not hacked .... you are not the only viewer. Your installer also has access to your system. Hackers don't use account names like yours which was ... system Did you change the admin account and also user account ? Share this post Link to post Share on other sites
annoyednow 0 Posted November 23, 2016 I thought I had a daily good layman grasp of all of this, but I'm now very confused. Share this post Link to post Share on other sites
