5 ms·

I mean I run my own security system at home. Part of the struggle is… what happens during a break in and they just swipe the damn dvr. I’m torn. Mine is also

I mean I run my own security system at home. Part of the struggle is… what happens during a break in and they just swipe the damn dvr. I’m torn. Mine is also one that to enable RTSP means it running a insecure firmware. So I can’t use both services. It’s rtsp or cloud only.

jareklupinski 3y ago
rsync to a NAS locked inside a fireproof safe and keep the combination in a safe deposit box forget the combination to be invulnerable to rubberhose crypto
drdaeman 3y ago
Having a replica is an easy part - just host another DVR elsewhere (in a location you own or trust, preferably far away) and stream a copy there at the same time you're streaming a copy to your local DVR. Repeat with more replicas (or a distributed filesystem with relevant properties) for higher resiliency. There are a bunch of distributed filesystem solutions out there to pick from. If you have a hacked but original firmware, most likely it uses a variant of S3 protocol for their cloud recordings, so simple binary patching (replacing hostnames and any hardcoded TLS certificates or fingerprints) may do the trick. Having a backup power and network is tricky. You need a reliable battery backup that would automatically kick in in case of power outage, notify you about the failure and power all systems that must stay online for a reasonable amount of time. And an one or more alternate network links that would still work if the primary one is severed - e.g. a fiber line and a 5G modem, but the more the merrier. Insecure firmware is probably not a problem if all devices are strictly isolated away to their own VLAN, which is carefully firewalled away from all your other systems (so even if you get a compromised laptop on your home LAN, it can't reach those cameras without going through a tightly locked down jumphost). Then it is more likely someone's throwing a wrench to a camera than someone hacking into it (even if all it takes is passwordless telnet that gives root access).

jareklupinski 3y ago

rsync to a NAS locked inside a fireproof safe and keep the combination in a safe deposit box forget the combination to be invulnerable to rubberhose crypto

drdaeman 3y ago

Having a replica is an easy part - just host another DVR elsewhere (in a location you own or trust, preferably far away) and stream a copy there at the same time you're streaming a copy to your local DVR. Repeat with more replicas (or a distributed filesystem with relevant properties) for higher resiliency. There are a bunch of distributed filesystem solutions out there to pick from. If you have a hacked but original firmware, most likely it uses a variant of S3 protocol for their cloud recordings, so simple binary patching (replacing hostnames and any hardcoded TLS certificates or fingerprints) may do the trick. Having a backup power and network is tricky. You need a reliable battery backup that would automatically kick in in case of power outage, notify you about the failure and power all systems that must stay online for a reasonable amount of time. And an one or more alternate network links that would still work if the primary one is severed - e.g. a fiber line and a 5G modem, but the more the merrier. Insecure firmware is probably not a problem if all devices are strictly isolated away to their own VLAN, which is carefully firewalled away from all your other systems (so even if you get a compromised laptop on your home LAN, it can't reach those cameras without going through a tightly locked down jumphost). Then it is more likely someone's throwing a wrench to a camera than someone hacking into it (even if all it takes is passwordless telnet that gives root access).