7 ms·

Reverse-Engineering an IP Camera (2019)

216 points by jnord 2y ago

fuzzfactor 2y ago
It would be really good to see this kind of effort on the Amazon Blink cameras, I know people who are returning them because they are app-trash no differently than the no-name (multiple ghost names actually) hardware like this. There's lots of garbage cameras now of various quality that behave the same way. What's needed is a replacement firmware and simple flashing technique for the most popular units to appear, so it's not just one hacker getting proper performance that the hardware is capable of.
- stacktrust 2y ago
  Blink cameras have amazing battery life due to proprietary silicon, https://news.ycombinator.com/item?id=40065319 https://news.ycombinator.com/item?id=40065319 > These would be tough as they are based on a proprietary ASIC which is poorly documented even for internal developers. Ask me how I know. Teardown thread, https://news.ycombinator.com/item?id=33683122 https://news.ycombinator.com/item?id=33683122
  - fuzzfactor 2y ago
    Yikes, that ASIC is so advanced that any product built around it will in some ways be designed for the landfill far more so than an equivalent that was generic.
soylentcola 2y ago
Only thing I'd mention is that the old school "web server runs on camera" model is really dodgy when the average user just plugs it in, fires up a mobile app, and sees their camera - then assumes all is well. So many security issues and exploits for those things. Hardcoded passwords, backdoors, and loads of exploits for gaining SSH or telnet access on very common models. As much as I hate the current shift toward camera-remote server setups (and their inevitable subscription fees), I can't imagine expecting your average buyer at Amazon or Walmart to properly configure and lock those things down. At least if it only talks to Amazon or Google or whoever, you won't be able to find it in a port scan and pull an image using admin/admin or whatever.
- MarkusQ 2y ago
  So to avoid the risk of someone wardriving your neighborhood and hacking into your camera, it's better to...send all the data to China and trust them to protect it?
  - soylentcola 2y ago
    Sorry...was talking more about the ones I've run across that are directly accessible via WAN for remote viewing.
    - MarkusQ 2y ago
      Ah, yeah. The "you didn't know you were an exhibitionist, did you?" specials.
  - mv4 2y ago
    In all fairness (there are multiple precedents), a US-based provider won't protect your data (from internal employees) either. Any centralized video monitoring system is a ticking time bomb.
    - mv4 2y ago
      Sorry, why the downvotes? Is something here factually incorrect? Didn't AT&T just 'lose' private data from "almost all customers"? The only truly private option is keeping your data on-prem.
      - soylentcola 2y ago
        Agree completely, and the only times I've used IP cameras, they were separated from the main LAN, had no access from outside, and provided a stream to a NAS running NVR software. That said, I can see the average user having a better outcome by "outsourcing their security" to Google, Amazon, and the like. Not ideal for exactly the reasons you stated, but seeing as very few people are going to set up or maintain an on-premises solution, I think the odds are still better than "random Chinese IP camera running a web server and viewable via a janky phone app outside the LAN". The move to doing everything on phones has only made it worse. At least when you were expected to log in via a "proper" browser for initial setup, you could be prompted to set a new password, update firmware, or make changes to settings. The phone-centric ones I've seen are basically "plug in, scan QR/type serial/connect to temporary AP, (confusing techie stuff happens magically here), now you can watch your dog on your iphone from anywhere!" Ignore the part about how this actually happens and how anyone can just scan port 8000 or whatever and connect with the hidden root login.
lemonlime0x3C33 2y ago
This was great, I loved all the parts it was super thorough :) You have to love serial ports on embedded devices, especially non password protected root access
tkems 2y ago
This is a great run down of the process to extract the firmware from these types of devices without desoldering the flash. I've done a fair amount of reverse engineering and a lot of devices have similar vulnerabilities. I think more time needs to be spent looking into these commonly used, cheap IoT devices and educating consumers on the risks of using a poorly secured device on their network. The upside of these vulnerabilities is that you can run your own code on these! 'Declouding' is great as it can extend the lifetime of these devices and make using them more private.
krunck 2y ago
"This first difficulty was to find information about the camera. Despite having a company logo printed on its front, I could not find any information about this company on Google. I found several identical cameras being sold online, but under different brands, all of them seem to be Chinese names." Why does this continue to surprise people? So much sketchy garbage coming out of China is sold under numerous "brands". Just look at a lot of computer stuff sold on Amazon.
- mv4 2y ago
  This is true for the top, known' brands as well. Wyze camera (top seller on Amazon) is a Tianjin Hualai Technology camera https://www.hualaikeji.com/en/product https://www.hualaikeji.com/en/product Roku just rolled our a similar cube-shaped cam (you can tell by the overall design). There's very little real innovation happening in consumer cameras right now.
  - deleted 2y ago
    [deleted]
  - ToucanLoucan 2y ago
    I mean, what exactly do you need innovated? I have a bunch of these cheap cameras (firewalled to only be accessible via LAN of course) that are nearly 6 years old now. They stream 2K video reliably, my DVR records for me, they have excellent quality night-vision via infrared, and I can access them via VPN. What's to improve here?
    - habibur 2y ago
      Smart camera. Attach a microphone and speaker with the camera. Any movement at odd times and you get a WhatsApp video call on your cell phone. You can watch the other person and can talk to him, "Hay! what are you doing at my home?" I was wondering if that's already available or not.
      - mv4 2y ago
deleted 2y ago
[deleted]
PaulHoule 2y ago
I am using an Amcrest camera to watch my feral cat Bob B when I am not there. (I am working on him getting enough trust to walk around in the floor when I am there but it is still something he does every other day) I was amazed at how easy it is, especially the software experience. The mobile app is easy, the web app is easy, RTSP is easy. If I want to add more camers and set up a server to record (like ZoneMinder) that looks easy too.
- mv4 2y ago
  Is this motion-detection based, or does that camera have cat detection?
  - PaulHoule 2y ago
    So far I use the web interface to check in on Bob B live when I am in the other house (where I live) or in the house that he's in (which has two rental units under renovation) One time I saw he was on the floor and I ran over to the other house to peek in through the window on him which seemed to piss him off. So I try not to do that. https://zoneminder.com/ https://zoneminder.com/ works with many camera brands and can do all sorts of detection. It's a slight hassle because Zoneminder wants its own filesystem, I could install a spare SSD I have into my home server or maybe I could set up another computer to be a zoneminder server in the rental. I have a microwave link between the houses and it might be better to spare it, but I am worried that anything in the cat room could get sprayed on.
    - mv4 2y ago
      Sounds like a good DIY option. Do you have to pay for their remote access service to monitor the cat remotely? (asking because I saw it on their pricing page, wondering whether required or optional)
      - PaulHoule 2y ago
        I have not done remote access with it. I wish I could run Tailscale on it and use it everywhere with my tablets, laptops, etc. but I can't. You could probably port forward the web server, but you could have a premium experience with ZoneMinder. I picked that camera out because I was looking at ZoneMinder's web page and thought Amcrest had a pretty good product line in terms of value. At my Uni they've installed a lot of Axis IP cameras which are quite a bit more expensive and are definitely tougher and higher performance.
mv4 2y ago
Since someone mentioned 'declouding' here, my startup (well, scaleup now) makes a few privacy-first, autonomous (no cloud) video security products - on-prem video security hub, relays for automation, cameras. I was also getting sick of cloud-based 'smart' cameras that ping random servers in China, so we made our own 'dumb' cameras that are fast (Uniview hardware with our firmware inside). If anyone here is interested, I will happily share more info. Always interested in product feedback.
- fusslo 2y ago
  This is exactly what I've been looking for. There's plenty of cheap RTSP and ONVIF compliant cameras coming out of china, but I trust them exactly 0%. I also don't trust us-based companies with remote access via their services. So I'm learning how to partition my home network to not allow the cameras on a vlan to not access the outside world. But then I need to figure out how to access the video streams.. from the network my computer is on that does have access to the outside world. I'm a firmware engineer, so I haven't touched networking since my IT job in college.
  - mv4 2y ago
    Mine are ONVIF-discoverable and will expose RTSP (H264 and H265) URLs and a snapshot URL. As I mentioned, they are 'dumb' (video and snapshots are their main purpose), and it's the security hub that makes them smart. No cloud-based remote access, your data stays on your device. If you decide to check it out, and feel free to ping me (email in profile). I am proud of these things, for the reasons you mentioned :) https://monitoreal.com/pro/monitoreal-camera/ https://monitoreal.com/pro/monitoreal-camera/ https://monitoreal.com/pro/security-assistant-spartan-i/ https://monitoreal.com/pro/security-assistant-spartan-i/ https://monitoreal.com/pro/monitoreal-relay/ https://monitoreal.com/pro/monitoreal-relay/
    - cbsks 2y ago
      I’m interested! I have a few cheap Poe cameras but the rtsp connection is always flaky on them. Your email is not in your profile by the way.
iqasimov 2y ago
long story short: your data sent to china
Maxious 2y ago
The telltale sign of the ipc binary suggests this is probably one of the SoCs looked at in https://openipc.org/ https://openipc.org/ I tore down an ankya brand device which had some fun features like setting up the wifi password by showing the camera a QR code
- mv4 2y ago
  I was just testing a Roku camera (was on sale for $23 from roku.com, I think) and it had the same feature (setting up wifi by showing it a QR code), which I thought was neat. However, it doesn't look like it exposes RTSP and works with the Roku app only (even Wyze, seemingly using the same OEM hardware, has a way to enable RTSP).
warmedcookie 2y ago
One thing I have setup on my computer is a custom DNS server that routes traffic by default to 8.8.8.8 (Google) but allows me to route certain domains (ex. ones you want to sniff) to your own webserver. Half the time there isn't even proper SSL protocols in place, making it very easy to see what these devices are sending over.
mv4 2y ago
This may come as a surprise, but it's not just hackers (or China) that you need to worry about. I've worked at a couple of FAANGs (risk, privacy, compliance) and was shocked by the lack of internal guardrails. Here's Amazon Ring settling with the FTC - company's own employees were watching customer video feeds for entertainment: https://www.ftc.gov/enforcement/refunds/ring-refunds https://www.ftc.gov/enforcement/refunds/ring-refunds Tesla's been caught doing similar things. The list goes on. https://www.reuters.com/technology/tesla-workers-shared-sensitive-images-recorded-by-customer-cars-2023-04-06/ https://www.reuters.com/technology/tesla-workers-shared-sens...
- kajecounterhack 2y ago
  I use Nest cameras at home instead of ring because based on work at Google I expect there to be strong internal guardrails relative to Ring (also heard about their lax standards), but happy to hear anecdata from (ex-)Nest engineers about potential issues.
  - mv4 2y ago
    I would love to hear from ex-Nest engineers as well about internal access. As for hackers, I remember seeing multiple Nest hacking incidents in the press a few years ago, but it appears they've hardened the system since then: https://techcrunch.com/2020/06/01/google-nest-advanced-protection/ https://techcrunch.com/2020/06/01/google-nest-advanced-prote...
- flanbiscuit 2y ago
  I use Amazon's Blink camera. Wonder if they could also be accessed by Amazon employees. Probably can if they are using their servers.
cameldrv 2y ago
These cameras are extremely suspicious -- just follow the money. I bought some cheap Chinese cameras in 2020 that by default send the video stream to a Chinese server, which you can watch with an app on your phone. The cameras were about $40 on Amazon, so my guess is the manufacturer was getting paid maybe $15-20 for them. Bandwidth to and from China is not that cheap, and you could be running this stream 24x7. The streaming service still works 4 years later even though the company whose name is on the camera has vanished. So, who is paying the server/bandwidth bill? The camera is too cheap to afford indefinitely providing this service, so you can only presume that you're paying in another way. Probably there is some third party in China that the camera manufacturer makes a deal with. The camera manufacturer may even be getting paid to pick a particular provider.
- codetrotter 2y ago
  I bought one on AliExpress for just under 18 EUR. Mine works similarly, that it streams to some server in the cloud. I knew this, and only connected it for testing a little bit and made sure to not put my face or any of my documents etc in view of the camera. The company behind the one I bought does seem to have a slightly better business model though. With them you can use it free to see live or you can pay them a monthly fee for recordings. As for me my plan is to put it on a LAN without internet access and figure out how to get the video locally.
  - mv4 2y ago
    Make sure to also specify a domestic NTP server - it may refuse to work until the time is synced, and most of the cheap cameras I looked at sync time with China by default.
  - embeddedsw 2y ago
    I use a Raspberry Pi to run a Tailscale subnet router on the LAN. I installed some cheap IP cams but blocked all Internet access so they can only access my LAN. With the Tailscale subnet router I can still get remote access to the camera streams from my phone.
- hattmall 2y ago
vivekkairi 2y ago
I faced a similar problem recently, where the IP cam I had was streaming video through the internet and it was Chinese ofcourse. But I found a much simpler solution to avoid it. The camera had rstp support and internet forums have already guessed the rstp url so I used that to hook it upto my surveillance system. Regarding avoiding transmission to internet, I just disabled internet access to that device and boom it became offline camera.
- mv4 2y ago
  This is the way. All my cameras are "offline", serving RTSP streams and snapshots on my local network.
pettycashstash2 2y ago
As an example Lorex, a Canadian security camera company founded in 1991, is currently owned by Dahua Technology, a major Chinese video surveillance manufacturer. Dahua acquired Lorex in 2018, which has led to some security concerns and restrictions on Lorex products' use by U.S. government agencies. Lorex cameras aren't banned for personal use in the US, but face restrictions for government agencies due to cybersecurity concerns. If you own a Lorex NVR system: Update firmware regularly Use strong passwords Limit remote access Consider network segmentation Monitor for unusual activity No need to discard your system, but stay informed about developments. Alternative options exist if you're concerned.
- scottlamb 2y ago
  Lorex cameras were rebranded Chinese cameras before 2018, too. For example, the Lorex MCNB2151 is a Hikvision DS-2CD2032. I think they had Hikvision and Dahua models prior to 2018; maybe it's all Dahua now. > Lorex cameras aren't banned for personal use in the US, but face restrictions for government agencies due to cybersecurity concerns. Not entirely sure the first half of this is true. iirc not only are many banned for government use under the 2019 National Defense Authorization Act, but also they've stopped issuing FCC approvals for many of these under the Secure Equipment Act of 2021. It'd be easy to get around this ban, but I won't. I believe Dahua and Hikvision are active participants in the Uyghur genocide. They've made custom software specifically to support this genocide (ethnic feature identification models) and have contracted to install their cameras themselves at "re-education camps". See e.g. https://www.theguardian.com/world/2021/sep/30/uyghur-tribunal-testimony-surveillance-china https://www.theguardian.com/world/2021/sep/30/uyghur-tribuna... I am still using some Hikvision and Dahua cameras I bought prior to learning about this. My network configuration does not allow them to contact the outside world. My NVR connects to them via RTSP. This is the only way to do it with cheap, untrustworthy closed-source IP cameras.
- mv4 2y ago
  fyi the list of manufacturers banned by the FCC: https://www.fcc.gov/supplychain/coveredlist https://www.fcc.gov/supplychain/coveredlist
beryilma 2y ago
With my limited knowledge of network technologies, I still found it relatively easy to setup a Pi Zero + Raspberry Pi Camera Module system to stream video over RTSP to VLC software on my desktop or phone. The stream quality is pretty crappy, but I am hoping that, at least, this would not send my video to some Chinese servers. Anybody else experimented with such setup?
- mv4 2y ago
  Yes, most of our early product prototyping was Pi-based. I've experimented with cameras, parallel stream processing, opencv, even voice assistants. It's a great platform. Happy to answer any questions. Also, lots of tutorials (on Medium and YT) for your exact setup.
  - beryilma 2y ago
    I looked at some tutorials and videos, but I can't seem to be able to create a smooth stream no matter what I try: different frame rates, different resolutions, etc. RTSP streaming works reliably for me, but the stream is always choppy. Have you had a better experience?
    - mv4 2y ago
      You mentioned VLC playback is choppy on your desktop or phone. Have you tried local playback (VLC on your Raspberry Pi that's doing the capturing), is it smooth there? Also, what does CPU and memory usage look like when you a) play locally, b) stream RTSP over the network to your desktop/phone. These should steps should help narrow this down.
- squarefoot 2y ago
  I've been playing for a while with various *Pi like boards (mostly Orange Pis) and the ustreamer software which is very light and well suited for small boards like those. https://github.com/pikvm/ustreamer https://github.com/pikvm/ustreamer
lakid 2y ago
A new-ish project for a replacement firmware for Ingenic based cameras is here https://thingino.com/ https://thingino.com/ . The developers are super active and very responsive.
- mv4 2y ago
  I love firmware projects. It's not just about the security. Manufacturer's own software is often clunky, slow, and sometimes requires browser plugins (!!!). The hardware is usually OK, it's the software that makes these products horrible.
- aag01 2y ago
  https://github.com/themactep/thingino-firmware https://github.com/themactep/thingino-firmware for the repo
telltaledev 2y ago
TL;DR: Some dude didn't spend effort identifying a product suitable for his expectations / requirements, now instead wastes it post-purchase on trying to understand the product in order to solve the situation.
Kim_Bruning 2y ago
Buy cheap cameras, stick them on a cheap smart switch with your own NVR. Make sure the cameras can never ever talk to the network.
ck2 2y ago
XM cameras have been completely hacked and decompiled to the point where there is third-party firmware now for them https://kuku.eu.org/?projects/xm530/part1 https://kuku.eu.org/?projects/xm530/part1 https://github.com/OpenIPC https://github.com/OpenIPC https://openipc.org/ https://openipc.org/ https://team.openipc.org/ipcam_dms/ https://team.openipc.org/ipcam_dms/
jkljl 2y ago
[dead]
hagbard_c 2y ago
I did a similar thing with the Xiongmai camera's I bought to keep an eye on a newly built barn/stable/clinic here on the farm and used the information to create a CLI tool to control the camera's: https://github.com/Yetangitu/cam https://github.com/Yetangitu/cam I never allowed these camera's or the included DVR (which I do not use since I use Zoneminder [1]) access to the internet, they are confined on their own subnet which does not allow egress other than to my own networks nor ingress from other sources. That is true for any and all network-connected special-purpose hardware, e.g. the Fronius inverter - made in Austria - does not get to access the internet either. I pay for the hardware and I provide my own service infrastructure, I see no need to pay again with my data. [1] https://zoneminder.com/ https://zoneminder.com/

216 points by jnord 2y ago

It would be really good to see this kind of effort on the Amazon Blink cameras, I know people who are returning them because they are app-trash no differently than the no-name (multiple ghost names actually) hardware like this. There's lots of garbage cameras now of various quality that behave the same way. What's needed is a replacement firmware and simple flashing technique for the most popular units to appear, so it's not just one hacker getting proper performance that the hardware is capable of.

stacktrust 2y ago
Blink cameras have amazing battery life due to proprietary silicon, https://news.ycombinator.com/item?id=40065319 https://news.ycombinator.com/item?id=40065319 > These would be tough as they are based on a proprietary ASIC which is poorly documented even for internal developers. Ask me how I know. Teardown thread, https://news.ycombinator.com/item?id=33683122 https://news.ycombinator.com/item?id=33683122
- fuzzfactor 2y ago
  Yikes, that ASIC is so advanced that any product built around it will in some ways be designed for the landfill far more so than an equivalent that was generic.

soylentcola 2y ago

Only thing I'd mention is that the old school "web server runs on camera" model is really dodgy when the average user just plugs it in, fires up a mobile app, and sees their camera - then assumes all is well. So many security issues and exploits for those things. Hardcoded passwords, backdoors, and loads of exploits for gaining SSH or telnet access on very common models. As much as I hate the current shift toward camera-remote server setups (and their inevitable subscription fees), I can't imagine expecting your average buyer at Amazon or Walmart to properly configure and lock those things down. At least if it only talks to Amazon or Google or whoever, you won't be able to find it in a port scan and pull an image using admin/admin or whatever.

MarkusQ 2y ago
So to avoid the risk of someone wardriving your neighborhood and hacking into your camera, it's better to...send all the data to China and trust them to protect it?
- soylentcola 2y ago
  Sorry...was talking more about the ones I've run across that are directly accessible via WAN for remote viewing.
  - MarkusQ 2y ago
    Ah, yeah. The "you didn't know you were an exhibitionist, did you?" specials.
- mv4 2y ago
  In all fairness (there are multiple precedents), a US-based provider won't protect your data (from internal employees) either. Any centralized video monitoring system is a ticking time bomb.
  - mv4 2y ago
    Sorry, why the downvotes? Is something here factually incorrect? Didn't AT&T just 'lose' private data from "almost all customers"? The only truly private option is keeping your data on-prem.
    - soylentcola 2y ago
      Agree completely, and the only times I've used IP cameras, they were separated from the main LAN, had no access from outside, and provided a stream to a NAS running NVR software. That said, I can see the average user having a better outcome by "outsourcing their security" to Google, Amazon, and the like. Not ideal for exactly the reasons you stated, but seeing as very few people are going to set up or maintain an on-premises solution, I think the odds are still better than "random Chinese IP camera running a web server and viewable via a janky phone app outside the LAN". The move to doing everything on phones has only made it worse. At least when you were expected to log in via a "proper" browser for initial setup, you could be prompted to set a new password, update firmware, or make changes to settings. The phone-centric ones I've seen are basically "plug in, scan QR/type serial/connect to temporary AP, (confusing techie stuff happens magically here), now you can watch your dog on your iphone from anywhere!" Ignore the part about how this actually happens and how anyone can just scan port 8000 or whatever and connect with the hidden root login.

lemonlime0x3C33 2y ago

This was great, I loved all the parts it was super thorough :) You have to love serial ports on embedded devices, especially non password protected root access

tkems 2y ago

This is a great run down of the process to extract the firmware from these types of devices without desoldering the flash. I've done a fair amount of reverse engineering and a lot of devices have similar vulnerabilities. I think more time needs to be spent looking into these commonly used, cheap IoT devices and educating consumers on the risks of using a poorly secured device on their network. The upside of these vulnerabilities is that you can run your own code on these! 'Declouding' is great as it can extend the lifetime of these devices and make using them more private.

krunck 2y ago

"This first difficulty was to find information about the camera. Despite having a company logo printed on its front, I could not find any information about this company on Google. I found several identical cameras being sold online, but under different brands, all of them seem to be Chinese names." Why does this continue to surprise people? So much sketchy garbage coming out of China is sold under numerous "brands". Just look at a lot of computer stuff sold on Amazon.

mv4 2y ago
This is true for the top, known' brands as well. Wyze camera (top seller on Amazon) is a Tianjin Hualai Technology camera https://www.hualaikeji.com/en/product https://www.hualaikeji.com/en/product Roku just rolled our a similar cube-shaped cam (you can tell by the overall design). There's very little real innovation happening in consumer cameras right now.
- deleted 2y ago
  [deleted]
- ToucanLoucan 2y ago
  I mean, what exactly do you need innovated? I have a bunch of these cheap cameras (firewalled to only be accessible via LAN of course) that are nearly 6 years old now. They stream 2K video reliably, my DVR records for me, they have excellent quality night-vision via infrared, and I can access them via VPN. What's to improve here?
  - habibur 2y ago
    Smart camera. Attach a microphone and speaker with the camera. Any movement at odd times and you get a WhatsApp video call on your cell phone. You can watch the other person and can talk to him, "Hay! what are you doing at my home?" I was wondering if that's already available or not.
    - mv4 2y ago

deleted 2y ago

[deleted]

PaulHoule 2y ago

I am using an Amcrest camera to watch my feral cat Bob B when I am not there. (I am working on him getting enough trust to walk around in the floor when I am there but it is still something he does every other day) I was amazed at how easy it is, especially the software experience. The mobile app is easy, the web app is easy, RTSP is easy. If I want to add more camers and set up a server to record (like ZoneMinder) that looks easy too.

mv4 2y ago
Is this motion-detection based, or does that camera have cat detection?
- PaulHoule 2y ago
  So far I use the web interface to check in on Bob B live when I am in the other house (where I live) or in the house that he's in (which has two rental units under renovation) One time I saw he was on the floor and I ran over to the other house to peek in through the window on him which seemed to piss him off. So I try not to do that. https://zoneminder.com/ https://zoneminder.com/ works with many camera brands and can do all sorts of detection. It's a slight hassle because Zoneminder wants its own filesystem, I could install a spare SSD I have into my home server or maybe I could set up another computer to be a zoneminder server in the rental. I have a microwave link between the houses and it might be better to spare it, but I am worried that anything in the cat room could get sprayed on.
  - mv4 2y ago
    Sounds like a good DIY option. Do you have to pay for their remote access service to monitor the cat remotely? (asking because I saw it on their pricing page, wondering whether required or optional)
    - PaulHoule 2y ago
      I have not done remote access with it. I wish I could run Tailscale on it and use it everywhere with my tablets, laptops, etc. but I can't. You could probably port forward the web server, but you could have a premium experience with ZoneMinder. I picked that camera out because I was looking at ZoneMinder's web page and thought Amcrest had a pretty good product line in terms of value. At my Uni they've installed a lot of Axis IP cameras which are quite a bit more expensive and are definitely tougher and higher performance.

mv4 2y ago

Since someone mentioned 'declouding' here, my startup (well, scaleup now) makes a few privacy-first, autonomous (no cloud) video security products - on-prem video security hub, relays for automation, cameras. I was also getting sick of cloud-based 'smart' cameras that ping random servers in China, so we made our own 'dumb' cameras that are fast (Uniview hardware with our firmware inside). If anyone here is interested, I will happily share more info. Always interested in product feedback.

fusslo 2y ago
This is exactly what I've been looking for. There's plenty of cheap RTSP and ONVIF compliant cameras coming out of china, but I trust them exactly 0%. I also don't trust us-based companies with remote access via their services. So I'm learning how to partition my home network to not allow the cameras on a vlan to not access the outside world. But then I need to figure out how to access the video streams.. from the network my computer is on that does have access to the outside world. I'm a firmware engineer, so I haven't touched networking since my IT job in college.
- mv4 2y ago
  Mine are ONVIF-discoverable and will expose RTSP (H264 and H265) URLs and a snapshot URL. As I mentioned, they are 'dumb' (video and snapshots are their main purpose), and it's the security hub that makes them smart. No cloud-based remote access, your data stays on your device. If you decide to check it out, and feel free to ping me (email in profile). I am proud of these things, for the reasons you mentioned :) https://monitoreal.com/pro/monitoreal-camera/ https://monitoreal.com/pro/monitoreal-camera/ https://monitoreal.com/pro/security-assistant-spartan-i/ https://monitoreal.com/pro/security-assistant-spartan-i/ https://monitoreal.com/pro/monitoreal-relay/ https://monitoreal.com/pro/monitoreal-relay/
  - cbsks 2y ago
    I’m interested! I have a few cheap Poe cameras but the rtsp connection is always flaky on them. Your email is not in your profile by the way.

iqasimov 2y ago

long story short: your data sent to china

Maxious 2y ago

The telltale sign of the ipc binary suggests this is probably one of the SoCs looked at in https://openipc.org/ https://openipc.org/ I tore down an ankya brand device which had some fun features like setting up the wifi password by showing the camera a QR code

mv4 2y ago
I was just testing a Roku camera (was on sale for $23 from roku.com, I think) and it had the same feature (setting up wifi by showing it a QR code), which I thought was neat. However, it doesn't look like it exposes RTSP and works with the Roku app only (even Wyze, seemingly using the same OEM hardware, has a way to enable RTSP).

warmedcookie 2y ago

One thing I have setup on my computer is a custom DNS server that routes traffic by default to 8.8.8.8 (Google) but allows me to route certain domains (ex. ones you want to sniff) to your own webserver. Half the time there isn't even proper SSL protocols in place, making it very easy to see what these devices are sending over.

mv4 2y ago

This may come as a surprise, but it's not just hackers (or China) that you need to worry about. I've worked at a couple of FAANGs (risk, privacy, compliance) and was shocked by the lack of internal guardrails. Here's Amazon Ring settling with the FTC - company's own employees were watching customer video feeds for entertainment: https://www.ftc.gov/enforcement/refunds/ring-refunds https://www.ftc.gov/enforcement/refunds/ring-refunds Tesla's been caught doing similar things. The list goes on. https://www.reuters.com/technology/tesla-workers-shared-sensitive-images-recorded-by-customer-cars-2023-04-06/ https://www.reuters.com/technology/tesla-workers-shared-sens...

kajecounterhack 2y ago
I use Nest cameras at home instead of ring because based on work at Google I expect there to be strong internal guardrails relative to Ring (also heard about their lax standards), but happy to hear anecdata from (ex-)Nest engineers about potential issues.
- mv4 2y ago
  I would love to hear from ex-Nest engineers as well about internal access. As for hackers, I remember seeing multiple Nest hacking incidents in the press a few years ago, but it appears they've hardened the system since then: https://techcrunch.com/2020/06/01/google-nest-advanced-protection/ https://techcrunch.com/2020/06/01/google-nest-advanced-prote...
flanbiscuit 2y ago
I use Amazon's Blink camera. Wonder if they could also be accessed by Amazon employees. Probably can if they are using their servers.

cameldrv 2y ago

These cameras are extremely suspicious -- just follow the money. I bought some cheap Chinese cameras in 2020 that by default send the video stream to a Chinese server, which you can watch with an app on your phone. The cameras were about $40 on Amazon, so my guess is the manufacturer was getting paid maybe $15-20 for them. Bandwidth to and from China is not that cheap, and you could be running this stream 24x7. The streaming service still works 4 years later even though the company whose name is on the camera has vanished. So, who is paying the server/bandwidth bill? The camera is too cheap to afford indefinitely providing this service, so you can only presume that you're paying in another way. Probably there is some third party in China that the camera manufacturer makes a deal with. The camera manufacturer may even be getting paid to pick a particular provider.

codetrotter 2y ago
I bought one on AliExpress for just under 18 EUR. Mine works similarly, that it streams to some server in the cloud. I knew this, and only connected it for testing a little bit and made sure to not put my face or any of my documents etc in view of the camera. The company behind the one I bought does seem to have a slightly better business model though. With them you can use it free to see live or you can pay them a monthly fee for recordings. As for me my plan is to put it on a LAN without internet access and figure out how to get the video locally.
- mv4 2y ago
  Make sure to also specify a domestic NTP server - it may refuse to work until the time is synced, and most of the cheap cameras I looked at sync time with China by default.
- embeddedsw 2y ago
  I use a Raspberry Pi to run a Tailscale subnet router on the LAN. I installed some cheap IP cams but blocked all Internet access so they can only access my LAN. With the Tailscale subnet router I can still get remote access to the camera streams from my phone.
hattmall 2y ago

vivekkairi 2y ago

I faced a similar problem recently, where the IP cam I had was streaming video through the internet and it was Chinese ofcourse. But I found a much simpler solution to avoid it. The camera had rstp support and internet forums have already guessed the rstp url so I used that to hook it upto my surveillance system. Regarding avoiding transmission to internet, I just disabled internet access to that device and boom it became offline camera.

mv4 2y ago
This is the way. All my cameras are "offline", serving RTSP streams and snapshots on my local network.

pettycashstash2 2y ago

As an example Lorex, a Canadian security camera company founded in 1991, is currently owned by Dahua Technology, a major Chinese video surveillance manufacturer. Dahua acquired Lorex in 2018, which has led to some security concerns and restrictions on Lorex products' use by U.S. government agencies. Lorex cameras aren't banned for personal use in the US, but face restrictions for government agencies due to cybersecurity concerns. If you own a Lorex NVR system: Update firmware regularly Use strong passwords Limit remote access Consider network segmentation Monitor for unusual activity No need to discard your system, but stay informed about developments. Alternative options exist if you're concerned.

scottlamb 2y ago
Lorex cameras were rebranded Chinese cameras before 2018, too. For example, the Lorex MCNB2151 is a Hikvision DS-2CD2032. I think they had Hikvision and Dahua models prior to 2018; maybe it's all Dahua now. > Lorex cameras aren't banned for personal use in the US, but face restrictions for government agencies due to cybersecurity concerns. Not entirely sure the first half of this is true. iirc not only are many banned for government use under the 2019 National Defense Authorization Act, but also they've stopped issuing FCC approvals for many of these under the Secure Equipment Act of 2021. It'd be easy to get around this ban, but I won't. I believe Dahua and Hikvision are active participants in the Uyghur genocide. They've made custom software specifically to support this genocide (ethnic feature identification models) and have contracted to install their cameras themselves at "re-education camps". See e.g. https://www.theguardian.com/world/2021/sep/30/uyghur-tribunal-testimony-surveillance-china https://www.theguardian.com/world/2021/sep/30/uyghur-tribuna... I am still using some Hikvision and Dahua cameras I bought prior to learning about this. My network configuration does not allow them to contact the outside world. My NVR connects to them via RTSP. This is the only way to do it with cheap, untrustworthy closed-source IP cameras.
mv4 2y ago
fyi the list of manufacturers banned by the FCC: https://www.fcc.gov/supplychain/coveredlist https://www.fcc.gov/supplychain/coveredlist

beryilma 2y ago

With my limited knowledge of network technologies, I still found it relatively easy to setup a Pi Zero + Raspberry Pi Camera Module system to stream video over RTSP to VLC software on my desktop or phone. The stream quality is pretty crappy, but I am hoping that, at least, this would not send my video to some Chinese servers. Anybody else experimented with such setup?

mv4 2y ago
Yes, most of our early product prototyping was Pi-based. I've experimented with cameras, parallel stream processing, opencv, even voice assistants. It's a great platform. Happy to answer any questions. Also, lots of tutorials (on Medium and YT) for your exact setup.
- beryilma 2y ago
  I looked at some tutorials and videos, but I can't seem to be able to create a smooth stream no matter what I try: different frame rates, different resolutions, etc. RTSP streaming works reliably for me, but the stream is always choppy. Have you had a better experience?
  - mv4 2y ago
    You mentioned VLC playback is choppy on your desktop or phone. Have you tried local playback (VLC on your Raspberry Pi that's doing the capturing), is it smooth there? Also, what does CPU and memory usage look like when you a) play locally, b) stream RTSP over the network to your desktop/phone. These should steps should help narrow this down.
squarefoot 2y ago
I've been playing for a while with various *Pi like boards (mostly Orange Pis) and the ustreamer software which is very light and well suited for small boards like those. https://github.com/pikvm/ustreamer https://github.com/pikvm/ustreamer

lakid 2y ago

A new-ish project for a replacement firmware for Ingenic based cameras is here https://thingino.com/ https://thingino.com/ . The developers are super active and very responsive.

mv4 2y ago
I love firmware projects. It's not just about the security. Manufacturer's own software is often clunky, slow, and sometimes requires browser plugins (!!!). The hardware is usually OK, it's the software that makes these products horrible.
aag01 2y ago
https://github.com/themactep/thingino-firmware https://github.com/themactep/thingino-firmware for the repo

telltaledev 2y ago

TL;DR: Some dude didn't spend effort identifying a product suitable for his expectations / requirements, now instead wastes it post-purchase on trying to understand the product in order to solve the situation.

Kim_Bruning 2y ago

Buy cheap cameras, stick them on a cheap smart switch with your own NVR. Make sure the cameras can never ever talk to the network.

ck2 2y ago

XM cameras have been completely hacked and decompiled to the point where there is third-party firmware now for them https://kuku.eu.org/?projects/xm530/part1 https://kuku.eu.org/?projects/xm530/part1 https://github.com/OpenIPC https://github.com/OpenIPC https://openipc.org/ https://openipc.org/ https://team.openipc.org/ipcam_dms/ https://team.openipc.org/ipcam_dms/

jkljl 2y ago

[dead]

hagbard_c 2y ago

I did a similar thing with the Xiongmai camera's I bought to keep an eye on a newly built barn/stable/clinic here on the farm and used the information to create a CLI tool to control the camera's: https://github.com/Yetangitu/cam https://github.com/Yetangitu/cam I never allowed these camera's or the included DVR (which I do not use since I use Zoneminder [1]) access to the internet, they are confined on their own subnet which does not allow egress other than to my own networks nor ingress from other sources. That is true for any and all network-connected special-purpose hardware, e.g. the Fronius inverter - made in Austria - does not get to access the internet either. I pay for the hardware and I provide my own service infrastructure, I see no need to pay again with my data. [1] https://zoneminder.com/ https://zoneminder.com/