D-Link Forums

The Graveyard - Products No Longer Supported => IP Cameras => DCS-2670L => Topic started by: PASGILI on January 20, 2021, 07:04:12 AM

Title: camera is regularly hacked
Post by: PASGILI on January 20, 2021, 07:04:12 AM
Unfortunately my camera is regularly hacked.I see in the log that several IPs connect with the login "admin". Although I change by a strong password, only a few hours later it starts again.  Today, my network was very very unstable and as soon as I unplugged the camera everything returned to normal.I don't find it normal that you can't change the "Admin" login. A solution is possible? Thank you
Title: Re: camera is regularly hacked
Post by: FurryNutz on January 20, 2021, 09:38:21 AM
Link>Welcome! (http://forums.dlink.com/index.php?topic=49573.0)


What Mfr and model is the main host router?

Do you have uPnP enabled on the camera and router?
Title: Re: camera is regularly hacked
Post by: RYAT3 on January 20, 2021, 03:55:48 PM
Where is the IP coming from? 192.168.x.y?

Any other information?


Title: Re: camera is regularly hacked
Post by: PASGILI on January 21, 2021, 12:26:24 AM
Hello everyone, here are the requested informations :
Firmware version 2.02.06
Hardware Version B
agent version 2.2.0-b78
Upnp disabled
I am in Belgium

Router: TP-LINK ARCHER C2300
Upnp enabled

excerpt from the log of the last attack that damaged my network
23.   2021/01/20 11:51:48 admin login Ok from 45.95.168.120
after removing the plug from my camera everything was normal

Thanks

Title: Re: camera is regularly hacked
Post by: RYAT3 on January 21, 2021, 06:21:57 AM

Well it looks like an abusive active IP address. Honeypoting!

I believe you!

You should block it in your router.

https://www.abuseipdb.com/check/45.95.168.120 (https://www.abuseipdb.com/check/45.95.168.120)
Title: Re: camera is regularly hacked
Post by: PASGILI on January 22, 2021, 12:29:06 AM
Unfortunately my router doesn't allow me to do so. I'm out of luck...
Title: Re: camera is regularly hacked
Post by: RYAT3 on January 22, 2021, 02:42:09 PM
Quote from: PASGILI on January 22, 2021, 12:29:06 AM
Unfortunately my router doesn't allow me to do so. I'm out of luck...

Are you sure? Which manufacturer/model is it?
Title: Re: camera is regularly hacked
Post by: PASGILI on January 23, 2021, 06:01:37 AM
Yes TP-LINK ARCHER C2300 V2
Title: Re: camera is regularly hacked
Post by: RYAT3 on January 23, 2021, 02:52:33 PM
Quote from: PASGILI on January 23, 2021, 06:01:37 AM
Yes TP-LINK ARCHER C2300 V2

Although these are "V1" instructions, it looks like it would be here, under access control.

https://www.tp-link.com/us/user-guides/Archer-C2300&A2300_V1/chapter-10-network-security#ug-sub-title-1 (https://www.tp-link.com/us/user-guides/Archer-C2300&A2300_V1/chapter-10-network-security#ug-sub-title-1)
Title: Re: camera is regularly hacked
Post by: PASGILI on January 25, 2021, 12:52:58 AM
Thank you very much for the research but unfortunately with the V2 it is not possible. I'm going to check out a TP-Link forum. Thank you
Title: Re: camera is regularly hacked
Post by: RYAT3 on January 25, 2021, 06:43:41 AM
Is there a F/W update for your router? 

I'm not sure how the hacking and stuff works, but is there an open port on your router? So you can access it from the outside network?

If there is NO open port, you'd have to assume your router is also compromised.
Title: Re: camera is regularly hacked
Post by: RYAT3 on January 25, 2021, 12:01:33 PM
Quote from: RYAT3 on January 25, 2021, 06:43:41 AM
Is there a F/W update for your router? 

I'm not sure how the hacking and stuff works, but is there an open port on your router? So you can access it from the outside network?

If there is NO open port, you'd have to assume your router is also compromised.

I found their emulator for 2300 V2.  I found the page in question.

https://emulator.tp-link.com/webpages_C2300V2_US_emulator/index.html (https://emulator.tp-link.com/webpages_C2300V2_US_emulator/index.html)


(https://i.postimg.cc/br2djZND/tplinkarcher2300v2.png)
Title: Re: camera is regularly hacked
Post by: PASGILI on January 26, 2021, 07:07:01 AM
According to the forum on TpLink there is no way to filter an external address.
The firmware is up to date.
Yes there was port 80 which was open but of course I closed it. On the router forum they advised me to change the port to access from outside. The page that you show me is used to block the internal devices in the network.
Thanks
Title: Re: camera is regularly hacked
Post by: RYAT3 on January 26, 2021, 07:07:44 PM
My bad, you are correct.  I got ahead of myself when I saw that page.  I thought it was for outside devices.

Is that TrendMicro stuff enabled? Advanced/Security/AntiVirus.  Or do they charge a fee?

That IP address should be blacklisted in their software by now.
Title: Re: camera is regularly hacked
Post by: FurryNutz on January 26, 2021, 07:49:51 PM
How about trying a different brand router? I would not recommend using anything TP-Link.
Title: Re: camera is regularly hacked
Post by: PASGILI on January 28, 2021, 01:16:36 AM
Hello, yes of course TrendMicro is well activated but is not paying.
Yes I could try with another router but as it's very recent I'm still waiting a little bit.
I opened port 554 and it allows me to see the images from outside but I can't manage the camera. For the moment I haven't had any more attacks....