Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[PASGILI]

Unfortunately my camera is regularly hacked.I see in the log that several IPs connect with the login "admin". Although I change by a strong password, only a few hours later it starts again.  Today, my network was very very unstable and as soon as I unplugged the camera everything returned to normal.I don't find it normal that you can't change the "Admin" login. A solution is possible? Thank you

[FurryNutz]

Link>Welcome!

• What Hardware version is your DCS? Look at the sticker behind or under the camera.
• Link>What Firmware version is currently loaded? Found on the DCSs web page under status.
• What region are you located?

What Mfr and model is the main host router?

Do you have uPnP enabled on the camera and router?

[RYAT3]

Where is the IP coming from? 192.168.x.y?

Any other information?

[PASGILI]

Hello everyone, here are the requested informations :
Firmware version 2.02.06
Hardware Version B
agent version 2.2.0-b78
Upnp disabled
I am in Belgium

Router: TP-LINK ARCHER C2300
Upnp enabled

excerpt from the log of the last attack that damaged my network
23.   2021/01/20 11:51:48 admin login Ok from 45.95.168.120
after removing the plug from my camera everything was normal

Thanks

[RYAT3]

Well it looks like an abusive active IP address. Honeypoting!

I believe you!

You should block it in your router.

https://www.abuseipdb.com/check/45.95.168.120

[PASGILI]

Unfortunately my router doesn't allow me to do so. I'm out of luck...

[RYAT3]

Unfortunately my router doesn't allow me to do so. I'm out of luck...

Are you sure? Which manufacturer/model is it?

[PASGILI]

Yes TP-LINK ARCHER C2300 V2

[RYAT3]

Yes TP-LINK ARCHER C2300 V2

Although these are "V1" instructions, it looks like it would be here, under access control.

https://www.tp-link.com/us/user-guides/Archer-C2300&A2300_V1/chapter-10-network-security#ug-sub-title-1

[PASGILI]

Thank you very much for the research but unfortunately with the V2 it is not possible. I'm going to check out a TP-Link forum. Thank you

[RYAT3]

Is there a F/W update for your router? 

I'm not sure how the hacking and stuff works, but is there an open port on your router? So you can access it from the outside network?

If there is NO open port, you'd have to assume your router is also compromised.

[RYAT3]

Is there a F/W update for your router? 

I'm not sure how the hacking and stuff works, but is there an open port on your router? So you can access it from the outside network?

If there is NO open port, you'd have to assume your router is also compromised.

I found their emulator for 2300 V2.  I found the page in question.

https://emulator.tp-link.com/webpages_C2300V2_US_emulator/index.html

[PASGILI]

According to the forum on TpLink there is no way to filter an external address.
The firmware is up to date.
Yes there was port 80 which was open but of course I closed it. On the router forum they advised me to change the port to access from outside. The page that you show me is used to block the internal devices in the network.
Thanks

[RYAT3]

My bad, you are correct.  I got ahead of myself when I saw that page.  I thought it was for outside devices.

Is that TrendMicro stuff enabled? Advanced/Security/AntiVirus.  Or do they charge a fee?

That IP address should be blacklisted in their software by now.

[FurryNutz]

How about trying a different brand router? I would not recommend using anything TP-Link.