D-Link Forums

D-Link IP Cameras for Home => DCS-2330L => Topic started by: RYAT3 on August 23, 2016, 08:28:25 PM

Title: DCS2330l anti hack blocks DNR202L ?
Post by: RYAT3 on August 23, 2016, 08:28:25 PM
f/w 1.12 on 2330l


192.168.0.129 is my DNR-202L.



41. 2016-08-23 16:51:51 User from 192.168.0.129 login failed & lock web service
42. 2016-08-23 16:05:57 User from 192.168.0.129 login failed & lock web service
43. 2016-08-23 15:39:13 User from 192.168.0.129 login failed & lock web service
44. 2016-08-23 15:16:37 User from 192.168.0.129 login failed & lock web service
45. 2016-08-23 14:28:57 User from 192.168.0.129 login failed & lock web service
46. 2016-08-23 13:28:53 User from 192.168.0.129 login failed & lock web service
47. 2016-08-23 12:57:01 User from 192.168.0.129 login failed & lock web service
48. 2016-08-23 12:34:33 User from 192.168.0.129 login failed & lock web service
49. 2016-08-23 11:42:34 User from 192.168.0.129 login failed & lock web service
50. 2016-08-23 11:02:52 User from 192.168.0.129 login failed & lock web service
51. 2016-08-23 09:40:19 User from 192.168.0.129 login failed & lock web service
52. 2016-08-23 08:17:44 User from 192.168.0.129 login failed & lock web service
53. 2016-08-23 07:52:04 User from 192.168.0.129 login failed & lock web service
54. 2016-08-23 06:48:43 User from 192.168.0.129 login failed & lock web service
55. 2016-08-23 04:38:02 User from 192.168.0.129 login failed & lock web service
56. 2016-08-23 04:16:29 User from 192.168.0.129 login failed & lock web service
57. 2016-08-23 03:58:28 User from 192.168.0.129 login failed & lock web service
58. 2016-08-23 03:38:28 User from 192.168.0.129 login failed & lock web service
59. 2016-08-23 02:41:52 User from 192.168.0.129 login failed & lock web service
60. 2016-08-23 01:13:33 admin FROM 192.168.0.141 LOGIN OK


Other DCS-2230L cam on DNR-202L

21. 2016-08-23 13:20:20 User from 192.168.0.129 login failed & lock web service
22. 2016-08-23 12:54:40 User from 192.168.0.129 login failed & lock web service
23. 2016-08-23 12:44:47 User from 192.168.0.129 login failed & lock web service
24. 2016-08-23 12:32:28 User from 192.168.0.129 login failed & lock web service
25. 2016-08-23 11:21:28 User from 192.168.0.129 login failed & lock web service
26. 2016-08-23 11:04:45 User from 192.168.0.129 login failed & lock web service
27. 2016-08-23 10:53:49 User from 192.168.0.129 login failed & lock web service
28. 2016-08-23 10:37:20 User from 192.168.0.129 login failed & lock web service
29. 2016-08-23 10:22:43 User from 192.168.0.129 login failed & lock web service
30. 2016-08-23 09:38:00 User from 192.168.0.129 login failed & lock web service
31. 2016-08-23 08:17:41 User from 192.168.0.129 login failed & lock web service
32. 2016-08-23 07:54:11 User from 192.168.0.129 login failed & lock web service
33. 2016-08-23 07:36:48 User from 192.168.0.129 login failed & lock web service
34. 2016-08-23 06:50:29 User from 192.168.0.129 login failed & lock web service
35. 2016-08-23 06:34:32 User from 192.168.0.129 login failed & lock web service
36. 2016-08-23 05:01:05 User from 192.168.0.129 login failed & lock web service
37. 2016-08-23 04:35:48 User from 192.168.0.129 login failed & lock web service
38. 2016-08-23 04:16:19 User from 192.168.0.129 login failed & lock web service
39. 2016-08-23 04:04:19 User from 192.168.0.129 login failed & lock web service
40. 2016-08-23 03:56:20 User from 192.168.0.129 login failed & lock web service

ftp://ftp2.dlink.com/PRODUCTS/DCS-2330L/REVA/DCS-2330L_REVA_RELEASENOTES_1.12.00_EN.PDF (http://ftp://ftp2.dlink.com/PRODUCTS/DCS-2330L/REVA/DCS-2330L_REVA_RELEASENOTES_1.12.00_EN.PDF)

V1.10.07
1. Update mydlink agent version to 2.0.19-b23
2. Add the login check mechanism on Web GUI to solve Brute Force Attack
issue


IE is crashing, I'll review the video dates later on.

Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: FurryNutz on August 24, 2016, 06:49:09 AM
I presume the DNR is set up correctly and credentials are correct on the DNR?
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: RYAT3 on August 24, 2016, 06:52:21 AM

Yes, otherwise it wouldn't be recording to the hard drive, or displaying live view.   ;)
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: FurryNutz on August 24, 2016, 06:54:04 AM
So these logs are on the camera? Does the DNR report anything?
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: BAMoh on September 08, 2016, 09:31:51 AM
Was this resolved?
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: FurryNutz on September 12, 2016, 07:18:31 AM
Any status on this?  ???

f/w 1.12 on 2330l


192.168.0.129 is my DNR-202L.



41. 2016-08-23 16:51:51 User from 192.168.0.129 login failed & lock web service
42. 2016-08-23 16:05:57 User from 192.168.0.129 login failed & lock web service
43. 2016-08-23 15:39:13 User from 192.168.0.129 login failed & lock web service
44. 2016-08-23 15:16:37 User from 192.168.0.129 login failed & lock web service
45. 2016-08-23 14:28:57 User from 192.168.0.129 login failed & lock web service
46. 2016-08-23 13:28:53 User from 192.168.0.129 login failed & lock web service
47. 2016-08-23 12:57:01 User from 192.168.0.129 login failed & lock web service
48. 2016-08-23 12:34:33 User from 192.168.0.129 login failed & lock web service
49. 2016-08-23 11:42:34 User from 192.168.0.129 login failed & lock web service
50. 2016-08-23 11:02:52 User from 192.168.0.129 login failed & lock web service
51. 2016-08-23 09:40:19 User from 192.168.0.129 login failed & lock web service
52. 2016-08-23 08:17:44 User from 192.168.0.129 login failed & lock web service
53. 2016-08-23 07:52:04 User from 192.168.0.129 login failed & lock web service
54. 2016-08-23 06:48:43 User from 192.168.0.129 login failed & lock web service
55. 2016-08-23 04:38:02 User from 192.168.0.129 login failed & lock web service
56. 2016-08-23 04:16:29 User from 192.168.0.129 login failed & lock web service
57. 2016-08-23 03:58:28 User from 192.168.0.129 login failed & lock web service
58. 2016-08-23 03:38:28 User from 192.168.0.129 login failed & lock web service
59. 2016-08-23 02:41:52 User from 192.168.0.129 login failed & lock web service
60. 2016-08-23 01:13:33 admin FROM 192.168.0.141 LOGIN OK


Other DCS-2230L cam on DNR-202L

21. 2016-08-23 13:20:20 User from 192.168.0.129 login failed & lock web service
22. 2016-08-23 12:54:40 User from 192.168.0.129 login failed & lock web service
23. 2016-08-23 12:44:47 User from 192.168.0.129 login failed & lock web service
24. 2016-08-23 12:32:28 User from 192.168.0.129 login failed & lock web service
25. 2016-08-23 11:21:28 User from 192.168.0.129 login failed & lock web service
26. 2016-08-23 11:04:45 User from 192.168.0.129 login failed & lock web service
27. 2016-08-23 10:53:49 User from 192.168.0.129 login failed & lock web service
28. 2016-08-23 10:37:20 User from 192.168.0.129 login failed & lock web service
29. 2016-08-23 10:22:43 User from 192.168.0.129 login failed & lock web service
30. 2016-08-23 09:38:00 User from 192.168.0.129 login failed & lock web service
31. 2016-08-23 08:17:41 User from 192.168.0.129 login failed & lock web service
32. 2016-08-23 07:54:11 User from 192.168.0.129 login failed & lock web service
33. 2016-08-23 07:36:48 User from 192.168.0.129 login failed & lock web service
34. 2016-08-23 06:50:29 User from 192.168.0.129 login failed & lock web service
35. 2016-08-23 06:34:32 User from 192.168.0.129 login failed & lock web service
36. 2016-08-23 05:01:05 User from 192.168.0.129 login failed & lock web service
37. 2016-08-23 04:35:48 User from 192.168.0.129 login failed & lock web service
38. 2016-08-23 04:16:19 User from 192.168.0.129 login failed & lock web service
39. 2016-08-23 04:04:19 User from 192.168.0.129 login failed & lock web service
40. 2016-08-23 03:56:20 User from 192.168.0.129 login failed & lock web service

ftp://ftp2.dlink.com/PRODUCTS/DCS-2330L/REVA/DCS-2330L_REVA_RELEASENOTES_1.12.00_EN.PDF (http://ftp://ftp2.dlink.com/PRODUCTS/DCS-2330L/REVA/DCS-2330L_REVA_RELEASENOTES_1.12.00_EN.PDF)

V1.10.07
1. Update mydlink agent version to 2.0.19-b23
2. Add the login check mechanism on Web GUI to solve Brute Force Attack
issue


IE is crashing, I'll review the video dates later on.
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: RYAT3 on September 12, 2016, 09:42:11 AM
I don't think it's complained lately. I haven't logged directly into the 2330l's since about this time. (And I started to use the correct passwords)
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: FurryNutz on September 12, 2016, 10:52:37 AM
I see.  ::)
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: remoteCamsFarAway on October 01, 2016, 08:29:11 AM
SAME PROBLEM HERE.  I've seen where I sometimes try to log into my remote cams and get "403 Forbidden" in my web browser.  Never really knew what it was and didn't give it much thought.  Just saw this thread and correlated the "lock web service" message in a camera log to the browser "forbidden" message  I have a DNR-312L recorder in my network.  The "lock web service" message lists the DNR as the IP address associated with that message.  However, that camera is no on the list of cameras that the DNR should be accessing.

WHY IS THE DNR TRYING TO ACCESS CAMS ON MY NETWORK THAT ARE NOT ON ITS LIST?  IS IT CONSTANTLY SCANNING THE NETWORK LOOKING FOR POTENTIAL CAMS TO CONNECT TO?  Note that these cams were on its list at one previous time but I removed them.  Or is it that there is some residual that did not get fully cleared in the DNR software even though I no longer see these cams in the visible list?

Currently running firmware 1.04.03.  I see 1.05.06 is now available.  Will upgrade when on site in a month.
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: RYAT3 on October 01, 2016, 08:50:14 AM
Are you using 2330l's?
I don't have that recorder, so I can't verify.

I also think post of the problem was very poor wifi signal at the time.  The dnr202l I think was losing connection a lot and maybe sending to many requests to the camera ( valid ones, with correct password), so the anti hack kicked in.

This doesn't explain your situation though. 
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: remoteCamsFarAway on October 01, 2016, 02:30:13 PM
Yes, the cams that are being accessed by the DNR-312L are 2330L cams but these cams are not in the list that the DNR should be accessing.  Don't know why it is.  Apparently the cams are seeing this as an attack and they temporarily go unavailable.
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: FurryNutz on October 04, 2016, 01:19:55 PM
I recommend that you phone contact your regional D-Link support office and ask for help and information regarding this. This maybe something that the DNR will need to support as the 312L is a business class NVR while the 2330L is a home class camera. The DNR may not support the home class cameras maybe. Something that support will need to review and let you know about. We find that phone contact has better immediate results over using email.
Let us know how it goes please.

Yes, the cams that are being accessed by the DNR-312L are 2330L cams but these cams are not in the list that the DNR should be accessing.  Don't know why it is.  Apparently the cams are seeing this as an attack and they temporarily go unavailable.
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: remoteCamsFarAway on October 04, 2016, 09:10:49 PM
I recommend that you phone contact your regional D-Link support office and ask for help and information regarding this. This maybe something that the DNR will need to support as the 312L is a business class NVR while the 2330L is a home class camera. The DNR may not support the home class cameras maybe. Something that support will need to review and let you know about. We find that phone contact has better immediate results over using email.
Let us know how it goes please.

Yes, the cams that are being accessed by the DNR-312L are 2330L cams but these cams are not in the list that the DNR should be accessing.  Don't know why it is.  Apparently the cams are seeing this as an attack and they temporarily go unavailable.

Yes the DCS-2330L IS one of the cams that is natively supported by the DNR-312L.  What I tried to say was that I had not instructed the DNR to record from these cams.  Even so, I was getting the lock messages in the log files of those cams that the DNR should not have been accessing.
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: FurryNutz on October 06, 2016, 10:24:39 AM
Maybe something that the DNR is doing that it shouldn't be doing. Something that support should have a look at.
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: remoteCamsFarAway on October 06, 2016, 07:14:36 PM
There is a recent firmware update available for the DNR.  I'll apply it when I'm down there in a month.  Hopefully it will fix that problem.
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: RYAT3 on October 06, 2016, 07:23:14 PM
There is a recent firmware update available for the DNR.  I'll apply it when I'm down there in a month.  Hopefully it will fix that problem.

There is also a new 1.14 F/W upgrade which has "4. Add support Dlink new anti-brute force mechanism(block only IP, reset when successful login from one IP)"

I'm not sure how this would work.. if your local connection is logging in correctly, and someone is attacking remotely - is the remote only blocked and the local still good?  Does the local reconnecting unblock the attacker?   ???

*I'll try to test this on the weekend.
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: FurryNutz on October 06, 2016, 10:39:09 PM
http://forums.dlink.com/index.php?topic=65687.0 (http://forums.dlink.com/index.php?topic=65687.0)
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: remoteCamsFarAway on October 07, 2016, 08:39:13 PM
myDlinkLite has been prompting me to update the firmware to the new level.  I've allowed it multiple times and it appears that it is updating the firmware but the camera remains at firmware level 1.12.  I suspect that the update is failing due to this problem.  Will need to do it locally when I get there in three weeks.

Possibly related, we are finding that two of our three cams are now showing "Xed out" in myDlinkLite but I can still access them directly without going through myDlinkLite.  Because I'm having a high frequency of this "locked" problem which appears as "403 Forbidden" when directly accessed, I'm assuming that's why myDlinkLite is just giving up and reporting the camera as permanently unavailable.  When I get the "403 Forbidden" response, I just hit F5 periodically to refresh the web page and I finally get the login prompt to access the camera.

Also note that this problem is pervasive on my three 2330L cams but I have not seen this on my two 2630L cams running FW 1.03.

Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: RYAT3 on October 07, 2016, 08:52:25 PM
Maybe the download isn't getting there completely, so the camera stops it?

It would be borderline crazy - but since you are connecting remotely directly to the cam f/w, have you thought of trying to upload the F/W from your current location?

Just don't be streaming anything else while doing that on the slow connection there.

Do you see any signal strength in Network Wireless setup?  That would be your other obstacle...
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: remoteCamsFarAway on October 09, 2016, 06:13:51 PM
I have tried to update the firmware DIRECTLY from my location here without going through myDlinkLite but still have the same result.  Checking a little more by way of camera logs, router logs, and the browser status at the bottom of the browser page indicating that it is waiting for a response from the server it looks like the download is failing almost immediately.  I've tried this on two of the three 2330L cams with the same results.  Is something in the communication link timing out?  I don't know.  I do know that I have a 1Mb/s ADSL link down there.  That's pretty slow.

The only other remote update I'd done in the past was on the two 2630L cams.  Both of them worked with no problem.  It seems that there is something different about the 2330L and 2630L cams.  Generally speaking I've noticed that the 2630L cams respond more quickly to requests.  Is it an algorithmic difference or a processor speed difference that allows the 2630Ls to remotely update while the 2330Ls won't?  I don't know.

Signal strength is generally in the 70s and 80s on these cams.

I did have a high incidence of DoS attack log entries in my router log indicating that the attack was coming from my IP address here in Colorado.  I thought maybe the router was blocking my communications and creating the problems so I disabled DOS attack security in my router.  I no longer get those DoS log entries but it didn't fix the firmware upload issue.

I still get a high frequency of the 403 forbidden hits.  I still think this is related to my DNR-312 recorder but am waiting to apply new 2330L and DNR-312L firmware updates when I'm there in three weeks.  Still hoping they may fix some problems.

Note that I only get the 403 Forbidden hits on the 2330L cams and not the 2630L cams.  That may be a clue but I don't know what it's telling me.

I am still having a high frequency of the "403 forbidden" web page occurrences and DOS attack

Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: RYAT3 on October 09, 2016, 06:27:54 PM
I haven't dealt with that slow of a connection.

Here's another idea:

You could get a cheap laptop, put it there, and enable remote desktop connection, and you have to open up 1 port (3389).

http://www.practicallynetworked.com/networking/win_rem_dsktp_pt3.htm
 (http://www.practicallynetworked.com/networking/win_rem_dsktp_pt3.htm)

Then when you are back home - you can administer your setup remotely, with a local laptop.

You could tell it to download the f/w, disconnect, and return later on.

Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: RYAT3 on October 09, 2016, 06:38:43 PM
I wonder how bad your pings are... if those are timing out...  :o
Title: Re: DCS2330l anti hack blocks DNR202L ?
Post by: FurryNutz on October 10, 2016, 07:41:33 AM
Can also use teamviewer as well.