• March 01, 2021, 05:34:34 AM
  • Welcome, Guest
Please login or register.

Login with username, password and session length
Advanced search  

News:

This Forum Beta is ONLY for registered owners of D-Link products in the USA for which we have created boards at this time.

Pages: [1] 2

Author Topic: camera is regularly hacked  (Read 1065 times)

PASGILI

  • Level 1 Member
  • *
  • Posts: 11
camera is regularly hacked
« on: January 20, 2021, 07:04:12 AM »

Unfortunately my camera is regularly hacked.I see in the log that several IPs connect with the login "admin". Although I change by a strong password, only a few hours later it starts again.  Today, my network was very very unstable and as soon as I unplugged the camera everything returned to normal.I don't find it normal that you can't change the "Admin" login. A solution is possible? Thank you
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 49525
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: camera is regularly hacked
« Reply #1 on: January 20, 2021, 09:38:21 AM »

Link>Welcome!

  • What Hardware version is your DCS? Look at the sticker behind or under the camera.
  • Link>What Firmware version is currently loaded? Found on the DCSs web page under status.
  • What region are you located?

What Mfr and model is the main host router?

Do you have uPnP enabled on the camera and router?
Logged
Cable: 1Gb/50Mb>NetGear CAX80>DIR-882>HP 24pt Gb Switch. COVR-1202/2202/3902,DIR-2660/80,3xDGL-4500s,DIR-857,835,827,815,890L,880L,868L,836L,810L,685,657,3x655s,645,628,601,DNR-202L,DNS-345,DCS-933L,936L,960L and 8000LH.

RYAT3

  • Level 10 Member
  • *****
  • Posts: 2233
Re: camera is regularly hacked
« Reply #2 on: January 20, 2021, 03:55:48 PM »

Where is the IP coming from? 192.168.x.y?

Any other information?


Logged

PASGILI

  • Level 1 Member
  • *
  • Posts: 11
Re: camera is regularly hacked
« Reply #3 on: January 21, 2021, 12:26:24 AM »

Hello everyone, here are the requested informations :
Firmware version 2.02.06
Hardware Version B
agent version 2.2.0-b78
Upnp disabled
I am in Belgium

Router: TP-LINK ARCHER C2300
Upnp enabled

excerpt from the log of the last attack that damaged my network
23.   2021/01/20 11:51:48 admin login Ok from 45.95.168.120
after removing the plug from my camera everything was normal

Thanks

Logged

RYAT3

  • Level 10 Member
  • *****
  • Posts: 2233
Re: camera is regularly hacked
« Reply #4 on: January 21, 2021, 06:21:57 AM »


Well it looks like an abusive active IP address. Honeypoting!

I believe you!

You should block it in your router.

https://www.abuseipdb.com/check/45.95.168.120
Logged

PASGILI

  • Level 1 Member
  • *
  • Posts: 11
Re: camera is regularly hacked
« Reply #5 on: January 22, 2021, 12:29:06 AM »

Unfortunately my router doesn't allow me to do so. I'm out of luck...
Logged

RYAT3

  • Level 10 Member
  • *****
  • Posts: 2233
Re: camera is regularly hacked
« Reply #6 on: January 22, 2021, 02:42:09 PM »

Unfortunately my router doesn't allow me to do so. I'm out of luck...

Are you sure? Which manufacturer/model is it?
Logged

PASGILI

  • Level 1 Member
  • *
  • Posts: 11
Re: camera is regularly hacked
« Reply #7 on: January 23, 2021, 06:01:37 AM »

Yes TP-LINK ARCHER C2300 V2
Logged

RYAT3

  • Level 10 Member
  • *****
  • Posts: 2233
Re: camera is regularly hacked
« Reply #8 on: January 23, 2021, 02:52:33 PM »

Yes TP-LINK ARCHER C2300 V2

Although these are "V1" instructions, it looks like it would be here, under access control.

https://www.tp-link.com/us/user-guides/Archer-C2300&A2300_V1/chapter-10-network-security#ug-sub-title-1
Logged

PASGILI

  • Level 1 Member
  • *
  • Posts: 11
Re: camera is regularly hacked
« Reply #9 on: January 25, 2021, 12:52:58 AM »

Thank you very much for the research but unfortunately with the V2 it is not possible. I'm going to check out a TP-Link forum. Thank you
Logged

RYAT3

  • Level 10 Member
  • *****
  • Posts: 2233
Re: camera is regularly hacked
« Reply #10 on: January 25, 2021, 06:43:41 AM »

Is there a F/W update for your router? 

I'm not sure how the hacking and stuff works, but is there an open port on your router? So you can access it from the outside network?

If there is NO open port, you'd have to assume your router is also compromised.
Logged

RYAT3

  • Level 10 Member
  • *****
  • Posts: 2233
Re: camera is regularly hacked
« Reply #11 on: January 25, 2021, 12:01:33 PM »

Is there a F/W update for your router? 

I'm not sure how the hacking and stuff works, but is there an open port on your router? So you can access it from the outside network?

If there is NO open port, you'd have to assume your router is also compromised.

I found their emulator for 2300 V2.  I found the page in question.

https://emulator.tp-link.com/webpages_C2300V2_US_emulator/index.html


Logged

PASGILI

  • Level 1 Member
  • *
  • Posts: 11
Re: camera is regularly hacked
« Reply #12 on: January 26, 2021, 07:07:01 AM »

According to the forum on TpLink there is no way to filter an external address.
The firmware is up to date.
Yes there was port 80 which was open but of course I closed it. On the router forum they advised me to change the port to access from outside. The page that you show me is used to block the internal devices in the network.
Thanks
Logged

RYAT3

  • Level 10 Member
  • *****
  • Posts: 2233
Re: camera is regularly hacked
« Reply #13 on: January 26, 2021, 07:07:44 PM »

My bad, you are correct.  I got ahead of myself when I saw that page.  I thought it was for outside devices.

Is that TrendMicro stuff enabled? Advanced/Security/AntiVirus.  Or do they charge a fee?

That IP address should be blacklisted in their software by now.
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 49525
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: camera is regularly hacked
« Reply #14 on: January 26, 2021, 07:49:51 PM »

How about trying a different brand router? I would not recommend using anything TP-Link.
Logged
Cable: 1Gb/50Mb>NetGear CAX80>DIR-882>HP 24pt Gb Switch. COVR-1202/2202/3902,DIR-2660/80,3xDGL-4500s,DIR-857,835,827,815,890L,880L,868L,836L,810L,685,657,3x655s,645,628,601,DNR-202L,DNS-345,DCS-933L,936L,960L and 8000LH.
Pages: [1] 2