I noticed my generic Chinese 16 channel dvr started shutting down and rebooting at around five minute intervals yesterday morning.
Having spent a fruitless few hours changing power supplies then disconnecting cameras in the suspicion it might be a camera/cable fault I finally discovered that unplugging the Ethernet lead removed the problem.
Now I'm puzzled. Google took me to an American forum which suggests something is trying to gain access via the Ethernet but I never completed giving the dev web contact just local to our own wifi group.
Any ideas?

In article ,
Cynic writes:
I noticed my generic Chinese 16 channel dvr started shutting down and rebooting at around five minute intervals yesterday morning.
Having spent a fruitless few hours changing power supplies then disconnecting cameras in the suspicion it might be a camera/cable fault I finally discovered that unplugging the Ethernet lead removed the problem.
Now I'm puzzled. Google took me to an American forum which suggests something is trying to gain access via the Ethernet but I never completed giving the dev web contact just local to our own wifi group.
Any ideas?

These make outgoing network connections which have often been
hijacked to get into your internal network from the outside,
past any firewall and NAT you might have, and then into other
devices you have on your internal network. They have notoriously
poor security design, and few (if any) security updates.

Mine lives in a DMZ, and the only outgoing network connection
it is allowed to make is NTP to my ISP's NTP servers.

Someone is probably using a standard exploit against yours,
which isn't quite working with perhaps a slightly different
version of software than the exploit expects. It's unlikely
they are deliberately crashing it, because the last thing
they'd want to do is to draw attention to your system being
hacked.

Don't assume other hacks aren't in use which have worked
to get to other devices on your internal network.

--
Andrew Gabriel
[email address is not usable -- followup in the newsgroup]

Cynic wrote:

Google took me to an American forum which suggests something is
trying to gain access via the Ethernet but I never completed giving
the dev web contact just local to our own wifi group.
Just because you didn't grant anything else access, doesn't prevent
something from trying to access the PVR or cameras. It's increasingly
common for botnets to try to use devices such as cameras to attack other
systems.

In a domestic setup you'd usually be behind a NAT device (your
router/firewall) and would have to configure a firewall rule to allow
inbound connections, however if the router has UPnP then it's possible
the cameras have done this for themselves.

If you turn off or unplug your router, then plug back the ethernet lead
does it still crash?

Can you see if you have UPnP enabled (sometimes Xboxes or Playstations
recommend you enable it)?

Can you upgrade firmware on your cameras, router, DVR?

Thanks for your suggestions. I'm not sure why or how someone has found the ip address of my system but it seems something is awry. Would it be worth changing the http port number and media port number? I confess I'm feeling my way in the dark with this stuff.

On Fri, 27 Oct 2017 06:42:04 -0700, Cynic wrote:

Thanks for your suggestions. I'm not sure why or how someone has found
the ip address of my system but it seems something is awry. Would it be
worth changing the http port number and media port number? I confess I'm
feeling my way in the dark with this stuff.

If your system has opened up a port to the Internet and is listening for
an incoming connection (so the owner can, for example, view web cam
footage from a remote location) then the port is probably visible to all.

There is software on the Internet which keeps checking all available
address ranges and ports just to see if something is there listening.

If there is a response then the remote software tries loads of well known
ways to gain access to the device.

Changing port numbers will protect you for less than a second - only until
the next scan goes past.

To check if you do have any open ports, use your PC to go to
https://www.grc.com/x/ne.dll?bh0bkyd2
and run the Shields Up tool, chosing the "All Service Ports" option. This
will tell you which, if any, ports are visible to the Internet.

A good result is all green (no response). This is what you should get with
a standard NAT router where no ports have been opened and they are all
"stealthed". That is, they don't offer any response to the query.

Any other response on any port tells you that there is a process there
that at least is sending some kind of a response back to the query.

If you see any red ports (open) then you really need to do something about
them. If you turn off your devices and the ports are no longer open that
is instructive.

Cheers


Dave R

--
AMD FX-6300 in GA-990X-Gaming SLI-CF running Windows 7 Pro x64

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

Cynic wrote:

Thanks for your suggestions. I'm not sure why or how someone has
found the ip address of my system

There are millions of people out there just scanning the whole internet
for things to hack, they put them into searchable databases, e.g.

https://www.shodan.io/search?query=dvr

You might do a search using the brand name of your cameras.

but it seems something is awry. Would it be worth changing the http
port number and media port number
It might put them off for a bit, but they'd probably stumble into you again.

I confess I'm feeling my way in the dark with this stuff.

Do you ever view your cameras remotely?

I don't view my dvr outside my home wifi ie I only use computers that are part of the home group not via an internet connection although I've often thought it would be useful to do so.
Are there ways of so doing without being exposed to hacking or is it simpler just to forget it?

Cynic wrote:

I only use computers that are part of the home group not via an internet connection

How sophisticated a firewall does your router have? i.e. what model ...

The router is badged Plusnet. I don't have any other information about it.

Cynic wrote:

The router is badged Plusnet.

Quite likely a thomson (but you might find a model number stuck
underneath) in my experience their web interface is limited, you can do
a lot with the CLI but it's kind of cryptic.

Cynic wrote:

The router is badged Plusnet.

Plusnet do offer a firewall at their end, rather than yours, you could
try setting it to "high" and see if it fixes the issue.

https://portal.plus.net/my.html?action=firewall