Blue Iris Shows Connection to Server in Vietnam?

DLONG2

DLONG2

Known around here
May 17, 2017
783
467
Looking at the log file, I see that Blue Iris reports a connection to a server in Ho Chi Minh City many times a day. What would cause that event? Would this likely be a hacker attempt? My Blue Iris outside connection is my public IP address and then a port number to reach the BI login screen.
 
As I don't know BI I might be talking poo poo, but is this a connection from or to the IP address in Ho Chi Minh City?

Also is it successful?
 
MrRalphMan said:
As I don't know BI I might be talking poo poo, but is this a connection from or to the IP address in Ho Chi Minh City?

Also is it successful?
Click to expand...
blue iris does not make outside connections to any foreign servers...blue iris does support a quasi ddns service if you enable it, but that is a US server....it is only china based companies like dahua and hikvision that dont take privacy and security seriously..
 
  • Like
Reactions: Mike
I am in California. I had to shut down the http server in BI because remote server connections were being made and successful logins to two of my accounts last night. I'll need to investigate the use of VPN to secure my network.

With hackers having been looking in my cameras, will I need to factory-reset the cameras? Neither of the hacked accounts were admin accounts, just user accounts.
 
DLONG2 said:
I am in California. I had to shut down the http server in BI because remote server connections were being made and successful logins to two of my accounts last night. I'll need to investigate the use of VPN to secure my network.

With hackers having been looking in my cameras, will I need to factory-reset the cameras? Neither of the hacked accounts were admin accounts, just user accounts.
Click to expand...
How in the world we the camera's accessed? Did you port forward the cams? How do you know your bi account was hacked?
 
fenderman said:
blue iris does not make outside connections to any foreign servers...blue iris does support a quasi ddns service if you enable it, but that is a US server....it is only china based companies like dahua and hikvision that dont take privacy and security seriously..
Click to expand...

That's why I was asking if it was outgoing or incoming connections and if they were successful, I wasn't clear from the initial post.

I guess we have the answer now and it's not good.
 
MrRalphMan said:
That's why I was asking if it was outgoing or incoming connections and if they were successful, I wasn't clear from the initial post.

I guess we have the answer now and it's not good.
Click to expand...
It's likely user error...there may have been an attempt but not a successful login unless user is using a silly password
 
The user password I set up had lower and upper cases and special characters. The early connections from Ho Chi Minh city would only show "CONNECTION" in the logs, surrounded with the usual MOTION entries. But last night the CONNECTION entries (from another country) were immediately followed with the markers to indicate LOGGED IN, from a user account. The password was not very simple, and I had even changed it after I saw the initial attempt from Vietnam.
 
DLONG2 said:
The user password I set up had lower and upper cases and special characters. The early connections from Ho Chi Minh city would only show "CONNECTION" in the logs, surrounded with the usual MOTION entries. But last night the CONNECTION entries (from another country) were immediately followed with the markers to indicate LOGGED IN, from a user account. The password was not very simple, and I had even changed it after I saw the initial attempt from Vietnam.
Click to expand...
That is meaningless, bi will tell you if any frames it minutes of video was sent...
 
When I get home tonight I'll review the logs to see if these details were included as well as the login and logout events.
 
I exported the log file and opened it in Excel for clearer viewing. There were successful logins from 3 countries in the near or middle east. Unfortunately, the login used was common to my mobile devices as well as the Roku app. When I rebuild my network and reopen the BI web server, I'll be sure to use unique accounts for each device so as to better understand how a leak may occur in the future, and to watch the logs more closely.

My logs don't show any data regarding the viewing of clips, just that clips were either moved or deleted. I am concerned about the state of my two cameras, if they were in any way compromised. The account which was hacked was not an admin account, but when I do the network redesign with VPN, and rebuild the BI, I'll factory reset both cameras.
 
Last edited:
DLONG2 said:
I exported the log file and opened it in Excel for clearer viewing. There were successful logins from 3 countries in the near or middle east. Unfortunately, the login used was common to my mobile devices as well as the Roku app. When I rebuild my network and reopen the BI web server, I'll be sure to use unique accounts for each device so as to better understand how a leak may occur in the future, and to watch the logs more closely.
Click to expand...
you say successful..what does the log say about video transferred?
 
Hi fenderman. My logs never show that any video was transferred, just that files were either moved or deleted.
 
DLONG2 said:
Hi fenderman. My logs never show that any video was transferred, just that files were either moved or deleted.
Click to expand...
If you click on the status icon then connection tab it will tell you the frames transfer if any...
in the log you will see a login time and logoff time with a calculation of the duration...if you just see a "connection" that is meaningless, that happens when anyone hits the login page even if entering improper credentials..that is likely what you saw...
 
Since I've shut down the web server, my "Status/Connections" tab shows nothing. The log files, however, do have "CONNECTED" and "LOGIN" and "LOGOUT" items listed, all with IPs from the near or middle east. Yes, the logout item does show a total logged in duration.

I know that "CONNECTED" means nothing except someone landing on the login page, and the successful logins were preceded with a series of connections. It was the 'CONNECTED" item from Vietnam which I first saw in the logs, and after looking deeper into them I found 3 logins.

And that is actually what I see.
 
DLONG2 said:
Since I've shut down the web server, my "Status/Connections" tab shows nothing. The log files, however, do have "CONNECTED" and "LOGIN" and "LOGOUT" items listed, all with IPs from the near or middle east. Yes, the logout item does show a total logged in duration.

I know that "CONNECTED" means nothing except someone landing on the login page, and the successful logins were preceded with a series of connections. It was the 'CONNECTED" item from Vietnam which I first saw in the logs, and after looking deeper into them I found 3 logins.

And that is actually what I see.
Click to expand...
This is highly unlikely...I would email support...
is it possible you or one of your users is logging in via a connection that uses a vpn service that places you in remote locations? how long were they logged in for?
 
I have seen a number of remote login attempts on my BI. Granted I have Foscam systems, I have seen attempts from China, India, Russia, Uzbekistan, Pakistan, and other places. I have had to block range of IP's at my gateway router. I am just wondering, is something being advertised that I am not aware of? I cant shutdown my webserver because I use the iphone app to connect remotely to my system. I have locked it down to only my iphone. Any thoughts of how I stop them from getting in?
 
You must log in or register to reply here.
Top Bottom