My Dahua NVR5432 was hacked last week!

MakeItRain said:
So how does OPNSense compare to pfSense and Firewalla Purple?

Is this yet another system that runs on windows Linux that attaches in between the router and your home switch?

I’m actually considering the Firewalla Pirple now from the above recommendation due to its DNS filtration capability.

At this point I’m already nearly $3000 in with my network infrastructure upgrade so I might as well keep going.
Click to expand...

OPNsense and Pfsense are definitely related. Pfsense came first but then OPNsense forked off and created their own version. Pfsense is basically run by Netgate while OPNsense is owned by Decisio. Today they look quite different and both are very capable but I prefer OPNsense because IMHO the navigation and rules are easier to implement than Pfsense. You can run it on a separate PC but honestly I prefer to just use purpose built hardware (see link below) since it’s just easier to maintain and speeds tend to be more stable since it is dedicated equipment.

OPNsense® Shop – Everything to secure your network and more

shop.opnsense.com shop.opnsense.com

The other option if you want to go cheaper is to use something like a Protectli to install either Pfsense or OPNsens and you can try each to see what you like better.

protectli.com

Protectli: Trusted Firewall Appliances with Firmware Protection

Secure your network with a trusted Protectli Firewall Appliance! Fully compatible with open-source software. US-based support, warranty and repairs.
protectli.com protectli.com

I don’t have a ton of experience with Firewalla so I really can’t do any in depth comparisons but from what I had researched it seems like more of a consumer grade system vs Pfsense/OPNsense which I would put in the prosumer or small to medium business range for firewalls. This doesn’t mean Firewalla can’t work for you if it has all the features you’re looking for, really just depends what you want. Pfsense and OPNsense are more powerful but also made for more technical folks so they would have a steeper learning curve if you are trying to install everything yourself. Lots of stuff on YouTube for both of those so I wouldn’t get too intimidated if you did decide to go that route.
 
Last edited:
  • Like
Reactions: bigredfish
yes Firewalla is clearly aimed at consumer and SMB. It is as mentioned above not as powerful as other more advanced firewall products like Pfsense which has been around quite a while I think?.

I was looking for something powerful but simple enough for an average homeowner or small business who doesnt want or likely need to get too far in the weeds of learning to create firewall rules, examine packets, etc. . I'm pretty happy with it and think it will meet the needs of most consumer users

User Manual

We want to keep this user manual as simple as possible. If some function requires too many words to explain, it probably means we need to redesign our user interface. If at any stage you have problems or suggestions, please feel free to send email to help@firewalla.com. Customer satisfaction...
firewalla.com firewalla.com
 
  • Like
Reactions: looney2ns
steve1225 said:
key logger / trojan / malware on any computer (especially Windows)..

Milions people don't even know that theirs computers are infected..
Click to expand...
Key loggers can be pretty scary. Maybe the OP could put all his passwords on an encrypted thumb drive. When he needs to use a password you could plug in the thumb drive and copy and paste the passwords. No key strokes. Pain in the butt for sure but better than getting hacked.
 
Your first line of defense is to run any of the good antivirus software which will detect and eliminate any key loggers, Trojans, and viruses.
 
I ran Windows Defender scan along with MalwareBytes scan. Nothing found. No keyloggers. I'm convinced the intrusion was a network intrusion. I have confirmed that I was not the only one hacked this past couple of weeks. Others were as well and had the same signature.
 
I’ve just about fully migrated all Dahua cameras to my new Ubiquiti UNVR. The Ubiquiti App is so much more easier to use than iDMSS. So much more user friendly. However, the Protect UI on the console for managing cameras is quite lacking when compared to Dahua’s NVR app.

Another bummer is that Ubiquiti does not support H.265 decoding.
 
Just found out this week that some of my customers NVRs were probably hacked. Two are clearly hacked: users vclubsql and roman have been added. Three cases are unclear: updates and config users have been added. Does NVR add config+updates itself during update or could those been hacked as well?

Haven't found anything else harm done in the NVR.

Common for all of these cases are that they use fiber connection from same ISP. No port forwards, and 4/5 have better firewall than just ISP fiber router.. P2P active.
 
Maybe this is a result of the "old" weak security P2P implementation that @steve1225 mentioned that seems to affected European models prior to a certain date? or maybe an inside thing on one of the P2P servers..
 
  • Like
Reactions: looney2ns
oh6hfx said:
Just found out this week that some of my customers NVRs were probably hacked. Two are clearly hacked: users vclubsql and roman have been added. Three cases are unclear: updates and config users have been added. Does NVR add config+updates itself during update or could those been hacked as well?

Haven't found anything else harm done in the NVR.

Common for all of these cases are that they use fiber connection from same ISP. No port forwards, and 4/5 have better firewall than just ISP fiber router.. P2P active.
Click to expand...

As always - this could be done in many ways:
  • open port (OK, You didn't),
  • very old firmware and old P2P protocol which wasn't secure enough (in all countries - not only in Europe - this is way Dahua blocked old P2P on servers)...
  • someone hacked Your clients (or Yours) computers / mobiles and taken NVR serial id and admin password from SmartPSS configuration or web browser password database..

Third option is not rare.
Windows / Android malwares scans / copies and send to CC servers thousands of important users files..
Mac / iPhone users are less affected.

This is very often the case where EVERYONE is using one ADMIN account/password and this password is on many computers / mobiles...

Solution:
  • update firmwares to latest ones...
  • update SmartPSS / mobile apps to latest ones..
  • STOP using admin account for everything. Admin account should be only for admin - 1 specified person who administrate NVR/camera and only for administration (so NO DMSS / SmartPSS use!!!)
  • all normal CCTV users (web/DMSS/SmartPSS) should have separate LOW PRIVILEGE NON ADMIN users on NVR...
Low privilege/ non admin account can't create other users / change password / change configuration...
 
  • Like
Reactions: oh6hfx and bigredfish
Good points indeed @steve1225 ! Haven't thought about the possibility of mobile client leak. In some cases they are indeed logged in as admin. Only 1/5 of these has smartpss installed, so mobile client could be the culprit here.
 
Did a bit log search and found one example when config and updates account were added. According to log it looks like they have been created via P2P.
 

Attachments

  • nvr_kayttajatilien_lisays.jpg
    nvr_kayttajatilien_lisays.jpg
    67 KB · Views: 10
oh6hfx said:
Did a bit log search and found one example when config and updates account were added. According to log it looks like they have been created via P2P.
Click to expand...

if someone stole admin password & NVR serial id from windows / mobile - then this is how he connected - over P2P...

One more time - admin user should be used only for administration purposes over NVR interface..
All SmartPSS / DMSS / web viewing & searching should be done using low-privilege non-admin user & password...
 
  • Like
Reactions: looney2ns and bigredfish
PS. On Polish Dahua Facebook group threads about problems with hacked NVR or cams are usually once per week...
There are always tons of random people's comments that Dahua has security holes and doesn't care about security.

I always ask a few questions like router open ports, firmware fresh updates and usage admin user for everything - and the responses always indicate that the break-in was the result of user/administrator negligence.

Last time I had case of 'super installer' who had 200 NVRs under management (some security company, installing alarms & CCTV and doing supervision services).
It turned out that he used open ports on routers everywhere (because he can connect quickly) and one common password for his management account.
Of course he didn't take the advice not to use open ports and only P2P - because it's too much work for him..
 
  • Like
Reactions: bigredfish
In past there were bugs/illogicalities in NVR access rights, sometimes even viewing cameras with mobile app (old one earlier than gdMSS, from year 2016 or so) was not possible without creating separate user group
for viewers with CAMERA option ticked. Then I remember that also there was something with notifications. Worked with admin account, not with regular user. Often it was easier just to log in as admin in mobile app too...
 
You must log in or register to reply here.
Top Bottom