2132-I turret camera gone off line

[Ajpepe72]

one of my cameras (2132-I) has lost its signal with blue iris software and when viewing ip addresses of connected systems in my router software it is not showing.
I have confirmed the Poe hub and Ethernet lead are good so a bit stuck now as the camera does not have a reset switch ?
It's a few years old and can't remember if it's a Chinese version but I suspect so.
Any ideas guys ?

 

[alastairstevenson]

Check if SADP can see it. Hangzhou Hikvision Digital Technology Co. Ltd.
If it's been reset to defaults, or had the IP address changed, or reverted to a recovery (min-system) mode, SADP will find it.

 

[Ajpepe72]

Ok I've ran sadp and it's showing the camera but looks like it has reverted to factory settings, IP address is showing as 192.0.0 prefix instead of 192.168.0.
I've managed to modify the parameters successfully in sadp and it's now showing it's proper IP address but I cannot log into the camera directly via web browser ?

 

[alastairstevenson]

I cannot log into the camera directly via web browser ?

Do you get the logon screen?

Does it show the version of firmware you'd expect, or is it 4.0.8 ?
If 4.0.8 then it's running in a recovery, min-system, mode with no web services.

 

[Ajpepe72]

All sorted, I made an error when modifying the IP address, I typed 192.169 instead of 192.168.
All back up and running now,thank you very much for your assistance.
Camera has been faultless for about 2 years so have no idea how it reverted back to factory settings.

 

[alastairstevenson]

All back up and running now

That's good.

Do you have any external access to the camera, ie have you set up any 'port forwarding' on your router?
Or do you have UPnP enabled on any camera services and on your router?
Following publication of the details of how to easily exploit a 'Hikvision backdoor' there seem to be quite a lot of Hikvision users reporting various types of changes to their cameras, IP addresses, resets to defaults etc.

 

[Ajpepe72]

Yes I have external access, both my cameras are not running default passwords, well this camera I had the issue with had reverted back to factory password but I've changed that again now.
Both this and my 2032 are showing v5.0, build 140714.

 

[Ajpepe72]

Actually I lied there, my 2032 is running the default password as I tried to update firmware on it last year (schoolboy error) so it lost its English menu so when logging in now is all in Chinese, and as I'm not fluent in Chinese I can't get to the security section to modify it

 

[normel]

alastairstevenson, would it be wise to also change the default ports of the camera in stead of using 80 and 8000 ( in order to at least more preventing this kind of things to happen ) ( besides of doing firmware upgrade , and using strong passw? _

 

[alastairstevenson]

it lost its English menu so when logging in now is all in Chinese, and as I'm not fluent in Chinese I can't get to the security section to modify it

You can do detailed configuration in English of a Chinese menu Hikvision camera with the Batch Configuration Tool here : Hangzhou Hikvision Digital Technology Co. Ltd.
Or if you want to be adventurous, and also update to a backdoor-fixed firmware version, you could do the 'enhanced mtd hack' : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

well this camera I had the issue with had reverted back to factory password but I've changed that again now.

It sounds like it's been messed with by an internet bad actor.
The backdoor exploit does not require use of any passwords that you have set.

 

[alastairstevenson]

would it be wise to also change the default ports of the camera in stead of using 80 and 8000 ( in order to at least more preventing this kind of things to happen )

As you've indicated - this doesn't prevent anything, it just makes the scanning activities take a little longer.
And some Hikvision cameras do not play well after a default ports change.

 

[Ajpepe72]

Thanks Alistair, I shall look into those.
Is there a way to also secure the 2132 turret cam as this is our baby monitor camera?
The users in blueiris show no unusual activity, only log ins from our own devices.

 

[fenderman]

Thanks Alistair, I shall look into those.
Is there a way to also secure the 2132 turret cam as this is our baby monitor camera?
The users in blueiris show no unusual activity, only log ins from our own devices.

if you are using blue iris there is no need to port forward your cameras...turn off upnp and port forwarding on your router....disable upnp on your cams..

 

[Ajpepe72]

Hi fenderman, sorry didn't really explain that well. My router port forwards to the blue iris server, not the actual cameras.
I assume I still need to port forward to blue iris or is there a better way to remote view blue iris ?

 

[alastairstevenson]

Is there a way to also secure the 2132 turret cam as this is our baby monitor camera?

Should you decide that an upgrade is necessary, the 'enhanced mtd hack' would be OK for the 2132. But any mtdblock6 changes should best be done while running the 5.2.5 firmware.
Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

 

[fenderman]

Hi fenderman, sorry didn't really explain that well. My router port forwards to the blue iris server, not the actual cameras.
I assume I still need to port forward to blue iris or is there a better way to remote view blue iris ?

If you cameras are not port forwarded then you are not vulnerable to this hack...even if your blue iris webserver is port forwarded...
and yes, you can setup a vpn....

 

[Ajpepe72]

The camera that went back to default ip address and password has been fine since I reset it but now my other camera (2032) has done the exact same thing twice in two days !
The cameras are not directly port forwarded as they are viewed remotely via blue iris.
Strange !

 

[alastairstevenson]

Just as a double check - use ShieldsUp! to do a full port scan and confirm they are all stealthed. GRC | ShieldsUP! — Internet Vulnerability Profiling  

 

[Ajpepe72]

Thanks Alistair, I will give that a bash when I get home. Appreciate the help.

 

[Ajpepe72]

Ok, so running shieldup scan gave me

'the equipment at the target IP address did not respond to our upnp probes'
All port tests came back as ok, they are all stealth.
The only thing that failed was the ping reply test, is this anything to worry about or not?