Camera backdoor?

[lalalelelululala]

Hello guys,

I have a very strange behavior going on in my network.

I know for certain that when I disconnect my Reolink camera, this behavior is gone.

Here is the model:

The mac address asking for an IP is ever-changing so often.
The requests are hammering in every second.
The camera has no access to the internet.

Any idea how I deal with this?

Regards

 

[alastairstevenson]

The mac address asking for an IP is ever-changing so often.

Is the camera set for DHCP or a static IP address?
Does the camera have WiFi and are there just 2 MAC addresses behaving this way?
Why are there no free leases on your DHCP server?
What does the DHCP device list show?

 

[lalalelelululala]

Is the camera set for DHCP or a static IP address?
Does the camera have WiFi and are there just 2 MAC addresses behaving this way?
Why are there no free leases on your DHCP server?
What does the DHCP device list show?

Camera is set to static IP address.
Camera is set to use WiFi. The mac addresses keep changing in a somewhat set interval. (After a reboot of the camera for instance)
There are no free leases because I picked that option.
->
Deny unknown clients
Only the clients defined below will get DHCP leases from this server.

When I undo this option and I open my lease pool the camera is asking for an IP out of the pool despite being statically assigned.

The DHCP device list shows that the camera is online with the IP I gave the "official" mac address.

 

[mat200]

Camera is set to static IP address.
Camera is set to use WiFi. The mac addresses keep changing in a somewhat set interval. (After a reboot of the camera for instance)
There are no free leases because I picked that option.
->
Deny unknown clients
Only the clients defined below will get DHCP leases from this server.

When I undo this option and I open my lease pool the camera is asking for an IP out of the pool despite being statically assigned.

The DHCP device list shows that the camera is online with the IP I gave the "official" mac address.

Hi @lalalelelululala

I see that it is a Reolink WiFi camera.

Check the MAC addressses:

Which MAC addresses are asking and assigned IP addresses?

update: WiFi MAC address? LAN MAC address? other MAC address?

 

[lalalelelululala]

Hi @lalalelelululala

I see that it is a Reolink WiFi camera.

Check the MAC addressses:

Which MAC addresses are asking and assigned IP addresses?

Asking ones are e.g.: 00:25:d1:0b:dd:87 or 00:c8:79:4e:dc:49
Assigned IP address mac = b0:41:1d:3d:a0:43

 

[mat200]

Asking ones are e.g.: 00:25:d1:0b:dd:87 or 00:c8:79:4e:dc:49
Assigned IP address mac = b0:41:1d:3d:a0:43

Hi @lalalelelululala

which is the WiFi mac and which is the LAN mac?

 

[alastairstevenson]

When I undo this option and I open my lease pool the camera is asking for an IP out of the pool despite being statically assigned.

That's the problem then.
The camera firmware is buggy if you've set the IP to static and it's still asking for a DHCP reservation.

 

[lalalelelululala]

Hi @lalalelelululala

which is the WiFi mac and which is the LAN mac?

Lan: ec:71:db:77:d6:2a
WiFi: b0:41:1d:3d:a0:43

 

[mat200]

Lan: ec:71:db:77:d6:2a
WiFi: b0:41:1d:3d:a0:43

Check each interface that you've disabled DHCP.

Funny to see 00:25:d1:0b:dd:87 or 00:c8:79:4e:dc:49 if the LAN and WIFi are not those.

Maybe time to use wireshark or another packet analyzer tool and see what happens when you allow it to grab an IP.

 

[SouthernYankee]

it may be time to drop the reolink POS in the trash.

If you have a good router (like ASUS) block all the mac addresses from accessing the internet. On the asus router you use parental controls to block mac addresses.

 

[lalalelelululala]

it may be time to drop the reolink POS in the trash.

If you have a good router (like ASUS) block all the mac addresses from accessing the internet. On the asus router you use parental controls to block mac addresses.

This might be very true.
The mac addresses seem to be randomly generated. Not really able to block all those.
I can whitelist the legit mac address and block all others.

I have a good router.
ASUS good? Not really.
I built my own router with pfsense paired with Ubiquity WiFi. Beats ASUS by miles.

Thanks everyone for the help.

 

[taz420nj]

This might be very true.
The mac addresses seem to be randomly generated. Not really able to block all those.
I can whitelist the legit mac address and block all others.

I have a good router.
ASUS good? Not really.
I built my own router with pfsense paired with Ubiquity WiFi. Beats ASUS by miles.

Thanks everyone for the help.

pfSense is lightyears better than anything any SOHO router can do...

 

[HealthyHarold]

Folks, I'm having a heck of a time trying to stop these fake MAC addresses generated by my ReoLink cameras, they're taking up all the DHCP address range and causing a mess. The strange thing is that after they use the fake MAC address, they proceed to connect with the real MAC address on finalization (I assume its the real MAC address, but who knows). Reolink support wrongly stated that it was fixed in the latest firmware, which I already had, then they backtracked telling me not to block their fake MAC addresses or it will cause infinite reboots, in other words, MAC filtering is a bad idea. Can anyone understand what they're doing here and why?

----------------
"The fake Mac address was used to detect whether the wifi of the camera is disconnect, which was used DHCP discovery protocols.
If the correct MAC address of the wifi camera was used, the camera will not able to get the DHCP IP address by default automatically.

We also don't suggest you block all the fake MAC addresses, the camera will still connect, but it will reboot itself while no one connects the camera.

Hope you can disregard such fake mac address in your router, which doesn't affect your use of the camera.
We will ask our senior engineer to change the code of the firmware and improve such issue."

------------

"Your camera is already in the latest firmware.
I will consult senior engineer again to get more details for you."

------------

"This fake mac address is just a kind of signal that indicating the camera is keep detecting the wifi and not disconnect with your home wifi.
Just consult with our senior engineer, now for the new firmware we have improved this problem and no random mac address.
Could you please send a screenshot to show us the firmware and we will send the new firmware to you?"

--------------

"Just confirmed with our engineer, the fake Mac address was sent by our camera for Wifi detection.
Every time your camera was rebooted, the Mac address would be changed accordingly to make sure the wifi connection is stable. In this way, we can make sure the camera will automatically connect with your home wifi after reboot or power cut."

 

[Will.I.Am]

Waffle waffle waffle.

I've seen phones use a fake mac address when they're sleeping, but that makes sense so that if they're just sending out silent requests to see what wifi networks are available when you're not actively using the thing, no one can sniff out your real mac address.


There's no reason I can see why an ip camera that is already connected to a network would need to spoof its mac address. No legitimate reason anyway.