Camera hacked behind VPN?

[foscam?]

I recently bought 2 cheap foscam IP cameras and hooked them both up about 5 days ago. 2 days later I was messing around in the settings and saw that it logged the IP address when someone logs in, and shows what user they logged in as. I noticed a couple of weird IP addresses in the list and did a whois on it, one was from Germany and one from the UK.

Some details:
I upgraded the firmware as soon as I hooked them up
I changed the default password to something else
I enabled port forwarding on my router so that I could access them remotely
I connected to the cameras (not using https) using a few popular android apps while I was playing around trying to figure out which app to use

It was after all that that someone from Germany connected to both cameras. I had a thought - could one of the apps have stolen my info (IP address, username, password)? sounds crazy, but i got hacked really fast.
Or are the cameras so insecure and vulnerable that someone scanner my ports that fast, found both the cameras, and bypassed the built in security and logged in?


SO, I thought enough of that, I'll disable port forwarding and put them behind a VPN. Within 6 hours of doing this, someone from Germany connected again. WHAT?? How is that even possible?? Anyone have any thoughts? The ONLY thing I can think of is if when they first connected, they injected some kind of code/hacked firmware that opens up a port that the router is not blocking. I read somewhere (cant find it now) an article where it talked about that being possible - that is, injecting some hacked firmware for devious purposes such as gaining access to your network.
I have a couple Hikvision cameras that have port-forwarding somehow built into the camera settings - ie - you dont have to manually forward the port with the router for some reason. So maybe they did something like that. Have some backdoor port they opened that the router is not blocking.

I need help. Any ideas of what is going on? or any ideas of how to fix this mess? First thought is to get rid of the cameras and hard-wire some better quality ones (like Hikvisions), but its just so far out there in the yard (chicken coop) that i tried a wireless hikvision and it didnt reach with its built in antenna. I dont wanna run 150' of CAT5 if i dont have to.

 

[nayr]

do you have uPnP enabled on your router? your cameras can open there own ports that way...

otherwise setup a rule on your firewall to block your cameras from accessing anything on the internet, could be coming via p2p/cloud backdoor.

cameras are full of security issues, no telling really.. consider them hostile devices on your network.. i do.

 

[Stealth22]

do you have uPnP enabled on your router? your cameras can open there own ports that way...

otherwise setup a rule on your firewall to block your cameras from accessing anything on the internet, could be coming via p2p/cloud backdoor.

cameras are full of security issues, no telling really.. consider them hostile devices on your network.. i do.

Good advice. I plan to keep mine on a separate network entirely, lol.

 

[CamFan]

Don't ever trust these cheap cameras or any IOT device to share my network and have internet access. Like Nayr says, they are hostile and not trustworthy. Full of security flaws, known and unknown.

Check out Shodan to see if you show up.

I use the parental restrictions in my router to never allow them any internet access 24/7. MAC address based. Had to setup a NTP time server on my NVR to allow them to sync time. Otherwise, they are internally accessible and I use my NVR to access them. Milestone XProtect, which I hope is Enterprise grade, hardened and secure. It should be, they sell their softwares to airports, municipalities and other entities that likely get attacked on a regular basis. Probably can't say that for blue iris.

And turn off that port forwarding. Use shields up from GRC to check for open ports.

 

[Abbell]

I upgraded my firewall yesterday... 108 attack attempts failed. I banned the IPs. I am still considering moving the cameras to a separate router on my network and then use my firewall DNS for routing.
Kill UPnP, bonjour, multicasting and then setup trusted IPs if your cameras have the ability. I did this and I either connect to my cameras through BI or on my lan on a computer in the correct IP range.