Thanks in part to the discovery in this thread, I discovered that since mid-May, my server has been accessed from numerous off-shore IP addresses (Turkey, China, Australia, Mexico, etc) using my primary credentials.
While I don't know for certain that it was the Roku app (found at the tread above), the timing is suspect - as the unverified logins began right around the time the app was installed.
I use Notepad++ to view the text log, and then search for "login" in "whole document". That creates a split-window showing only the logins with IPs, and the full log in the other window. You can quickly see all the logins, and what happened just prior or after that point in the log.
It is gut wrenching to realize numerous individuals had access to my server, and I was clueless about. It will be my morning routine now to go over the logs from the previous 24 hours.
FWIW, I had "secure only" on the webserver options tab turned off (for compatibility with my VERA home automation system).
Two days ago, I changed my credentials, and enabled the 'secure only' option. As of last night, I had no more unwanted logins. So, last night, I turned off the secure login. By this morning, I had someone from Australia getting in using the new credentials.
Somehow, something is revealing my creds. I've also created separate creds for my VERA HA controller (which I should have done initially anyway). If the next logins occur with those, I'll know the problem is with the HA controller.
I've sent several emails to Ken letting him know what happened, and asking him:
1) Is there a way for the wget command used in HA controllers to trigger BI to circumvent the SSL login
2) Is there anyway to blacklist EVERY IP address, and whitelist only those (ranges) I authorize
3) Is there away to auto-ban IP addresses that attempt repeated failed logins (i.e. brute force attacks).
TL;DR: Had I not checked the logs specifically for unrecognized IP addresses, I would still have no clue that my cameras were open to the world. Stop what you're doing, and review your log files. If you find suspicious activity post it here so we can see if this is a bigger problem than just my system.
While I don't know for certain that it was the Roku app (found at the tread above), the timing is suspect - as the unverified logins began right around the time the app was installed.
I use Notepad++ to view the text log, and then search for "login" in "whole document". That creates a split-window showing only the logins with IPs, and the full log in the other window. You can quickly see all the logins, and what happened just prior or after that point in the log.
It is gut wrenching to realize numerous individuals had access to my server, and I was clueless about. It will be my morning routine now to go over the logs from the previous 24 hours.
FWIW, I had "secure only" on the webserver options tab turned off (for compatibility with my VERA home automation system).
Two days ago, I changed my credentials, and enabled the 'secure only' option. As of last night, I had no more unwanted logins. So, last night, I turned off the secure login. By this morning, I had someone from Australia getting in using the new credentials.
Somehow, something is revealing my creds. I've also created separate creds for my VERA HA controller (which I should have done initially anyway). If the next logins occur with those, I'll know the problem is with the HA controller.
I've sent several emails to Ken letting him know what happened, and asking him:
1) Is there a way for the wget command used in HA controllers to trigger BI to circumvent the SSL login
2) Is there anyway to blacklist EVERY IP address, and whitelist only those (ranges) I authorize
3) Is there away to auto-ban IP addresses that attempt repeated failed logins (i.e. brute force attacks).
TL;DR: Had I not checked the logs specifically for unrecognized IP addresses, I would still have no clue that my cameras were open to the world. Stop what you're doing, and review your log files. If you find suspicious activity post it here so we can see if this is a bigger problem than just my system.
