Hacked? My cameras had access to the internet

Cold-Lemonade

Pulling my weight
Apr 1, 2021
163
135
Boston
While doing some maintenance on my network, I had forgotten to disconnect my cameras from the switch and, as a result, my ip cameras had access to the internet for about 30 minutes. When I checked the firewall logs after discovering this error, I could see that the private ip addresses associated with the ip cameras were communicating with a public ip address associated with Amazon Web Services and that this ip address was trying to connect to various ports on my router.

How bad do you think the situation is? When I realized the cameras could access the internet, I immediately disconnected the switch to them. I have since rebooted my router to get a new public ip address. These cameras are branded Amcrest, Marquis, and Anpviz (I think the latter two are Hikvision clones). I had changed the passwords to the cameras. I haven't checked the logs inside the cameras yet. Going to do that after I post this thread.

Unfortunately I was working right in front of several of these cameras so if they were sending video out to that Amazon Web Services machine they would have that video.

Any suggestions for other actions to take?
 
Here are the two ip addresses that my cameras contacted and were trying to connect to my router afterwards:

3.236.167.184 (This one is associated with Amazon Web Services) trying to connect from port 443 to port 39359.
208.67.75.242 (This one is associated with be OpenDNS) trying to connect on port 123 so probably an NTP server of some sort and not much to worry about.