Multiple Dahua locations trying to gain access to NVR

[Nick70068]

I installed a new network security appliance (Firewalla) and in a short time I noticed multiple Dahua locations from America, Germany, Japan, Russia( malicous site) and Singapore trying to gain access to the NVR. And of course there were numerous

Is there any reason Dahua is access the NVR?

Attached are several Firewalla triggered alarms displaying the access.

BTW, system is a DHI NVR5208-8p-4ks2e (V4.002.0000007.R, Build Date 2024.07.17)

 

[steve1225]

Many questions:

• have You open port to NVR on router?
• have You enabled P2P on NVR (network -> p2p)?
• have You enabled uPnP on NVR (network -> uPnP)?

Can You tell from firewall logs on which port numbers (source & destination) and which protocol (tcp, udp) those transmissions were done?
this will allow to specify method used to those attacks..

 

[Nick70068]

There is the standard P2P enabled for remote viewing, with a very strong password.

 

[steve1225]

There is the standard P2P enabled for remote viewing, with a very strong password.

what with other my questions?

 

[Nick70068]

Can You tell from firewall logs on which port numbers (source & destination) and which protocol (tcp, udp) those transmissions were done?
this will allow to specify method used to those attacks..

Yes, I have the standard 37777 port open for remote viewing and of course port 80 for webviewer.
No UPnP ports open


Firewall can't give me the port numbers or if it was tcp,udp protocol.




Like Quote Reply

Report

 

[steve1225]

Yes, I have the standard 37777 port open for remote viewing and of course port 80 for webviewer.
No UPnP ports open

Man, You opened both NVR ports to full internet and then you complain that the entire internet are trying to connect to it
Congratulations

there are millions of internet crawlers which try to connect to each ip address and each port..
to check which services is open to public & can be hacked...
millions cams were hacked that way..

There are public website with databases of open services & ports...
Check:

https://www.shodan.io/search?query=dahua

Almost milion opened Dahua cams & NVRs...



Disable opened ports & migrate to VPN..
Or if VPN is too difficult You can use Dahua P2P as much more secure option comparing to opened ports..