Need Help: My cam system Dahua gets Illegal login attemps and even real access

[Everthen]

Hi you all, Im new here, Have a problem since about 3 years:
I´ve got a Dahua DH-XVR5108HE-X system in my office, with 7 cams. I´ve got full direct access to that system. Software version is V4.001.00000.15 , Build 2021-10-13. No newer updates for that using the button on the web access.
We are 3 users which usually connect to cams:
1st- Me as administrator, using admin account in LAN PC web browser or Smart PSS app
2nd & 3rd : other 2 users who login as created user accounts using the mobile app DMSS or gDMSSPlus.
Since about 3-4 years I usually get some login attemps from different IPs, which I usually revise them and I add them to BLACKLIST so they dont go on attempting to get in my system or hack my pass. I get about 2-8 attemps per week.
All accounts created by me, even the admin account have strong pass.
The problem comes when I get in the log event the following lines:

• [Username : admin] [Log Type: Illegal Login ] Event Type:Illegal Login Event Action:Event Start Start Time:2024-08-15 09:54:07 IP Address:127.0.0.1 Username:admin Group:admin
• [Username : admin] [Log Type: Illegal Login ] Error Code: Wrong username or password. Time: 2024-08-15 09:54:07 Group: admin IP Address: 127.0.0.1 Username: admin
• [Username : admin] [LogType: adduser] Username: deafult
• [Username : admin] [LogType: modify user] IP Address:127.0.0.1 Username:admin Group:admin Permissionlayback Channel 1:No-->Yes 2:No-->Yes 3:No-->Yes 4:No-->Yes 5:No-->Yes 6:No-->Yes 7:No-->Yes 8:No-->Yes
• [Username : admin] [LogType: modify user] IP Address:127.0.0.1 Username:admin Group:admin Permission:Live Channel 1:No-->Yes 2:No-->Yes 3:No-->Yes 4:No-->Yes 5:No-->Yes 6:No-->Yes 7:No-->Yes 8:No-->Yes
• [Username : deafult] [LogType: user logout] Time: 2024-08-15 09:54:36 Group: admin IP Address: 127.0.0.1 Username: deafult
• [Username : deafult] [LogType: user logged in] IP Address:127.0.0.1 Username:deafult
• Here comes several (6 or 8 ) logins and log outs from "deafult" user
• [Username : deafult] [LogType: Delete User] Username:deafult

So , it seems that a hacker get access to my system, from 127.0.0.1 (usually when mobile apps get access it appears this IP) , and creates a "deafult" user (not default) , and then he access to my cams for 2 minutes and after that he deletes the "deafult" user he created.
This EXACT same thing (with different user names such as "admln" (with an L) ) has happened about 6 months ago. So first time I hope it was just an alone hacker, but it seems it could be easly hacked with whichever that method.

I think I need help here to prevent that, so I just registered in this forum to show you my case. Can someone help me with that? Thank u very much!!

 

[looney2ns]

You need to use a VPN to access your NVR.

How to Secure Your Network (Don't Get Hacked!) | IP Cam Talk

 

[bigredfish]

I don’t think those 127.0.0.1 attempts are outside intruders. I’m not enough of a network guru to be sure but I think that’s the machine talking to itself.

Are you port forwarding at your router to allow access? If so don’t.

Either install OpenVPN on your router and remote devices or simply turn on P2P on the NVR and access it remotely by serial number

 

[steve1225]

How You access this NVR from internet?

are You using P2P or open port at router with some DDNS?

 

[steve1225]

Are this logs are time correlated with time that someone from the NVR users are doing anything in system?
even watching via dmss?

 

[Carcus]

I think that's logs from any client that tries to connect using P2P.

That's a loopback address, be nice if the software actually showed the address but it doesn't.

Strange that you're getting failed login attempts though, unless someone has your serial number.

 

[steve1225]

I think that's logs from any client that tries to connect using P2P.

That's a loopback address, be nice if the software actually showed the address but it doesn't.

Strange that you're getting failed login attempts though, unless someone has your serial number.

that's was also my thinking..
P2P works like VPN - it relays Dahua private protocol (which is TCP/IP based) via UDP P2P protocol - which is simply a form of VPN..

so connections from 127.0.0.1 on NVR usually means a P2P ones..

Older versions of Dahua P2P are vulnerable to scan attacks - where attackers can scan different serial numbers to find proper ones.
This is way is important to upgrade NVR/cams firmware to latest ones - P2P is changed (as protocol) a lot to block those problems..

This NVR is a old one with old firmware - so it can support older (vulnerable) versions of P2P.

My solution - change admin user name to something different... so even someone will try to log as admin, there will be no such user..
try to find newer firmware for it...

Index of /Firmwares/Recorders/HDCVI

Index of /Firmware/Rejestratory/HDCVI

 

[TonyR]

My solution - change admin user name to something different... so even someone will try to log as admin, there will be no such user..
try to find newer firmware for it...

Just ran across a client's 2017 Amcrest (Dahua-OEM) with frequent attempts to log into the default "admin" which keeps locking them out for 20 minutes. The bad news is it has latest firmware (from 2017!) AND what's worse you cannot change admin to something else. The current solution was to create a new user with all of admin's permissions so that they could still log in with their phone app to the new user while admin was locked out.

When I gave that NVR to the original client in 2019 he only used it locally to see one cam, and he didn't care about viewing remotely. He passed away in 2022, the new hubby from summer of this year ('24) wanted 2 more cams and to be able to see it on an app when they were at his house most of the time, the cameras are at a lake house where they come on weekends.

Since I'm really a BI person and have only installed 3 NVR's vs. 6 BI servers I did some reading and found where other Amcrest NVR users of that age had complained about the same thing: the username "admin" is un-editable and not removable.

 

[bigredfish]

Any NVR port forwarded will see those attempts. Good news is if you’re seeing them in the logs they were unsuccessful