NVR4108-4KS Recordings Paused by Thieves

aabs

aabs

Getting the hang of it
Mar 19, 2017
101
32
UK
As per the title of the thread. Today the police knocked on my door to view footage of a robbery which had taken place in a neighbours property.
However when I went to view the footage both the cameras that had that area covered had been paused recording whilst the crime took place.

Went into the events log and saw that my system had been logged into at that time but HOW ?

I have a VPN running and I have changed the NVR default passwords to the admin account and the 88888 account.

Starlight cameras also have no gateway address for not internet facing.
NVR4108-4KS firmware 3.215.000000.3

Eager to find out where my vulnerability is and how this has happened if anyone can help.

A few screen shots attached, hope someone can help me plug my security flaw.
 

Attachments

  • IMG_1791.JPG
    IMG_1791.JPG
    2.8 MB · Views: 260
  • IMG_1794.JPG
    IMG_1794.JPG
    2.3 MB · Views: 260
  • IMG_1793.JPG
    IMG_1793.JPG
    2.6 MB · Views: 252
What about the details, of the logs ? And there is something other ? The recordings seem stopped around 2:46 AM
 
Hi Redfive,
Yeah the robbery took place at 2:46. My system was rebooted at 03:02
Can't figure out all cameras paused at 2:46 followed by a reboot.
Maintenance reboot is disabled and I've check other random dates and no pauses in any other night time monitors.
 

Attachments

  • IMG_1795.JPG
    IMG_1795.JPG
    3.4 MB · Views: 103
  • IMG_1796.JPG
    IMG_1796.JPG
    2.2 MB · Views: 100
Last edited:
I wonder if that could have been automatic maintenance of some kind on the NVR. Since your log doesn't show any events for an hour leading up to the reboot it is hard to say what happened. Does the details button show anything for the shutdown/reboot and later events to suggest what may have triggered it?

You should check on UPnP and port forwarding features as noted here: How to Secure Your Network (Don't Get Hacked!) | IP Cam Talk

I'd also recommend preventing the cameras and NVR from having internet access at all, and when you need remote access use only a VPN.

There's also the possibility that something else simply failed on the NVR at exactly the wrong time and that nothing related to the failure got logged.
 
  • Like
Reactions: Zion and mat200
alastairstevenson said:
That does seem like an amazing coincidence - and way too sophisticated for normal smash-and-grab burglars.
But just in case - you can check the extent of external access using a service such as ShieldsUp! GRC | ShieldsUP! — Internet Vulnerability Profiling
Use the 'All service ports' scan, not the UPnP scan, in the first instance.
Click to expand...
Yeah the police did mention that it was a very organised gang taking prestigious vehicles in the area. I have no doubt that they have somehow disabled my system. I'm eager to find out how as I've followed all advise on here in the past. E.g. VPN, no wifi cameras and no gateways apart from NVR which is needed for my remote viewing.

Done the port scan and all Green
 

Attachments

  • IMG_1797.PNG
    IMG_1797.PNG
    491.1 KB · Views: 77
  • Like
Reactions: alastairstevenson
The shutdown seems at 03:01:33, and then rebooted (like a power outage), the strange thing is that the recordings were stopped before, without any logs about this ...
 
No the power being switched off would of triggered my property burglar alarm and would of been obvious as all the AV equipment/clocks and other gadgets would all be flashing displays.
Also no further information in the details of who rebooted the system.
 
  • Like
Reactions: mat200
redfive said:
The shutdown seems at 03:01:33, and then rebooted (like a power outage), the strange thing is that the recordings were stopped before, without any logs about this ...
Click to expand...
Yeah this completely fits in as the vehicle was taken at 2:50 and picked up on a police APR camera at 3:10 a 2 miles away.
 
aabs said:
Done the port scan and all Green
Click to expand...
Yes, looks good.
Though remember it's only service ports.
Maybe also do a custom port scan on the higher ports that the NVR uses.

aabs said:
I have no doubt that they have somehow disabled my system.
Click to expand...
That would be pretty stunning.
Can you ask the Police if they are aware of any similar situations where CCTV has been disabled?
That would be very newsworthy, in my view.
 
  • Like
Reactions: mat200 and fenderman
redfive said:
Do you have a wifi around from which you can access the NVR/cams ?
Click to expand...
I have a guest wifi which has no access to LAN and password protected.
I have my wifi which does have access to LAN and is also password protected.
Reason for guest wifi is for visitors so I don't give access to my LAN.
I'm a dam more careful than most !!
 
  • Like
Reactions: mat200 and alastairstevenson
So that's not an NVR with PoE ports (I'm unfamiliar with Dahua kit).
Do the cameras and NVR connect on a switch, ie not through switch ports on your router?
 
aabs said:
I have a guest wifi which has no access to LAN and password protected.
I have my wifi which does have access to LAN and is also password protected.
Reason for guest wifi is for visitors so I don't give access to my LAN.
I'm a dam more careful than most !!
Click to expand...

How strong are the passwords for your wifi? What encryption are you using for your WiFi?
 
  • Like
Reactions: mat200
alastairstevenson said:
Do the cameras and NVR connect on a switch, ie not through switch ports on your router?
Click to expand...
I'm thinking if they are capable enough to be using one of those relays / boosters for breaking into keyless cars, there could also be a WiFi disruptor aimed at the many that use WiFi cameras - that could give the router/AP a hard enough time that it doesn't pay enough attention to the router switch ports, to the detriment of any traffic though them.
If the normal camera traffic passes through them.
Pure unfounded speculation of course.
 
  • Like
Reactions: mat200, bp2008 and aabs
redfive said:
Did you check the logs on your router and/or wifi system ?
Click to expand...
Wifi logs on router don't go back far enough only 10 hours or so due to the amount of activity.
I have tried a telnet session but get no connection, don't know if it support sssh
Totally at a loss how they have got in but when things emerge such as SHODAN did it might make a little more sense as the crooks always seam to be a step ahead with tech vulnerabilities.

With reference to the last post, at least and I will now enable DOS attacks.
 
You must log in or register to reply here.
Top Bottom