3

Just installed a lorex home security system. This is an nvr system much like this one:

http://www.amazon.com/Lorex-LNR400-Channel-Security-Cameras/dp/B00QLA2V28/ref=sr_1_3?ie=UTF8&qid=1455913618&sr=8-3&keywords=lorex+nvr

Although not exactly like this one linked above it is quite similar, however a newer model. The manual asks to open up some port's but am wondering am I exposing too much to the outside world with something like this:

enter image description here

I do know systems like this are vulnerable due to firmware's rarely being upgraded by homeowners but I am pretty much on top of the firmware upgrades as long as lorex provides them.

Has anyone ever installed one of these and are the ports I've opened up pretty typical to access this stuff?

Forgot to mention this is for a personal house of mine not a business. Recently had some vandalism in our community and a huge drug bust of a family that recently moved near us...Scary stuff..even when you think you are living in a safe place stuff like this happens.

8
  • 1
    Why does it need ports open at all? What else is on the computer where the traffic is going to?
    – schroeder
    Feb 19, 2016 at 20:45
  • Looking at the back of the box, I see an RJ45. So I'm guessing that the IP is the box. Is this correct JonH? Feb 19, 2016 at 20:51
  • Yes the IP in question 192.168.1.118 is my lorex box. This is a PoE type system (for those new to that its power over ethernet). The only thing getting power is the actual nvr box, not the cameras. The cameras just connect via standard rj45 to the box.
    – JonH
    Feb 19, 2016 at 20:52
  • 2
    Ok, then the biggest problem is someone scanning the internet looking for cameras with vulnerabilities. If you are ok with that risk, then you have limited exposure. I'd still want to put that device on a guest network or a separate VLAN...
    – schroeder
    Feb 19, 2016 at 20:57
  • 1
    No - I mean vulnerabilities in the software or firmware of the device itself.
    – schroeder
    Feb 19, 2016 at 21:01

6 Answers 6

10

You asked if it was too many ports. That's kind of the wrong question. One port can be too many.

If you want the services that the device provides, and you are willing to accept the risks of outsiders gaining access to the device as a result, then one port or 10, it doesn't matter.

I'd still want to limit your risk by placing this device in a guest network or a separate VLAN, in case the device is taken over to become a pivot point for an attacker.

3
  • 1
    I'm pretty rough with networking in general, although very interested and should take more time to learn more about it. My day job is mainly front end work with c# and sql server, but its no excuse. When you say a guest network or seperate vlan is there any possibility you could diagram something like that out. Are we talking about some other access point or router and connecting that camera alone to it rather than joining it to my current network? ps +1 so far...
    – JonH
    Feb 19, 2016 at 21:03
  • @JonH You probably want a managed switch. It would go: Modem -> Router -> Managed switch -> VLAN A -> rest of network. VLAN B would only connect to the questionably secure security system. There is a caveat here: you need to separate out your access point into a separate device most likely because of your current consumer router not supporting VLANs in this way. Easiest way is probably just to buy a cheap Ubiquiti router. Feb 20, 2016 at 0:53
  • 1
    @JonH just Google 'routers guest network' and buy one. They basically have 2 networks that are isolated from each other. You can ask another question about a specific model if you are unsure that it will do what you need. Best to reference this question if you do ask a follow up. Feb 20, 2016 at 0:58
3

You should only enable port forwarding if you want to view the cameras from the outside world, ex. from your phone or work computer. Port 80 is obviously the web interface where you log in from outside, I'm not sure what ports the other apps are using. You should definitely keep firmware upgraded and use strong passwords unless you want to show up on shodan.io... I would recommend getting a raspberry pi and setting up openvpn and pfsense or ufw firewall on it. Configure it in a way that only certain ip addresses can access it, like your phone and a signing key ca.

2
  • VPN is a good idea. You can get a router with that built-in. Feb 19, 2016 at 21:16
  • Port 80 is HTTP, port 443 is HTTPS. I can't help but wonder why a device that offers incoming HTTPS would also need incoming HTTP.
    – user
    Feb 20, 2016 at 12:26
3

We've gotten this idea that "open ports==insecure". That's at least a little true, so it gets repeated to people in a 2 minute conversation snippet to explain security at a micro-level. One might be lead to believe that "more open ports == more insecure". That's simply not true at all.

The reality is that it's the devices, or services themselves that are insecure. Internet cameras have a particularly bad track record. The way you have to think about this is, are you comfortable with just any old schmo is able to trivially hack into your web camera and watch it? Because that's at least a semi-likely scenario with these sort of devices. There's simply little incentive for the device makers to care about security, and it's largely out of your control.

You say you're willing to keep up with the updates. You're making the assumption that the manufacturer actually cares about security, which they generally don't. Even if they do, you're still opening yourself up for the period until they provide a patch. Who's to say how many people knew about an exploit in an obscure internet camera before it got patched?

The end result is, think of the camera as a publicly available device broadcast on an obscure TV channel. Firewall it off from the rest of your network. Then the worst that can happen is someone can break it. (Which is already true, since anyone could also just throw a good sized rock at the thing).

2

I see two main risks:

  1. The NVR box is insecure. While having no knowledge of this brand, IoT devices are, as you've mentioned, notoriously insecure. How big a risk is very brand/product specific. It's a good sign if the manufacturer has released security patches for this or another product. It means they care (at least a little). But they may release patches without saying they're security related so this isn't a litmus test.
  2. Somehow another device on your network gets that IP address. I assume you're using static IPs for the NVR box, but likely dynamic IPs for other devices. So make sure that your router can't assign that IP to another device. You can probably limit the range of dynamic IPs in the router configuration. This will stop an attacker crashing the NVR and having the IP reassigned to access other devices on your network.

An alternative to just opening the firewall is to get a router/firewall that allows you to configure VLANs or has a guest network. You could then restrict access so that only the NVR device is exposed to the Internet. This will stop a compromised NVR being used as a jump box to attack the rest of the network.

You may also want to disable port 80 and other unencrypted ports if the system will still work. As you're the only one accessing the box, only using SSL shouldn't be a problem.

1
  • This helps me as well..so far this specific device seems to have recent software patches relating to security however you are right..this may be temporary...
    – JonH
    Feb 19, 2016 at 21:14
0

The answer is yes it's dangerous to open ports like this. Just yesterday I saw this article discussing the disclosure of hardcoded root passwords in some Lorex (among others) DVRs.

http://www.pcworld.com/article/3034265/hard-coded-password-exposes-up-to-46000-video-surveillance-dvrs-to-hacking.html

Unfortunately, port forwarding through your firewall is the only way many of these cheap DVRs allow you to use a remote/mobile client to access video when you're away. Towards that end I would definitely put this system on a DMZ in order to protect the rest of your home network from it in the event of a compromise. Or set up your own VPN.

0

As other have indicated you want to put this system on a separate VLAN behind a router/switch and to be most secure, close all those ports and sacrifice the ability to view your cameras via the web. You can view them by configuring a VPN into your home network that allows you to send and receive encrypted traffic to view the cameras and administrate them when away from home.

Search engines like shodan.io exist specifically to find cameras which have been setup without security in mind and you could find yourself having take one step forward on the security of your home, and two steps back.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .