Can I bypass my own networked camera?

Question

We have networked camera on my house. My brother is protected by user name and password. When I check my network in laptop, I can see the networked camera in my network but when I click to open, it direct to the webpage 10.143.210.12/index.htm and asking me user name and password.

I tried by using different ports, e.g. http:// 10.143.210.12:800, :443, :8080 etc.. (still asking me user name and password). I doubt that someone (guest) who is using our home network can hack into our networked camera.

Is that possible to crack it in? Does being in the same network make it more easy to crack the camera or still the same security strength?

Answer 1

There are a bunch of potential ways for an attacker on your network to break into it:

• Bruteforce the password.
• Sniff traffic on the network, wait for you to log in via HTTP (not HTTPS) and steal the login details.
• Use ARP spoofing (a.k.a. poison routing) to perform a man-in-the-middle attack and steal credentials that way.
• Run sslstrip to perform an SSL man-in-the-middle, then steal the login details when you log in. If you already get SSL warnings when logging in on port 443 (likely on an embedded device) you'd never notice that you'd been tricked.
• If the router uses session cookies and HTTPS is not used exclusively, an attacker may be able to steal the session cookie and hijack your session, giving them full access to the camera.
• Identify vulnerabilities in the camera software and exploit them.

If the attacker doesn't have direct access to the network, they'd have to compromise an internal system or exploit vulnerabilities in your internet-facing router in order to get access. Some routers have poorly designed / configured implementations of UPnP that allow port forwarding rules to be set remotely.