Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My boss is trying to invest on a CCTV solution that he orders from China, his idea is to market it here after we fine tune the process and configuration and make a few tweaks of our own. It consists of 4 wireless cams and a reception device(that I think has an Android port) that is connected to the internet, then they have an Android/iOS app that enables viewing the camera anywhere in the world, the problem is, we can't...

They are using a UDP protocol to transfer the data - and UDP doesn't have packet verification so the data could be easily corrupted, not a big issue if a few frames of real time video are corrupted, but the way I see it, if one is to intercept a packet, he could keep feeding the same frame to the device and create a video loop, UDP just makes it easier since there's no packet verification, am I right?

This is one of the security concerns I've told him about, but anyway, he wants it to work... What happens here is it must use UPnP connection to the router, and even after enabling it through router setup page (it's a belkin) I can't get access to the cameras from anywhere outside of our network...

inside our network, I can connect my phone to the WiFi and view the cameras, but not outside, not on my house, not on 3G network, not anywhere... the funny thing here is it must be working, because the fellows at customer support in China sent me a picture of our parking lot, where the cameras are pointed at... I've tried contacting them and asking for how they did do it, but they gave me nothing I haven't had already...

Researching UDP yesterday, made me wonder if there's some kind of block to that protocol, since other than a few applications, it has run quite obsolete and it is highly insecure... I don't know if locally (in my router) or at an ISP level, but I would go for ISP since if it was my router not letting the signal get to the internet, they wouldn't have viewed it in china...

share|improve this question
    
UDP is very popular and ISPs don't block it and neither do home "routers". –  Matrix Sep 26 '13 at 9:19
    
If you don't use proper crypto, such an attack will always work. No matter if you're using TCP or UDP. –  CodesInChaos Sep 26 '13 at 9:29
    
Yeah, that my lack of knowledge :p What about UPnP i found online that belkin routers can be a pain to configure UPnP but i've tried multiple times with different settings including disabling UPnP and manually port forwarding the different ports the device uses –  Antero Duarte Sep 26 '13 at 10:03

3 Answers 3

up vote 1 down vote accepted

UDP is no more, and no less, protected than TCP. It is a transport mechanism, not a security system. We sometimes say that TCP is reliable because, contrary to UDP, it includes provisions for acknowledging received packets and emitting again missed packets, but this is not a "security" reliability; it is only against non-malicious transport errors.

If TCP was used, it would not be intrinsically "safer". When we want a "safe TCP", we use SSL/TLS. SSL needs a "reliable" transport like TCP (because it checks that it received every byte in due order and with no alteration, but does not include corrective actions against transmission errors, only detection). However, there is a variant of SSL which is meant to be applied over UDP: DTLS. Thus, a CCTV system which transfers data over UDP may be secure, if it uses DTLS, in the same sense that a CCTV system which transfers data over TCP may be secure, if it uses SSL/TLS.

I don't claim that your CCTV system uses DTLS; I'd actually be surprised if it did. But I want to point out that while UDP does not provide any security, it is not adverse to security either.


That being said, since the CCTV system is supposed to work over any Internet access, and you would get the pictures with an app on your phone, then chances are that the pictures are actually sent to a server operated by the camera vendor. Indeed, there is a "rendez-vous" between the client (the app on your phone) and the camera, the latter being hidden behind an ISP which may apply a dynamic IP; a third party is more or less needed at some point.

In any case, you'd better trust them... If pictures of your parking lot are considered sensitive, then a reasonable first step might be, perhaps, not to send them to people you hardly know in China. Just saying. The operative word here is not "China" but "hardly know": you are delegating your physical surveillance to a third party, and that is not an innocent move.

share|improve this answer
    
No man, i do trust them, i have no problem with them seeing the image, thats why we have it pointed at the parking lot while testing, the thing is, they are able to see the picture and im not when im home, i can only see the picture when inside the network to which the CCTV device is connected to, could this be because of this "rendez-vous" you said that the data is being fed to a server and back here, i mean, if they are based in china, most likely their servers are closer to them than to us, which means they are able to connect with less effort (lower ping and delay), could this be why... –  Antero Duarte Sep 26 '13 at 13:49
    
they can see it there and i cant see it here? i mean, a video feed is a large quantity of data, the worse the connection the harder it should be to connect at all... If this is the case, we cannot use this system... –  Antero Duarte Sep 26 '13 at 13:52

When you are connecting to your cameras inside your LAN are you using your external IP address or local address?

Edit: Also, are you only able to connect using an App? Or was there software as well for PC's?

share|improve this answer
    
their app is very poorly designed, it doesnt ask me for any ip at all, all i need to input is a device ID (different for every device of theirs, or so i hope...) and a password defined on the device itself –  Antero Duarte Sep 26 '13 at 8:50
    
No - you do need an IP. Otherwise how do your packets get to it to ask for the image to be sent back. –  Rory Alsop Sep 26 '13 at 8:57
    
Maybe the app is using broadcast to discover the CCTV. Use a network sniffer to see what is going on. –  Matrix Sep 26 '13 at 9:17
    
alright, i don need an ip, the device obviously has an ip, i've tried setting it to dynamic and fixed and the result is the same, what im trying to say is there is no field in the app to input an ip, i just enter the device id and i assume it gets the ip from there –  Antero Duarte Sep 26 '13 at 9:30
    
i have wireshark installed, what should i look for? –  Antero Duarte Sep 26 '13 at 9:32

To be able to access a DVR outside your LAN you need public IP and an open port or a public IP and uPnP, most of the new china DVR right now is taking advantage of the uPnP (please check uPnP vulnerabilities for safety), the default settings of routers is uPnP enabled meaning any device that can use this technology can gain access or Open ports automatically.. You can use the website provided by your DVR supplier enter your DVR device ID and it should be working.. there is also a setting on the DVR that you need to turn ON the "cloud" most of the DVR uses this term

The website that the your supplier provided is accessing your DVR thru a port that it opened maybe port 9000, 123456 or other ports programed on your DVR.. If your going to access your DVR using your public IP (dynamis/static) logically it will not work because it will go directly to port 80 which your router/modem owns (the router/modem log-in page)..

uPnP + Supplier Website = Port Forwarding + DDNS

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.