I keep reading about hackers accessing laptop and home security camera systems. Most home users are using SOHO routers meaning they are on a private IP range behind a NAT. I realize NATs aren't designed for security, but if an IP camera is behind one, how can a hacker access it?
Would it require either the camera's software or the router to have a security hole (0 day, bad code) or end-user misconfiguration (weak/default password, open/mapped ports) that would let the attacker in?
End-user puts the device in the DMZ because they want to access it remotely and can't be bothered trying to figure out port-forwarding rules. This might happen if a user is Torrenting or has a NAS or other device they want to access from the public internet.
User has allowed direct access to the device via ingress port-forwarding or firewall rules which makes it accessible to probes / attacks. Again, this scenario might be common with a torrenting user or owner of a NAS or DVR that they want to access from the outside world.
An internal device on the network has been compromised and returned a reverse shell to the attacker. Since most (if not all) SOHO routers allow all egress traffic this connection is allowed to take place. The attacker then moves laterally through the network via the originally compromised machine.
The edge router itself is compromised and allows access from the outside world.
There are a variety of ways of bypassing the NAT but the aforementioned are probably the most common attack scenarios.
The cameras are often designed for ease-of-use by people who want to watch the streams of their goldfish or children. To make it easy to use, the cameras often call home to the manufacturer's website for remote viewing. Often these sites are insecure.
Another method is UPnP sets up automatic port forwarding:
One solution for NAT traversal, called the Internet Gateway Device
Protocol (IGD Protocol), is implemented via UPnP. Many routers and
firewalls expose themselves as Internet Gateway Devices, allowing any
local UPnP control point to perform a variety of actions, including
retrieving the external IP address of the device, enumerate existing
port mappings, and add or remove port mappings. By adding a port
mapping, a UPnP controller behind the IGD can enable traversal of the
IGD from an external address to an internal client.
It's easy to disable these features if you're aware of them.
It is possible that the camera is still reachable from the network, even if UPnP, port forward is disabled, and the camera is behind NAT.
Some camera manufacturers use "UDP hole punching method".The API looks like the following:
The camera sends UDP packets to a server every 30 seconds or less. This makes this connection alive, thus the camera can be reached from the server.
The client software initiates a connection with the camera server, and it sends the camera ID to the server.
The camera server connects to the camera through the alive UDP connection, and it notifies the camera that a client is trying to connect to the camera.
The camera connects to the client software directly. If the client software is not behind NAT or firewalled, the connection succeeds. Now there is a working UDP channel between the client software and the camera.
In reality, this process is a bit more complicated with more scenarios, but this is basically how a camera can be reached via the camera server, only by knowing its camera ID.
This happens invisibly to the browsing user, but to the camera or router, the request appears to come from "inside" the trusted perimeter and the door is opened.