21

We're evaluating putting in an IP-based CCTV system for a third-party upcoming project (part of a wider networking project). The CCTV system is cabled as follows: Cat 6 running from each external camera to a POE switch, patch cable from switch to NVR (network video recorder basically HDD enclosure that records the CCTV).

My concern is that there will be multiple long external Cat 6 runs that are essentially very easy entry points into the network. All some one would need to do is cut the cable, put RJ45s on both ends of the cut, place a small switch in-between and then patch themselves into the switch... Apart from the couple of minutes downtime, the CCTV camera could even carry on working.

What can I do to secure the network? I can't just not connect that switch to the rest of the LAN because there are third-party apps (home automation controllers like Crestron) that we use that sit on the local network and access the NVR as well as other local area network-attached devices.

Improve this question
5
  • 6
    Alert on the switch when connectivity has been interrupted (no link light). Use tougher conduit.
    – user2320464
    Oct 31, 2016 at 16:23
  • 14
    The CCTV cameras should be on their own subnet/VLAN etc. This way you can't get into the network proper from the long external UTP runs.
    – Aron
    Nov 1, 2016 at 3:14
  • 5
    Semi-related - don't trust your cameras either. I have seen several (eg hosafe) that "phone home" and you can't disable that in the camera. So use your firewall to prevent all egress from the camera VLAN/physical LAN.
    – Criggie
    Nov 1, 2016 at 4:48
  • 11
    "couple of minutes downtime" ... Amateurs.
    – Eric Towers
    Nov 1, 2016 at 5:01
  • 2
    In addition to @user2320464's comment: run the (steel) conduit where you'd need a ladder to get to it (when it has to be in an insecure area). They're quite obvious on CCTV which you know you've got, and which should cover the approaches to the buildings. Anti-climb paint may be needed on some structures.
    – Chris H
    Nov 1, 2016 at 15:16

9 Answers 9

Reset to default
25

Options that come to mind:

  • Use a Managed Switch to provide access control by physical port.

    • For each physical port, only a specific IP address can be allocated (i.e. that of the camera) This may help detect attacks because if the attacker tries to create an IP conflict to access the rest of the LAN then that will likely interfere with the camera connection. More advanced attackers can probably avoid such detection though.

    • For each IP we now know it can only come from a particular physical port. We then create access control lists by destination IP and TCP port number.

  • Ideally the cameras should use HTTPS and that your receiving station is secured against MiTM by verifying the camera's HTTPS certificate fingerprint. At the very least the cameras should have some kind of authentication before releasing their video stream and configuration interface.

  • If modern WiFi is an option it has a built-in authentication before accessing the LAN based on a shared secret. However, it can be DoSed wirelessly and its security is less easily validated by another party. (proving physical cables secure is easier than proving that a shared secret was not compromised)

  • I've heard of an authentication method designed for restricting Ethernet use but I'm not sure its scope (or if your camera supports it) or whether it will help you without updating all the other devices on the LAN. Perhaps a Managed Switch would help contain the need for updating configuration.

  • Overall review the security of the other devices on your LAN. Windows computers should treat the networks as Public Networks so they do not assume trust. Each device on your LAN should be considered and secured.

  • Of course do not leave any default credentials in place. The passwords must be reset on all new devices both for the CCTV and other devices on your LAN.

  • Don't forget physical barriers :-)

Improve this answer
12
  • 11
    802.1x is the thing you're thinking of for Ethernet. It supports roughly the same kinds of things as WPA (authentication with user/pass, preshared secret, and/or certificates). It's been around for 15 years and support in OSes is good, but embedded devices are hit-and-miss. It's worth a try.
    – hobbs
    Nov 1, 2016 at 3:40
  • 3
    802.1x is also, unfortunately, specifically vulnerable on this front. Once the port is authenticated and active it is possible to surreptitiously tap the connection (with care, and its particularly hard with gigabit connections), eavesdrop briefly to determine the camera's MAC, and then start talking on the network as if it were the camera while no one is the wiser. Its a known issue that has been addressed but not remedied fully: en.wikipedia.org/wiki/…
    – Jeff Meden
    Nov 1, 2016 at 15:41
  • 4
    You left out the most obvious - have these cameras on their own subnet, so that it's impossible for someone to get on the main network in the OP's original scheme scenario.
    – SnakeDoc
    Nov 1, 2016 at 15:42
  • 1
    @SnakeDoc, "have these cameras on their own subnet" Good advice. However with a Managed Switch including ACL, the same can be accomplished even on a single subnet. The OP implied that there are other devices on the same subnet and it may be easier for him to keep it that way.
    – 700 Software
    Nov 1, 2016 at 18:05
  • 1
    Cameras using HTTPS....?
    – Alec Teal
    Nov 2, 2016 at 9:46
11

Put your cameras and video recorder on a separate network segment, and bridge them through a firewall that would allow internal devices to talk to the video recorder while preventing anything on the untrusted side of the network from talking to the other side.

This can easily be done with a Linux/BSD machine (with IPtables/PF) and I'm sure there are commercial routers like Cisco or Ubiquiti that would do the trick as well.

If your cables end up at a physically secure location before going to the cameras you could also use IPSec with a small server at both ends to encrypt the traffic that goes over the insecure cable, that way an attacker won't be able to do much unless he cracks IPSec.

Improve this answer
1
  • 2
    How I understand OP's question is that almost all of his lines are untrusted.
    – Agent_L
    Nov 1, 2016 at 17:54
8

Use encrypted VLAN or VPN. Set up a VPN gateway wherever your network switches between internal to external. Make sure that all external cables carry only encrypted data.

With encrypted link, you ensure authenticity (data must come from inside trusted network), integrity (data is not modified when traveling on untrusted cable), and confidentiality (data is not leaked through the external cables).

The final security concern is availability (service is not interrupted), encryption doesn't solve this. What you can do for availability is to have additional redundant path between the trusted networks and automatic rerouting between them. An attacker would have needed to simultaneously compromise all physical paths to take down the service.

Additionally, as you have a camera network, you might want to make sure that anyone that needs to get to access panel and exposed wiring within the unencrypted internal network has to pass through a camera's line of sight. This way, you would record evidence of tampering and gives you a chance to identify the perpetrator.

Improve this answer
2
  • A VPN connection would be ideal if the camera supports this.
    – 700 Software
    Nov 1, 2016 at 20:05
  • @George Bailey: if the camera doesn't support VPN, you can attach the camera to a hardware VPN client, one of these costs about $40. You might even go lower if you use Arduino or Raspberry Pi and DIY the router and VPN client setup.
    – Lie Ryan
    Nov 4, 2016 at 1:55
3

Security Guard

enter image description here

This device can actively monitor the integrity of the Cat6 cables using the Mark I Eyeball standard accessory.

Improve this answer
6
  • Most companies put in cameras so they don't have to pay an expensive security guard to patrol the premises. Many use the cameras with remote monitoring services to forgo the on-site security guard entirely.
    – Johnny
    Nov 2, 2016 at 6:26
  • @Johnny Your point suggests that security guards are mutually exclusive to cameras. My point is that technology is not always the only solution to a technology problem. Security is achieved through layering. However, when you are worried about network intrusion from the CCTV network, I suspect you have a rather large budget.
    – Aron
    Nov 2, 2016 at 7:07
  • @Aron a large budget or someone who knows enough to understand that an exposed ethernet cable is a vulnerability. Doesn't take much cash to have that knowledge. ;)
    – FreeMan
    Nov 2, 2016 at 12:20
  • 1
    @FreeMan No, but it does take a lot of cash for you to have management that listens to that level of tin foil hatting.
    – Aron
    Nov 2, 2016 at 12:29
  • 1
    @Aron Exactly. Multiple layers usually work better than one, very protected, layer (Kevin Mitnick et al. call this "M&M security": hard outside and soft inside). Even if one is dedicated to it, playing exploit cat-and-mouse will eventually leave this one hole the attacker can use. Instead, make them have a hard time worrying about security guards AND getting to the cable AND successfully MiTMing, etc.
    – Jaime Gallego
    Dec 28, 2016 at 1:34
1

Say someone were to swap the wires before crimping them so that anyone plugging in a normal cable would feed the PoE 48V into the +-2.5V data wires... Just make sure to document which wire is which and only do this if you know people are following documentation. Standard pinout on Wikipedia.

Improve this answer
4
  • 1
    That's security through obscurity that loses all of its value the second someone learns about it. Eg by using a barrel connector and analyzing the wires with a voltmeter before connecting own switch.
    – Agent_L
    Nov 1, 2016 at 17:50
  • Of course. It is an addition to the software methods.
    – chx
    Nov 1, 2016 at 17:51
  • He's not concerned with someone unplugging a network cable from a camera and plugging that into his switch, but with someone cutting into a cable and crimping their own RJ45 connectors. Since some cable makers are "creative" with their use of the wire pair color codes, an attacker would need to expect non-standard wiring and be able to correct it.
    – Johnny
    Nov 2, 2016 at 3:20
  • If you are trying to destroy the attacker's NIC using the PoE feed, that can be defeated by a set of capacitors, which these days are typically integrated into the NIC themselves precisely for this reason (and also induced currents).
    – Aron
    Nov 2, 2016 at 3:36
1

Steel Wire Armour Cat-6 is available. Using it, or running normal Cat-6 in a steel conduit will make it harder for an adversary to splice into the cable. As will running the cables above head-height.

However, as others have mentioned, network isolation is the best solution.

Improve this answer
1
  • Steel wire armored cable seems to be designed to prevent accidental breakage or abrasion from contact with mechanical equipment. just a thin shell of steel wire around the conductors, and I don't see how that would stand up to an attacker with a good pair of wire cutters (bike cables locks with the same diameter face the same problem, and they are steel all the way through).
    – Johnny
    Nov 2, 2016 at 23:18
1

I want to mention that, some NVR-s (like HIKVISION DS-7608NI-E2/8P/A) have 8 PoE ports + one more port for internal network.

This way, the cameras will not be accessible individually, while still inside an isolated LAN, but you will be able to configure access with authentication to the camera feeds through the NVR configuration.

Improve this answer
0

Setup ACL's and VLANs for all of your subnets. That way if someone were to do what you just described, they would have to know what VLAN is needed and which subnet to be on. All other attempts would be blocked by the ACL.

Improve this answer
5
  • 4
    -1 ACL and VLAN use will not mitigate a physical MitM attack.
    – user2320464
    Oct 31, 2016 at 16:24
  • This was not a suggestion to "prevent" a MitM attack. It is an option to better securing the path. @user2320464 Your comment above suggesting "tougher conduit" or an "alert" is better??? By the time one would even have a chance to notice an alert, the intrusion has already happened.
    – TheValyreanGroup
    Oct 31, 2016 at 16:44
  • 1
    @TheValyreanGroup, Your answer did seem slightly off topic, because the OP implied that everything is on the same subnet. Your answer implies the opposite (using separate subnets) without acknowledging the fact that the OP would have to change is configuration. Furthermore your answer in some ways duplicates what I already suggested could be accomplished with a Managed Switch. You did not describe how your answer is different or better. Keep in mind I did not vote you up or down. I just see a lot of room for improvement, and I don't see how this fully answers the OP.
    – 700 Software
    Oct 31, 2016 at 17:29
  • 2
    "Your comment above suggesting "tougher conduit" or an "alert" is better???" Comments are not intended to be better than answers.
    – 700 Software
    Oct 31, 2016 at 17:30
  • 4
    Sometimes tougher conduit is the right answer. :-)
    – 700 Software
    Oct 31, 2016 at 17:33
-1

If you're concerned about physical security, maybe not use POE Ethernet across a long Cat 6 cable, but use a secured camera installation with a 110 V power directly to it and Wi-Fi connection to your main router/access point that has good encryption. It is maybe not the easiest or cheapest solution, but you need to decide whether cost or physical security of your connection is more important. I don't know if there are POE routers available, but may be something looking into.

Or, you could cobble together a DC 12 V feed across the Cat 6 to feed both the camera and a wireless Ethernet transmitter so even if a villain broke the line and tried to tap in, all they'd get is 12 V and no signal.

Improve this answer
6
  • 1
    I like the decoy idea. Not to mention the chance of frying the theif's non-PoE switch ;)
    – Darren H
    Oct 31, 2016 at 19:58
  • 7
    Wireless for security cameras? Worst idea ever.
    – André Borie
    Oct 31, 2016 at 20:01
  • 3
    @AndréBorie what, you mean a microwave shouldn't be able to stop my camera feeds?
    – Delioth
    Oct 31, 2016 at 21:12
  • @Delioth I think you have deeper problems if your attacker has managed to place your camera into a microwave. But yes, the microwave oven would act as a faraday cage and block the WiFi signal.
    – Aron
    Nov 2, 2016 at 3:27
  • 1
    @Aron - Microwave oven interference with Wifi is a real phenomena since the 2.450GHz frequency they use is so close to the 2.4Ghz Wifi band. While microwaves are shielded, that shielding is not perfect, and it only takes a tiny amount of leakage from a 1000W microwave over to wreak havoc with Wifi signals. 5Ghz Wifi bands don't share the same problem, but that band has its own weakness in signal penetration.
    – Johnny
    Nov 2, 2016 at 4:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.