2

I am looking to add an IP camera to a home network. The camera connects to the home network via an ethernet cable, but it also has wifi capabilities.

The manufacturer is a small one, so no good reputation.

How can I protect the network against the possibility that this camera could spy on the other activity of the network (trojan)?

In particular, this other activity to be secured will be computers using this home network to connect to https websites.

Should I (can I?) create a separate sub network for this camera?

Improve this question
1
  • If your router acts as a switch, the device would only be able to see broadcast data and data sent directly to it by acting passively. Doesn't help if it's actively trying to compromise other systems though.
    – Matthew
    Aug 23, 2017 at 12:55

3 Answers 3

Reset to default
2

Depends on your hardware. But most actual routers allow the use of virtual networks (vlan). That should be sufficient for a home network.

Improve this answer
1
  • Thanks Mat for your answer. I am not very familiar with VLAN. If I put the IP camera on its own VLAN alone, does it prevent it from spying on the other devices?
    – DevShark
    Aug 23, 2017 at 12:52
2

I'm assuming your Wifi is properly encrypted and you don't plan to let the camera connect to it (ie. LAN only).

Can I create a separate sub network for this camera?

If your router supports it, sure. It's just the question if it makes sense from a rechability POV. Where are the people watching things with your camera?

  • In the open internet? Go ahead and separate your computers from the camera, with only internet access is available to both.
  • At your computers? Well, then you can't separate it, of course.

Should I create a separate sub network for this camera?

From security POV, yes. While proper HTTPS connections are not in danger, there are reasons like

  • You have HTTP without S too
  • Government-level attackers (total surveillance...) can get valid fake certificates
  • Sometimes, HTTPS is not used properly and is not secure (enough)
  • Your camera can do more than sniffing connections. Eg. actively attacking your computers with yet unknown 0day exploits.
  • Why not?

Finally, outside of bits and bytes, remember it's a camera. It has a lens. And the real world is as interesting as the digital one.

Improve this answer
2

The answer will depends a lot of your skills, requirements and available ressources. It is likely that the cheapest solution is to go buy a new camera from a reputable vendor.

In case you absolutely need to use that camera and are not limited by your resources you should create a dedicated, unconnected network where you will only have this camera and dedicated machines for receiving the feed (i.e. create a CCTV). Make sure your disable the camera WIFI signal as well (disable the module or place the camera in a faraday cage) That will limit greatly the potential risks caused by the device.

Of course, if that is too restrictive or expensive for your need, you should explain your requirements in detail (hint: when asking about security, a detailed explanation of what you need protected, against what and what are your ressources is always necessary for obtaining a useful answer)

Improve this answer
1
  • Thanks Stephane for your answer. I tried to explained what I need protected: https communication from other computers on the home network. It needs to be protected against a monitoring ip camera made in China, just in case it has a bad behavior. The resources are not amazing, a bit of time from a technically inclined person, but not expert in networking.
    – DevShark
    Aug 23, 2017 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .