3

We have a building with n cameras connected to a Digital Video Recorder that has been attacked, this DVR provides a web server in port 90 that can be accessed from the internet. All the system were recovered by using backups, DVR Firmware could not be updated since manufacturer deprecated it in 2014. How is it possible to add an extra layer of protection to this stack without loosing the connectivity to the web server from the internet?.

4

Assuming that the connections are HTTP based, set up a web server (e.g. nginx / Apache) as a reverse proxy in front of the DVR, and require inbound connections to that web server to be authenticated over HTTPS with a client certificate. This way the DVR is never directly routed to the internet.

If you require access to other protocols, e.g. RTSP for video, I'd suggest creating an isolated network that contains the DVR and cameras, then setting up a VPN endpoint so that you can remotely access the DVR environment.

  • Regarding the second idea, setting up a VPN won't allow me to use the HTTP application from internet, right? thanks for your answer. – Alejandro Morán Dec 14 '17 at 16:16
  • @AlejandroMorán You'd VPN into the network and then access the HTTP application through a browser like you normally would. – Polynomial Dec 14 '17 at 17:29
  • 3
    And seriously consider updating off a platform that is now 4 years out of support. This answer is a good idea, which I've upvoted, but you're really putting a bandage on a larger problem and just enabling it to limp along longer. – baldPrussian Dec 14 '17 at 18:16
  • VPN could also be replaced with SSH port forwarding. A bit more of a lightweight setup if you already have Linux machines. – multithr3at3d Dec 14 '17 at 19:17
  • @korockinout13 SSH forwarding is more ad-hoc, though, and makes things more awkward if you're trying to connect from a mobile platform. – Polynomial Dec 14 '17 at 19:55
3

You can always set up a VPN server on your local network so that any user who wants to watch the video , has to be connected and authenticated. This way you will be able to access the camera as if you were on the LAN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.