China CCTV System UDP protocol isn't working

Question

My boss is trying to invest on a CCTV solution that he orders from China, his idea is to market it here after we fine tune the process and configuration and make a few tweaks of our own. It consists of 4 wireless cams and a reception device(that I think has an Android port) that is connected to the internet, then they have an Android/iOS app that enables viewing the camera anywhere in the world, the problem is, we can't...

They are using a UDP protocol to transfer the data - and UDP doesn't have packet verification so the data could be easily corrupted, not a big issue if a few frames of real time video are corrupted, but the way I see it, if one is to intercept a packet, he could keep feeding the same frame to the device and create a video loop, UDP just makes it easier since there's no packet verification, am I right?

This is one of the security concerns I've told him about, but anyway, he wants it to work... What happens here is it must use UPnP connection to the router, and even after enabling it through router setup page (it's a belkin) I can't get access to the cameras from anywhere outside of our network...

inside our network, I can connect my phone to the WiFi and view the cameras, but not outside, not on my house, not on 3G network, not anywhere... the funny thing here is it must be working, because the fellows at customer support in China sent me a picture of our parking lot, where the cameras are pointed at... I've tried contacting them and asking for how they did do it, but they gave me nothing I haven't had already...

Researching UDP yesterday, made me wonder if there's some kind of block to that protocol, since other than a few applications, it has run quite obsolete and it is highly insecure... I don't know if locally (in my router) or at an ISP level, but I would go for ISP since if it was my router not letting the signal get to the internet, they wouldn't have viewed it in china...

Answer 1

UDP is no more, and no less, protected than TCP. It is a transport mechanism, not a security system. We sometimes say that TCP is reliable because, contrary to UDP, it includes provisions for acknowledging received packets and emitting again missed packets, but this is not a "security" reliability; it is only against non-malicious transport errors.

If TCP was used, it would not be intrinsically "safer". When we want a "safe TCP", we use SSL/TLS. SSL needs a "reliable" transport like TCP (because it checks that it received every byte in due order and with no alteration, but does not include corrective actions against transmission errors, only detection). However, there is a variant of SSL which is meant to be applied over UDP: DTLS. Thus, a CCTV system which transfers data over UDP may be secure, if it uses DTLS, in the same sense that a CCTV system which transfers data over TCP may be secure, if it uses SSL/TLS.

I don't claim that your CCTV system uses DTLS; I'd actually be surprised if it did. But I want to point out that while UDP does not provide any security, it is not adverse to security either.

---

That being said, since the CCTV system is supposed to work over any Internet access, and you would get the pictures with an app on your phone, then chances are that the pictures are actually sent to a server operated by the camera vendor. Indeed, there is a "rendez-vous" between the client (the app on your phone) and the camera, the latter being hidden behind an ISP which may apply a dynamic IP; a third party is more or less needed at some point.

In any case, you'd better trust them... If pictures of your parking lot are considered sensitive, then a reasonable first step might be, perhaps, not to send them to people you hardly know in China. Just saying. The operative word here is not "China" but "hardly know": you are delegating your physical surveillance to a third party, and that is not an innocent move.

Answer 2

When you are connecting to your cameras inside your LAN are you using your external IP address or local address?

Edit: Also, are you only able to connect using an App? Or was there software as well for PC's?

Answer 3

To be able to access a DVR outside your LAN you need public IP and an open port or a public IP and uPnP, most of the new china DVR right now is taking advantage of the uPnP (please check uPnP vulnerabilities for safety), the default settings of routers is uPnP enabled meaning any device that can use this technology can gain access or Open ports automatically.. You can use the website provided by your DVR supplier enter your DVR device ID and it should be working.. there is also a setting on the DVR that you need to turn ON the "cloud" most of the DVR uses this term

The website that the your supplier provided is accessing your DVR thru a port that it opened maybe port 9000, 123456 or other ports programed on your DVR.. If your going to access your DVR using your public IP (dynamis/static) logically it will not work because it will go directly to port 80 which your router/modem owns (the router/modem log-in page)..

uPnP + Supplier Website = Port Forwarding + DDNS