4

If I have a:

  • router with stateful packet inspection turned on, plus WPA2 security on the wifi network
  • an IP camera or webcam connected to this Wifi network

Is there any way to ensure that:

  • camera itself can't try calling some external service and bypass the SPI firewall
  • only way to view the video feed is to ssh into a linux server connected to the same wifi?
  • Any decent router/firewall should be able to stop outbound requests from a given ip/host; just deny the camera permission. I'm assuming that the camera doesn't store footage on itself (or not much) - stick it into a restricted server on the Linux box and you're set. However, unless the camera is able to "speak" WPA2 (or better), it's essentially broadcasting in the clear, and attackers won't even have to connect to your network to view it... or possibly swap out footage (new take on replaying footage, I guess - just repeat packets!). – Clockwork-Muse Jan 5 '14 at 4:08
  • That's a good point...there are a lot of different camera options out there. To be clear; I haven't bought the camera yet, trying to figure out the most optimal combination. – Uzumaki Naruto Jan 5 '14 at 15:08
  • I would also consider disabling UPnP on the router as the camera could request to have inbound traffic forwarded to it from the router. Disabling UPnP on security grounds is generally a good idea anyway. – Matthew1471 Apr 20 '16 at 19:08
6

Preventing the camera from talking to the outside world is trivial, or nigh impossible, depending on how evil the camera is. On one hand, any decent router should be able to block or not-block traffic from any local IP to the outside world; therefore, you may configure your router to:

  • assign a specific IP address to the camera (based on its MAC address);
  • block all non-local traffic to and from this IP address.

If the camera is "mostly honest" this will work. However, if the camera is intent on evading your measures, then the situation becomes more complex:

  • The camera may assume another IP address on its own accord, bypassing the IP filter.
  • The camera may change its MAC address, so as to avoid any MAC-based filtering on the router.
  • The camera may try to send data covertly through DNS requests. Indeed, while the router blocks the traffic to the outside world, the camera may still talk to the router, in particular to the DNS server that the router maintains. That DNS server may then relay DNS requests to external entities. Quite a lot of data can be smuggled that way; see this presentation for an introduction on the subject.
  • And, of course, since the camera is equipped with some WiFi-able circuitry, it may try to talk to other WiFi access points in the vicinity.

So one may say that you will be able to contain the camera traffic to the local network only as long as the camera will try to talk to external servers only for stupid but not deliberately dishonest reasons (e.g. check for firmware update).


As for preventing access to the camera from the outside: again, you have to assume that the camera is not willingly opening a covert channel. When DNS queries carry data, it goes both ways... Let's assume that the camera behaves properly. In that case, you must ensure the following:

  • The WiFi layer is robust. To make things short, this means WPA2 with a sufficiently random password (see the Wikipedia page on WiFi security as a starter point on the subject). To make sure that the camera is indeed WPA2-able, configure your router to allow only WPA2 and reject WPA and WEP; if the camera still communicates, then it does WPA2 and that's fine. Otherwise, ditch it.

    In any case, leave your router in WPA2-only mode.

  • The rest of the local network is robust. The router will act as first protection layer in this case; external packets will reach it, not other machines. You will configure the router to forward connections to port 22 to a specific local IP address, assigned to your Linux server, and that server runs a SSH daemon on that port. Make sure that security updates are applied regularly on that server; you don't want a remotely exploitable hole in the SSH daemon or the kernel to allow an intruder to hijack it.

    A corollary is that some malware on any client machine connected to the local network can open doors and give access to outsiders. You should think twice before allowing friends to "connect to your WiFi" with their own devices, whose cleanliness you cannot ensure.

    Another corollary is that everything relies on the absence of remotely exploitable vulnerabilities in the router itself. This might be a bit optimistic...


If you really want to be sure, do the following:

  1. Don't use a WiFi-able or even network-able camera. Use an USB-based camera, connected to a PC running Linux (e.g. your server). That machine will receive the feed. Now the problem becomes one of controlling what that Linux system does, and that's at least doable without too many assumption on the behaviour of closed-source firmware and drivers.

  2. Put a dedicated router/firewall between your WiFi router and the router provided by your ISP. That dedicated router should be, again, a small PC running some Unix-like system. The idea is not that Linux would intrinsically be better than the OS inside a normal, cheap router; indeed, some of them actually run a Linux kernel too. The point is that, with a PC, you can apply updates on a daily basis, whereas firmware updates for routers are rare, when they exist at all.

The whole underlying idea is that you can get decent security, as long as you spend system administration time on it, and security updates can be applied at all.

  • Wow, this is an awesome/comprehensive answer. Going to need some time to digest this all and figure out what to do... – Uzumaki Naruto Jan 5 '14 at 15:07
  • Hm, I'm starting to lean towards your last suggestion. Perhaps a raspberry pi + usb cam (for cost effectiveness) – Uzumaki Naruto Jan 5 '14 at 15:13
1

You don't need packet inspection turned on you just have to limit the network access to the camera. Limit it so that only the IP of the machine you want to be able to view it from is its only allowed outbound connection. From there you setup ssh access to that machine and you're set.

The network settings and ssh server setup will depend on your hardware and software choices. HTH

  • The camera will need to be able to "speak" WPA2 security, or the packets can just be pulled off the air (ie, it's essentially broadcasting them in the clear), regardless of whatever the rest of the network is doing. – Clockwork-Muse Jan 5 '14 at 4:04
  • Agreed, make sure you have some encryption on your network. – Ajaxasaur Jan 6 '14 at 4:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.