IP cameras or webcams and wifi/network security

Question

If I have a:

• router with stateful packet inspection turned on, plus WPA2 security on the wifi network
• an IP camera or webcam connected to this Wifi network

Is there any way to ensure that:

• camera itself can't try calling some external service and bypass the SPI firewall
• only way to view the video feed is to ssh into a linux server connected to the same wifi?

Answer 1

Preventing the camera from talking to the outside world is trivial, or nigh impossible, depending on how evil the camera is. On one hand, any decent router should be able to block or not-block traffic from any local IP to the outside world; therefore, you may configure your router to:

• assign a specific IP address to the camera (based on its MAC address);
• block all non-local traffic to and from this IP address.

If the camera is "mostly honest" this will work. However, if the camera is intent on evading your measures, then the situation becomes more complex:

• The camera may assume another IP address on its own accord, bypassing the IP filter.
• The camera may change its MAC address, so as to avoid any MAC-based filtering on the router.
• The camera may try to send data covertly through DNS requests. Indeed, while the router blocks the traffic to the outside world, the camera may still talk to the router, in particular to the DNS server that the router maintains. That DNS server may then relay DNS requests to external entities. Quite a lot of data can be smuggled that way; see this presentation for an introduction on the subject.
• And, of course, since the camera is equipped with some WiFi-able circuitry, it may try to talk to other WiFi access points in the vicinity.

So one may say that you will be able to contain the camera traffic to the local network only as long as the camera will try to talk to external servers only for stupid but not deliberately dishonest reasons (e.g. check for firmware update).

---

As for preventing access to the camera from the outside: again, you have to assume that the camera is not willingly opening a covert channel. When DNS queries carry data, it goes both ways... Let's assume that the camera behaves properly. In that case, you must ensure the following:

• The WiFi layer is robust. To make things short, this means WPA2 with a sufficiently random password (see the Wikipedia page on WiFi security as a starter point on the subject). To make sure that the camera is indeed WPA2-able, configure your router to allow only WPA2 and reject WPA and WEP; if the camera still communicates, then it does WPA2 and that's fine. Otherwise, ditch it.

  In any case, leave your router in WPA2-only mode.

• The rest of the local network is robust. The router will act as first protection layer in this case; external packets will reach it, not other machines. You will configure the router to forward connections to port 22 to a specific local IP address, assigned to your Linux server, and that server runs a SSH daemon on that port. Make sure that security updates are applied regularly on that server; you don't want a remotely exploitable hole in the SSH daemon or the kernel to allow an intruder to hijack it.

  A corollary is that some malware on any client machine connected to the local network can open doors and give access to outsiders. You should think twice before allowing friends to "connect to your WiFi" with their own devices, whose cleanliness you cannot ensure.

  Another corollary is that everything relies on the absence of remotely exploitable vulnerabilities in the router itself. This might be a bit optimistic...

---

If you really want to be sure, do the following:

1. Don't use a WiFi-able or even network-able camera. Use an USB-based camera, connected to a PC running Linux (e.g. your server). That machine will receive the feed. Now the problem becomes one of controlling what that Linux system does, and that's at least doable without too many assumption on the behaviour of closed-source firmware and drivers.

2. Put a dedicated router/firewall between your WiFi router and the router provided by your ISP. That dedicated router should be, again, a small PC running some Unix-like system. The idea is not that Linux would intrinsically be better than the OS inside a normal, cheap router; indeed, some of them actually run a Linux kernel too. The point is that, with a PC, you can apply updates on a daily basis, whereas firmware updates for routers are rare, when they exist at all.

The whole underlying idea is that you can get decent security, as long as you spend system administration time on it, and security updates can be applied at all.

Answer 2

You don't need packet inspection turned on you just have to limit the network access to the camera. Limit it so that only the IP of the machine you want to be able to view it from is its only allowed outbound connection. From there you setup ssh access to that machine and you're set.

The network settings and ssh server setup will depend on your hardware and software choices. HTH