Is it bad to have cameras using a static IP address?

Question

I am about to move in a new house, and I would like to install some security cameras.

The contractor told me that in order for me to check the videos recorded by the cameras in real time when I am away I'll need to have a static IP address.

Are there problems with it? Is it less secure?

I am not a billionaire or famous so it is unlikely there will be targeted attacks. On the other hand it would be my home network and it'll happen that I'll input my bank credentials sooner or later, so I want it to be safe.

Answer 1

I would consider another contractor, since that statement doesn't precisely increase my trust in his knowledge/skill.

The correct way of setting up a security camera system so you are able to check them when you are away is to have port forwarding on your router exclusively for VPN or HTTP/TLS mapped to the machine recording data from the cameras. This will work with a static IP or with DynDNS. If you use e.g. a Diskstation to do the recording (like I do at home) then you get DynDNS as well as the surveillance software (with a limited number of licenses, 4 in my case) for free already.

Never, never ever, expose an IP camera to the internet. This is an open invitation not only for people like the Russians who set up insecam half a year ago to mock you so on their website as well as all kinds of perverts and of course burglars.
You also risk being exploited and having malware (maybe botnet control software?) installed inside your home network. From there they'll attack the other computers which will see the traffic coming from a "trusted" source. Almost all IP cameras have cheap, default-to-insecure firmware, some do not even support basic encryption. Firmware is updated rarely, if ever, and not necessarily to account for security issues. The cameras in my home are susceptible to Heartbleed (although this is publicly known for almost one year). There's nothing to do about it, other than not letting anyone access them. The documentation doesn't even mention it, but they're demonstrably exploitable.

You might allow the cameras to make an outgoing connection to upload files to an external server when alarm triggers, which makes stealing or destroying your server at home futile. But never allow incoming connections whatsoever.

Personally, I wouldn't even allow a camera to make outgoing connections, seeing how virtually all IP cameras and their firmware are produced in China (and those that aren't are made in the USA, which is just as bad).
Government-supported espionage and in particular industrial espionage is a big business, and how could you do it better than by requiring a covert channel built into every camera that your prospective targets will readily place where there's something important? Of course you said that you are not an important person (...but who is really unimportant enough so nobody would care watching? Why is the NSA reading your mails then?). Not being the prime target doesn't mean that the backdoor is not built into your camera anyway, which could be used and abused by pretty much anyone.
Anyone, that includes burglars who can conveniently check whether someone is home. Don't make their lives easier than it needs to be.

Update:
Meanwhile, my statement about risking botnet software being installed on your IP cameras is no longer a mere possibility. The above statement which maybe sounded a tidbit paranoid turned out being outright prophetic (October 2016 attack on Dyn).
Therefore: No direct internet access for presumably insecure devices, never, not ever.

Answer 2

Static or dynamic IP is a non-issue.

But since you brought up cameras, you should know that many IP cameras have VERY poor security. Many of these cameras have a known bad firmware in them that allows unauthenticated download of the entire memory of the device via simply going to /proc/kcore, without the need to authenticate. This allows anyone to obtain the password for your camera.

http://www.tripwire.com/state-of-security/vulnerability-management/vulnerability-who-is-watching-your-ip-camera/

Answer 3

The only difference between the static IP address your technician is referring to and a dynamic, changing address in this situation is that one never changes, and the other does (how frequently depends on many factors).

There is nothing inherently more or less secure about either one. Both are a means to identify you and your home network on the Internet.

Answer 4

Not really...

Dynamic and static address have different advantages/inconvenients.

Static

• Vulnerable to data mining as you always use the same address.
• Great to host a server (like viewing the content of your security camera remotely)
• Bad to troll on forums as you can easily be blocked

Dynamic

• Less vulnerable to data mining as you often change your IP address
• Not as great to host a server (can make it more difficult to connect or you can share the IP with another server that is sending a lot of spam which might get you a bad name)
• Good to troll on forums as it's harder to block you

The only thing relevant to security is data mining. Is it a big deal for you?

Usually, your ISP will decide if you will have a static or dynamic address. Based on what you want, hope for the best.

Answer 5

For a typical residential user, static vs. dynamic IP doesn't matter much from a security point of view. Just like how the address of your residence is pretty static. You don't change that address all the time (unless you move of course). It only matters if someone wants to specifically target you, and they know your address. A typical user should not have to worry about that happening with their IP. Other than that, threats will be random. It doesn't matter whether your IP is static or dynamic, just that you have one at all.

See An attacker has my IP address;So what?

If you are running a camera, dynamic IP may have some advantage. If someone finds the IP, they can at least try to access the camera, and could share the IP with other people. A dynamic IP will change, meaning they would have to find it again.

Also, there are ways to access your home network even if it has a dynamic IP. Of course this means other people could use the method to access it as well.

Answer 6

Your security issues will be the following, depending on your own risk assessment.

1. A network camera, especially an external one would give me hard wired access to you network if i remove it from the wall and plug my laptop in or even my Raspberry Pi WiFi router

2. At the router you will either need to forward ports to each camera and/or DVR.

   Any ports that are open are possible access points into a network.

3. Hardware, possible exploits flaws etc in the camera.

Answer 7

It is not essential that you use static IP addresses. You could use a combination of dynamic IP addresses, port forwarding in your router, and a service such as dyndns.org (which gives you a static address that redirects to your dynamic address, which you have to update anytime your dynamic address changes. That update can occur manually, or many routers have built-in functionality to automatically contact dyndns and update your address anytime it changes). dyndns.org isn't the only site that provides this service, it's just the one I'm familiar with.

Even if you are using a static address for the cameras, you might need a tool like dyndns if your internet connection itself is dynamic, otherwise you won't know the IP address to connect to when you aren't at home.

All that said, from a security standpoint, there is no difference between static and dynamic addresses. As other people have pointed out, regardless of your IP address, you should take others steps to secure the cameras, such as keeping the firmware up

Answer 8

Even though you personally may not be a target, hackers might still want to break in either for fun or to pool your IP-connected device and make it part of a larger botnet attack. Many hackers are reaching security cameras and pooling them together as part of the Mirai botnet.

Users can scan if their IP (including the cameras) and network is infected with the Mirai botnet: https://www.incapsula.com/mirai-scanner.html

It’s also a good idea to change your password, put your network behind a WAF (Web Application Firewall) and make sure your DNS also has protection (see the recent DDoS attack against Dyn, for example).

Answer 9

The main reason you want a static IP is so that you have a way to reach your cameras when you are away. Picture this, if you had to call someone but didn't have their phone number or it had been changed with no forwarding number to call, how would you reach them? The static IP gives you that same number all time. That said there are other ways to connect from the outside by using some sort of DDNS system.

Since you are going to be using an IP security camera I would recommend a Synology NAS, they have a DDNS system that works quite well and comes with the cost of the NAS purchase and there is no monthly check-in that you need to do with some of the free DDNS services. Additionally you can point the camera to record on the NAS, so you get lots of storage and easy expansion and they even have their own app you can use to access the recordings.

That said you will want to put the NAS behind a router and you can port forward to the NAS. A Netgear WNDR 3700 is rather cost effective and will do the job, the nice thing about that router is that the ports all show up as stealth, even when they are open to port forwarding. So if someone scans your router from the internet they won't even know is it there. If you don't know how to do port forwarding, the Synology NAS can be connected with your custom quick connect code that you set up for yourself.

In the past these NAS devices have been pretty good, they have a compatibility list you should check out, then purchase a camera from that list to work with the NAS, the only thing I will warn you about, the recent DS1815 is somewhat loud when the hard drives are active and it might be that is true with the other models of 2015, so keep that in mind when deciding to get the NAS and where you want to place it. I use WD Red HDDs and they work great, since you will be recording video, it might be a good idea to go with the WD RED Pro hard drives, they are faster and reportedly quieter.

Once you are all set up don't roll out updates automatically, monitor when an update comes out, it will tell you in the web management interface, I think you can set up the NAS to email you as well for that, then check the Synology forum to see what other users have for experiences with the update and you can even ask questions of others to see if they have a certain webcam and NAS and if they were good with the update. Not every update Synology rolls out is perfect, but as long as you are careful you should be pretty smooth sailing with the NAS.

I will paste a link to the site and you can decide for yourself. https://www.synology.com/en-us/products/DS1815+