p2pwn Question
- Thread starter botics
- Start date
bigredfish
Known around here
Dahua NVR?
You’ve been hacked
Are you running P2P on an NVR with firmware older than Aug 2024?
Are you running port forwarding on your router to access the NVR?
One of those two things most likely.
If you are port forwarding you’ll be hacked again
Best to use a VPN such as OpenVPN or Wireguard
P2P is fine if you update all firmware to Aug 2024 or later
You’ve been hacked
Are you running P2P on an NVR with firmware older than Aug 2024?
Are you running port forwarding on your router to access the NVR?
One of those two things most likely.
- disconnect NVR and cameras from the internet
- factory default NVR and all cameras
- re-initialize the NVR
- make sure your admin is the only user account
- download and update the NVR firmware to something later than Aug 2024
- reboot
- plug each camera back into the NVR and wait for each one to come back up
If you are port forwarding you’ll be hacked again
Best to use a VPN such as OpenVPN or Wireguard
P2P is fine if you update all firmware to Aug 2024 or later
Last edited:
And now on cameras I am seeing reserved user accounts.. what a mess. Most of my cameras have no newer firmware update I am aware of but will ask Andy and check all these settings.
bigredfish
Known around here
UNPLUG it from the INTERNET NOW
If you are using PoE cams plugged directly into the NVR it matters much less about the cameras fw,.
The important thing, and the hack, likely came through your NVR
The steps I showed are still the ones you should use
There is no other way at this point
Last edited:
+1^^^^.
Also disable uPnP in router.
Cameras may have uPnP also but not as big a deal with a POE NVR but it won't hurt to disable those as well.
Also disable uPnP in router.
Cameras may have uPnP also but not as big a deal with a POE NVR but it won't hurt to disable those as well.
bigredfish
Known around here
bigredfish
Known around here
Andy still has many of the Dahua 5442 series (54IR series using his naming system)
These are still the go to cameras
Each location/scene is different, possible another model may be better for any given scene but that requires seeing a picture of the scene at night (daytime they'll all be fine)
empiretech01.com
These are still the go to cameras
Each location/scene is different, possible another model may be better for any given scene but that requires seeing a picture of the scene at night (daytime they'll all be fine)
Network Camera | EmpireTech
EmpireTech is dedicated to providing top-tier technology and goods, including multi-sensor dual lens cameras, ePoE with 800m transmission via Ethernet cable, AI Codec to enhance encoding efficacy and conserve bandwidth, and precise, reliable, and exact deep learning algorithm.
empiretech01.com
In the same boat. Yesterday I noticed one of my cameras had p2pwn overlay on it. My fault as it looks like I left P2P enabled on it. The other 3 cameras had it disabled.
It looks like the attackers are using Dahua cloud relay so you don't need to have port forwarding. I have a firewall rule that drops outgoing traffic from cameras now so they are isolated my local LAN.
I'm planning on resetting the camera a few times, flash the latest firmware and the reset it again.
They created a number of accounts, 2 of them cannot be removed from the UI.
It looks like the attackers are using Dahua cloud relay so you don't need to have port forwarding. I have a firewall rule that drops outgoing traffic from cameras now so they are isolated my local LAN.
I'm planning on resetting the camera a few times, flash the latest firmware and the reset it again.
They created a number of accounts, 2 of them cannot be removed from the UI.
bigredfish
Known around here
bigredfish
Known around here
I’d be interested to know if a factory default clears the user accounts. I assume it does
Regarding the post above about new cameras... I've said quite a few times, my opinion is, if you're thinking of getting new cameras simply because security issues, I wouldn't bother. If the current cameras are doing what you need in terms of video etc I would Focus your effort and money on securing them and your network rather than getting new cameras.
bigredfish
Known around here
I know for a lot of people configuring vpn's etc can seem like quite a challenge, which is understandable, but it hurts a bit to think of otherwise perfectly good cameras being thrown out or not used, just because of a security problem that a newer camera probably isn't completely immune to anyway!
This was a long time coming and I am sure it will happen again down the road to same or other brands. Time to break out the red Loctite and wrench and tighten it all down.
Mark_M
Known around here
I fixed someone's NVR with this issue recently:
They had guessed based on password (in fairness, the client had a very weak one).
Logs did not show changes made via P2P (Cloud services).
- Download the logs. The largest date range you can (1 month), and do so for multiple months of logs.
- Read through the log, or dump it into an AI agent to summarize.
- Usually the attack starts by multiple incorrect password attempts over a few days. Then they guess right.
- Cameras change image and overlay settings. Sometimes they change cameras passwords via the NVR.
They had guessed based on password (in fairness, the client had a very weak one).
Logs did not show changes made via P2P (Cloud services).
Tha admin account can, ( if nothing else) change the pwd on the reserved user accounts i believe. That is if a factory reset doesn’t clear them out.?
bigredfish
Known around here
I had a reasonably pleasant experience switching to Tailscale VPN on my pc and phones