Is my older Dahua security camera system salvageable?

[JerryCSR]

I am just a consumer who paid to have a 4-camera security system I could monitor from my Android phone installed. I am not very knowledgeable when it comes to these systems so I apologize in advance for my ignorance. I am reading a lot on this board and trying to get up to speed.

I had my system installed by a local camera security company. A couple of years later one day, around September of last year, I couldn't see my cameras on GDMss Lite/cellphone and go home and check my NVR and all four cameras say "hacked."

I called my system installer and he reset the system, but within a few hours all the cameras said "hacked" again. He didn't even know about the big Dahua hack, but to be fair this is when it first started becoming known to users back in September.

My installer called Dahua as they would not talk to me, only the installer. I listened in on the conversation and at no time was a firmware update given or suggested. Just resetting the system and changing the password. Thus, the re-hacking in a matter of hours.

I don't know if my system is salvageable and I would like your suggestions in this regard.
I was told my cameras are Dahua but there is no marking on them.
On the NVR I saw these ID numbers for the cameras:

[numbers deleted because of posters' recommendations]

My NVR has a model number of NVR3216V.

Can my NVR or cameras still be used or would you suggest I start over with a new NVR and new cameras?

I hope I supplied enough information to answer the question, but I am very new to this technology.

I really tried to get help from Dahua but once they heard the model numbers they refused to talk to me.

I couldn't find any firmware update for the cameras or NVR. I talked to my installer about a firmware update since I knew the cameras and NVR were both hacked but he could find no firmware update and simply changed the passwords.

Thank you so much for any advice you can give me. If I need to dump what I have and upgrade then that's what I need to do. As the victim of having my door kicked and having my house robbed this is important to me.

Thanking you in advance.

 

[Terk]

Those look like serial numbers not model numbers, you have the model number of the NVR but not the cameras, look for something starting with IPC or SD or something like that for the model numbers and update your post to replace those PZC and WID numbers if they turn out to be serial numbers.

 

[mat200]

I am just a consumer who paid to have a 4-camera security system I could monitor from my Android phone installed...
I had my system installed by a local camera security company. A couple of years later one day, around September of last year, I couldn't see my cameras on GDMss Lite/cellphone and go home and check my NVR and all four cameras say "hacked."
..Thank you so much for any advice you can give me. If I need to dump what I have and upgrade then that's what I need to do. As the victim of having my door kicked and having my house robbed this is important to me.

Thanking you in advance.

Hi Jerry

You're going to have to better secure your home network - as there will be a high chance that you will be hacked once again if you do not close those "internet doors"

Please look at setting up a VPN instead of port forwarding, also do a virus check on all connected computers, perhaps also virus check your mobile devices - especially if they are not getting updates.

Once you have done that, I believe you should be able to recover the NVR and cameras - but that will take some knowledge and time to redo the firmware.

 

[tangent]

Turn off UPNP and stop forwarding ports to the cameras/NVR.

Delete the serial numbers from your post and post the model numbers.

 

[bp2008]

Turn off UPNP and stop forwarding ports to the cameras.

To build upon that...

Don't forward ports to the NVR either.

UPnP is a feature found in your router, the cameras, and probably the NVR too... if you can turn it off in the router then great but I'd turn it off everywhere just to be safe (in case you get a new router and forget to turn off UPnP in it for example).

And ... um ... VPN Primer for Noobs

 

[Terk]

If you happen to have an Asus router it is fairly easy to get the VPN setup seeVPN help please

 

[JerryCSR]

THANK YOU for all the replies. So very helpful.

Delete the serial numbers from your post and post the model numbers.

I'm not sure there is a way to get the model number. There is nothing on the actual camera that I can see. Should I take it apart? Would the NVR somewhere show it on the computer monitor? Sorry for my ignorance.

Please look at setting up a VPN instead of port forwarding, also do a virus check on all connected computers, perhaps also virus check your mobile devices - especially if they are not getting updates.

I will do that.

Don't forward ports to the NVR either.

UPnP is a feature found in your router, the cameras, and probably the NVR too... if you can turn it off in the router then great but I'd turn it off everywhere just to be safe (in case you get a new router and forget to turn off UPnP in it for example).

I will do this. Thank you for noob primer.

If you happen to have an Asus router it is fairly easy to get the VPN setup seeVPN help please

Thanks for the info. I will read the link and look into the Asus router.

 

[tangent]

It looks like Dahua did release a firmware update for your NVR: General_NVR3xxx_Eng_P_V2.616.0000.0.R.20170925
Firmwares
Updating device firmware is always a bit riskier than a software update on a pc, more so if there's any chance your equipment was intended for use in china and was hacked to english.

No you don't need to take the camera apart, but you should delete the serial numbers you posted. There should be a sticker on the camera somewhere that identifies the model. It the sticker is in Chinese it's a bad sign.

You might want to consider slowly upgrading some of your cameras just for image quality reasons as some newer cameras do a lot better.

 

[bp2008]

FYI, I just wrote a small wiki page on securing a network, which I feel covers the basics.

How to Secure Your Network (Don't Get Hacked!) | IP Cam Talk

 

[JerryCSR]

No you don't need to take the camera apart, but you should delete the serial numbers you posted.

Done.

There should be a sticker on the camera somewhere that identifies the model. It the sticker is in Chinese it's a bad sign.

I found it. There was a sticker on the cable going inside the camera but nothing on the camera itself which confused me.

The sticker says:
IP Camera
Model IPC-HDW4300S-0360B

FYI, I just wrote a small wiki page on securing a network, which I feel covers the basics.

Thank you for this. I really appreciate you sharing this with me. I've got a lot of reading to do to get up to speed.

 

[JerryCSR]

You're going to have to better secure your home network - as there will be a high chance that you will be hacked once again if you do not close those "internet doors"

I've turned the system off until I understand what I'm doing. I did run a virus check on all my electronics connected via my network. Thank you.

 

[fenderman]

I've turned the system off until I understand what I'm doing. I did run a virus check on all my electronics connected via my network. Thank you.

You don't have to turn it off simply unplug the connection to the to the internet.... The system will still record.... Then after you disable the port forwarding and UPnP rules you can work on setting up the VPN for remote access...

 

[Terk]

Security Advisory – High risk vulnerability found in Dahua IPC-HDW4300S and some IP products

 

[Terk]

The links for the firmware download don't work though so you will likely need to send an email to the address at the bottom

 

[fenderman]

There is no need to update firmware...all he needs to do is setup a vpn...updating firmware will do nothing to stop future attacks...

 

[JerryCSR]

Advisory – High risk vulnerability found in Dahua IPC-HDW4300S and some IP products

This confirms that not only my NVR but the actual cameras themselves were hacked. Thank you. My installer was oblivious to this which is why I'm down to doing this myself. Thank you.

The links for the firmware download don't work though so you will likely need to send an email to the address at the bottom

I've got an email sent to Dahua at the email link provided. Thanks again!

There is no need to update firmware...all he needs to do is setup a vpn...updating firmware will do nothing to stop future attacks...

Are you saying I don't need to unhack my cameras and NVR before setting up the VPN? Sorry for being so ignorant.

 

[Kameraad]

1st make sure your nvr and camera's are not accessible from the internet, close all ports in your router.
2nd get the system up and running again. After you've done this your recordings are running, you just can't watch live and/or playback from outside your home.
3rd get the VPN running, this will make sure only you can login safe on your home network.

 

[tangent]

Are you saying I don't need to unhack my cameras and NVR before setting up the VPN?

Most likely the cameras were never hacked, just the NVR. The main thing is to unplug the cable from the nvr to your router and then disable UPNP on the router, upgrade the router's firmware if there's an update, and delete any port forwarding rules.

There are different flavors of the malware that targets cameras and nvrs. Some are removed by simply rebooting the device, others persist, some even brick your device rendering it useless. Since your nvr was displaying "hacked" most likely you were targeted by a more altruistic strain of the malware that wanted to alert people to the issue.

 

[JerryCSR]

Thanks again for all the help and great advice.

I currently have AT&T Uverse as my internet provider.

If you happen to have an Asus router it is fairly easy to get the VPN setup

So I run my Uverse router through an Asus router to create the VPN?

Sorry I'm so ignorant, but could you direct me to a posting or guide that would help me set up the Asus router with VPN to my Uverse router? Thank you so much.

 

[Kameraad]

Try the vpn primer, i can also recommend pivpn. It's pretty easy to setup.