User 'Cameras' with no password: do you have one?

technet

technet

Getting the hang of it
Dec 25, 2014
135
17
Hello everyone,

I've seen that in some Blue Iris installations we can find a user 'cameras' with no password and it has unlimited remote access.

What is that exactly? We've disabled it here, of course.
 
Last edited by a moderator:
  • Like
Reactions: The_Penguin and MartyO
technet said:
Hello everyone,

I've seen that in some Blue Iris installations we can find a user 'cameras' with no password and it has unlimited remote access.

What is that exactly? Disabled here, of course.
Click to expand...
If you mean admin then see this release note

  • Admin console sessions and anonymous-admin remote sessions now have their own automatically created Options/Users account "admin". For security, it will not be possible to login with this account remotely unless you assign it a password (or had a pre-existing admin account with a password). This will aid in the future development of per-user statistics and counters.​
Any other use must have been created by someone.
 
On different systems, at different installations? I don't see how, really. No (other) security issues found on any related computers.
 
technet said:
On different systems, at different installations? I don't see how, really. No (other) security issues found on any related computers.
Click to expand...
Is anyone besides you managing these installs. I have never seen this on any system.
 
Maybe a better approach would be to have a setting on these automatically created users that clearly shows "LAN only". I didn't see that.


fenderman said:
If you mean admin then see this release note

  • Admin console sessions and anonymous-admin remote sessions now have their own automatically created Options/Users account "admin". For security, it will not be possible to login with this account remotely unless you assign it a password (or had a pre-existing admin account with a password). This will aid in the future development of per-user statistics and counters.​
Any other use must have been created by someone.
Click to expand...
 
On one setup, user 'cameras' reappeared after being deleted.

Could you guys check on your updated Blue Iris installations if there's a 'cameras' user?

y8pjZnD.png


jg2t4.gif
 
Latest, with automatic updates every night at 03:00AM.

Are you using mobiles to access them?
 
I think that I was able to reproduce it. After some Android app logins and enabling and disabling audio on cameras, and browser logins, the user appears. It allows remote viewing and listening of every group.
 
technet said:
I think that I was able to reproduce it. After some Android app logins and enabling and disabling audio on cameras, and browser logins, the user appears. It allows remote viewing and listening of every group.
Click to expand...
that is strange...let us know what support says..
 
  • Like
Reactions: technet
Sure.

It seems that in the best scenario it could be some source code leftover that was used to help development/debug.
 
long ago I made one log on account with admin privleges and that was all I would see under users. Then just recently noticed additional camera and admin users, deleted both, the admin reappears every time with no password. I had to uncheck it, cause removing doesn't work. If this type of shit happens again I'll have to give up BI which I do like. No excuses please about one person,
 
I just updated to latest 4.1.7, camera is back in my user list, enabled with no password. WTF!!!!
 
You must log in or register to reply here.
Top Bottom