I have a concern that my inexpensive cameras are "phoning home". Therefore I put them on an isolated (ad-hoc) network (all devices have static IP addresses). But security cameras need a time/date stamp, so I developed an NTP server from a Nano, W5100 ethernet card and a NEO-6M GPS. This works fine.
I decided to upgrade my cameras to Reolink E1 Outdoor SE PoE. These cameras do not allow an IP address for the NTP server. I'm in the process of developing additional code for the Nano that creates a DNS that provides only one IP, that of the NTP server.
I am to the point where I can receive the DNS request on port 53, but I'm not sure my response is being well received.
What I noticed is, that no matter what NTP server I select in the camera, it always sends php.reolink.com. (Maybe not related: Because I am uncertain if routing is being done, I added an unconnected-to-any-other-network Asus RT-N56U router which sends www.asus.com.) Only messages sent to port 53 are being received and these messages have the same format as a DNS request.
There are things that disturb me.
I would expect the URL sent to be something like pool.ntp.org
Looking at the DNS spec it appears that responses to a DNS request sent to a questionable URL could potentially have "unrelated data" embedded in the response message. Am I being paranoid?
On another note, I asked google's AI go write the NTP code. It didn't work, so I went back to my code. I don't think the DNS code is working either; I'm still working on that.
I'm looking for suggestions on how to get the time/date to a Reolink camera on an isolated network. (And anything to assuage my paranoia)
Is there a place for NTP on this camera? Do you have a pic to share? Mine had one with some prepopulated drop downs, and it is a little finicky (just did it this weekend). I had to type in my IP address then click save. If I clicked anywhere else it wanted to change what I had put in the field I put my IP in. Once I hit save it was all good.
I will say on my camera (I only have 1 Reolink for my front door), and it is Wi-Fi. It is on a totally isolated SSID tagged with a separate VLAN tag for only my cameras which have no access to the internet at all. All my other POE cameras will not even find if there is a firmware update so I know the VLAN is blocking and I have trace confirmed it when they try to get updates.
Are you sure the php.reolink.com is not calling a package in the firmware? Have you traced it?
Gotcha. I will see if I can get some time to trace it.
All I meant by the php url was; are they calling a package inside the firmware as PHP is a software code format so it was a weird name to me name it that is all.
I did try to go to that URL on a browser and nothing came up so I am suspicious that the cam is even going there.
I am in the process of doing something similar. The architecture that I am implementing is two VLANS for my IOT devices. The first VLAN is internal only (no internet access) and outside of the IOT network, only has access to my home assistant IP on the network. The second VLAN has access to the internet and the home assistant IP. My ReoLink would go on the first -- no reason to have internet access, while my Peloton would be on the second.
Would the VLAN approach work for you (or is the a reason I should not pursue this)?
In my searches I found the Meinberg NTP server software. It runs on my W10 computer on which my camera program, BlueIris is running. It acts as an NTP server for my isolated network and gets its time from the usual sources (eg. pool.ntp.org).
It and BlueIris would have similar security issues. My concern is that these cameras, which have incredible computing power, if they could download code, even if they got it one byte at a time, could wreak serious havoc and/or become part of a bot-net.
So for me, it's the cameras breaking out, not someone breaking.
I ditched my Nano/Ethernet/GPS in favor of this software. I'll come back and report any problems; installation was a breeze.
WireShark is your friend. DNS and NTP have different roles.
Any self respecting malware is going to hide within normal network traffic to bypass firewalls. You are looking for discrepancies, like Clifford Stoll, in The Cuckoos Nest did, if you suspect any shenanigans. Get to know what is normal, and any suspect activity should be apparent. Although digital terrorists and state actors are harnessing modern AI technology to help them, the fundamental concepts still apply - they need to get their traffic out, and it takes added bandwidth to slurp up lots of useful stolen and intercepted data. Not all digital terrorists are smart, some are just wannabe skript kiddies who should turn to other well paying profitable enterprises such as religion, banking, or politics. Well configured routing and firewalls should discourage most of them.
Firmware updates should not be automated. Read the release notes first before applying.
99% of breaches are done with abusing the weakest link.. the person(s) whom manages the setup. This is what pen testing is for and having isolated systems in place so you don't risk your main systems and devices should you or someone you know connect an unknown device like a random USB they picked up and non production setups to validate update stability before pushing to a live environment.
Anything else is to stop using default logins for devices that are internet facing and especially those with hard coded backdoors that shitty companies don't see issues with having.
In regards to NTP (network time protocol) you can if you have a NAS for it have it setup as your camera's NTP server, I have this done with my hikvision and hilook cameras since I block their internet access and its where I store my footage for them anyways.
