-2

I installed recently a security camera ( https://www.amazon.com/dp/B08J158TVV?psc=1&ref=ppx_yo2_dt_b_product_details ) I noted the pan was not working properly and I asked for help ( support@boavision.com ). They answered promptly and asked for camera UID ( AAxx-xxxxx-xxxxx ). Using only this information, no IP or other, they were able to connect my camera and change the settings. As proof of fixing my problem they sent me two pics taken inside my house with my camera.

Question:

  1. How is this possible? I didn't open any port or service.
  2. How can I prevent such action in the future?

I am connected to Internet with a Netgear cable-modem Model: C7000|Nighthawk - AC1900 .

papy muzo
  • 9
  • 1
  • 1
  • I hope you left a review indicating this experience. – ceejayoz Jun 13 '21 at 02:02
  • No kidding, @ceejayoz ? I bet if you disable upnp in the country they are made, you're in trouble. – Gerard H. Pille Jun 13 '21 at 10:29
  • @GerardH.Pille If the camera always phones home, no need for UPnP. IRC, IPSec, openvpn or WireGuard (or HTTP or anything else) don't need UPnP: the home router always allows traffic initiated from inside to outside and will then allow replies. It might not scale as good. But there have been case of p2p networks used by IoT devices in the past. https://www.schneier.com/blog/archives/2016/02/eavesdropping_b_1.html -> https://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-internet-of-things/ – A.B Jun 13 '21 at 13:07
  • Thanks for your help Gerard. I closed the "hole". – papy muzo Jun 15 '21 at 17:38

1 Answers1

2

Welcome to the world of UPNP. Your camera told your router to open your house to world + dog. Wikipedia

Gerard H. Pille
  • 2,569
  • 1
  • 13
  • 11