Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[cardinalsfan]

Does your router have hidden WiFi? I would hid the SSID after you change it and the PW.

What ISP modem do you have? You might just wired direct to the ISP modem with one PC for now until tomorrow. Turn OFF the WiFi or just disconnected the router and turn it off.

You might go ahead and remove the camera from mydlink.com for now as well. You can add it back later...

No, the SSID is not hidden.  My modem is just a standard modem issues by my ISP.  It does not include wifi, only my router does that.  I turned the router off last night.

I let lastpass make a new password for the dlinksite, it should be very hard to crack.  All my computers have had malwarebytes run and all issues removed. 

I think (and hope) it's just someone messing around and now it'll hopefully be too tough for him to mess with so he'll give up.  I guess we'll find out.

My main worry is that it's someone planning to rob the house again and he's going to turn off the cameras and commit the robbery so there are no images of the act.  I'm pretty sure it's just some punk messing with us. 

[FurryNutz]

Internet Service Provider and Modem Configurations

• What ISP Service do you have? Cable or DSL?
• What ISP Modem Mfr. and model # do you have?

What I meant is to disconnect your main host router and connect your PC up to the ISP modem directly for a while. This will eliminate any un-authorized Wifi or LAN connections. Just one PC and the modem. This will allow you to reset and change all web site and email PWs. Then I would connect one wired PC to the main host router and factory reset the router while it's not connected to the ISP Modem. Factory reset the  router with one wired PC connected to the router and get it configured. Setup new SSID and new PW on WiFi. I would hid the SSID from being broadcast, this will help some. Then set up the camera to the router. I believe you can input the hidden SSID name and PW and it should connect to the router.

Once you have the router and camera net up, go live with the router and camera. I highly recommend that you leave the camera un-registered with mydlink.com for a time until you can ensure that nobody is doing anything with the router and camera locally. Once you do that, and you know you have re-set up the mydlink.com with a new PW, then go and re-register the camera.

You need to configure the router and camera off line before going on-line with them. This should help stave off any un-authorized users.

[cardinalsfan]

I see what you're saying.  I'll work on doing all that this weekend. 

[FurryNutz]

Keep us posted...hope we can get this nailed down and more secure...

[FurryNutz]

Internet Service Provider and Modem Configurations

• What ISP Service do you have? Cable or DSL?
• What ISP Modem Mfr. and model # do you have?

[JavaLawyer]

I think this all happened because I didn't change the username/password from the default after the firmware update and it was easy for him to get in.

This part of your original post (referenced above) confused me from the get-go. Performing a firmware update on the DCS-932L will not impact the stored username/password combinations that you've previously defined. That said, there are only three ways the default password (blank field) can be re-instated: (1) a new password was never selected when you originally configured the DCS-932L out-of-the-box; (2) you reset the DCS-932L to the factory default settings; (3) you manually changed the password back to a blank field.

[cardinalsfan]

Internet Service Provider and Modem Configurations

• What ISP Service do you have? Cable or DSL?
• What ISP Modem Mfr. and model # do you have?

Cox Cable
Cisco DPQ3212

[cardinalsfan]

This part of your original post (referenced above) confused me from the get-go. Performing a firmware update on the DCS-932L will not impact the stored username/password combinations that you've previously defined. That said, there are only three ways the default password (blank field) can be re-instated: (1) a new password was never selected when you originally configured the DCS-932L out-of-the-box; (2) you reset the DCS-932L to the factory default settings; (3) you manually changed the password back to a blank field.

My rebuttal for each item:

(1): I selected a new password for each right after I installed them last April.
(2): I haven't done this
(3): I didn't do this either

I had the password set before the required firmware update and afterwards it went back to the default.  It didn't change any of my other settings.  I know it doesn't sound right but I promise you it's what happened.  I even remember wondering why my password wasn't working when I tried to log in after the firmware update.  I didn't think much of it and left it alone.

If it makes any difference, I updated the firmware from the house from the mydlink site.  Maybe that's why it got changed.

Either way my network and cameras are locked down now.  All passwords have been changed and most now use 10 digit generated passwords to be more secure.  We'll see what happens from here. 

Thanks for all the help everyone, I'll update later if this continues to happen. 

[FurryNutz]

I recommend from now on, anytime you do FW updates, ensure the the PW has remained or just input a new PW that way you know for peace of mine that PW is in place and has been changed by you only.

Keep us posted.

[cardinalsfan]

I recommend from now on, anytime you do FW updates, ensure the the PW has remained or just input a new PW that way you know for peace of mine that PW is in place and has been changed by you only.

Keep us posted.

That's a very good idea.  No matter how it happened, it's my fault that the PW was the default and was able to be hacked.  I still have no idea how he got in but I've locked down as much as I can.  We'll see what happens from here. 

[FurryNutz]

 

[JavaLawyer]

Also, you can log into your web UI and change your password at any time if you feel it's been compromised, and only log into the web UI from a PC that you are confident is secure.

MAINTENANCE > Admin > ADMIN PASSWORD SETTING.

[RYAT3]

I hesitate to take them offline but I guess I have no choice right now.

I think he's been in my email (the one I use to send the motion detection emails) and gmail logged his IP.  Well, it logged an IP from Firefox, which is a broswer I never use.  It also had log ins from times I haven't been on so unless it was the camera, it was him.  Anything I can do with that IP address? 

Block it in your router?

What router are you using?

Do you need port forwarding?

There are papers out there on how to hack these Cameras...And also how to search them out.

What OS are you using? Which Windows ...? Or Mac...?
What router are you using?

Some dcs camera logs show ip address accessed from. ..

[RYAT3]

You can also do a whois lookup. . Or Google his ip... which is probably hacked to.

Trace route also. .nslookup..

[cardinalsfan]

Block it in your router?

What router are you using?

Do you need port forwarding?

There are papers out there on how to hack these Cameras...And also how to search them out.

What OS are you using? Which Windows ...? Or Mac...?
What router are you using?

Some dcs camera logs show ip address accessed from. ..

I don't think blocking it in my router will work as I'm more and more sure he didn't access the cams locally.  I use a Dlink DIR-655.  No need for port forwarding either.  I didn't know about the papers but between that and the default password, that might explain how this happened.  We have win 7 and win 8.1 computers in the house and 1 mac.  These cameras don't log IPs.