Subscriber Discussion

What Advice For DIY End Users Of Dahua Oems?

RI
Righteous Indignation
Dec 30, 2017

Forgive me for seeking advice on a topic that's been well covered by IPVM. I'm also a brand new member to this community. That coupled with very limited experience in even the most basic of proper practices within this realm, and the seemingly endless catalog of in depth articles and discussions on just THIS subject, let alone the entirety of what's contained in IPVM archives as well as the bleeding edge info provided to members every week, is, to say the least, overwhelming, bordering on daunting. In attempting to absorb as much information as possible, I have neglected other common mundane tasks most humans take for granted: laundry, dishes, shaving, etc. although I haven't been able to give up showering... just yet.

All (terrible) attempts at humor aside, I'm finding difficult if not near impossible to forgive myself for purchasing the Lorex NVR/IP camera package, through Costco Online, earlier this year - around June - that was, to the best of my knowledge at the time, hacked by an angry neighbor/some random student of the mechatronic education program from our local university. After reading many, many articles on the subject in general, and more than a few regarding the Dahua backdoor specifically, I am all the more grateful for IPVM membership today. At the same time, I am kicking myself in the pants repeatedly for allowing myself to fall prey to an exploit that seems so poignant it, in my opinion, should have made national headlines. (Just before typing this out, I read another IPVM article showing, for all intents and purposes, it DID make those headlines, and I recall reading about it in a major newspaper article. At the time, and until 5 days ago, I had no idea that Lorex/FLIR OEMed Dahua, even having made a Google query asking, "who OEMs Lorex/FLIR?" at the time not understanding the 'direction' the OEM travels, and so found zero information that Lorex/FLIR was anything other than good ol' USA manufactured. Could I possibly feel any more inept at having exposed my family to massive identity theft and beyond? A great deal more, it seems.

I wanted to ensure that I installed this product (Lorex LNV416S+LNB3163B x6+LNE3162B x3) with nothing less than the most up to date knowledge and practices to ensure smooth sailing. I accessed the Lorex/FLIR official website a grand total of 29 times, not including other legitimate (as far as I could discern) info regarding IP/NVR best practices, all queries ending with "2017" to try and ensure up to date info, unfortunately, not once did IPVM show up during this time. I also realized, due to the age of our dwelling (circa 1930s) and previous knowledge of WiFi vulnerabilities and my ineptitude at dealing with that possibility, that I opted for hard wiring everything, which brought its own challenges as fishing cable through the attic was impossible the entire middle of the dwelling (the place has seen many additions, having been a 'college rental house' for decades prior to purchasing it; the middle addition having an attic crawl space of just UNDER 6 inches and sporting electrical standards of some bygone era where a ground rail was the norm.) Suffice to say, I opted for PVC electrical conduit of sufficient bore to house the first half of the cable (CAT 6) run that was included in the system's purchase. Knowing next to nothing about THAT meant I needed to educate myself on those best and current practices as well. When all was said and done, my head overflowing with newfound knowledge, it was not until mid September of this year (2017) that I made my way to the local "ginormous" hardware supply outlet to purchase the supplies that came from an additional week of (pulling my last hairs out) planning.

You're probably asking why I did not opt for the BEST installation option, i.e., professional. First, and if you'll excuse the expletive, I am a cheapass, preferring to do 'it' myself (and taking a bit of pride in the successful installs around the house) and secondly, there are, for the size of my town and in my opinion, far too many 'security/alarm' installation businesses. One outfit, known nationally (three letters make up its name; can you guess?) has no less than SEVEN 'authorized' dealers/installers in a small city of just under 200k citizens. And that's JUST for that business name. There are over 25 professionals in this business in my city. Plus my cable/internet provider on my back about how they can do it 'best'. Something about this doesn't feel right; seems like a racket to this paranoid consumer.

To shorten this text wall: With the help of a very patient and attentive relative, we got everything installed, buttoned up, turned on and tuned in with, what I thought at the time was great success. I forgot to mention, I even over-educated myself on local "CCTV laws and ordinances" to ensure we were not encroaching on anyone's privacy or privacy laws in general.

Then, in late October, it all began to fall apart. It was harrowing to attempt putting a finger on which vector the exploit began. Being incredibly fortunate to live in a very affluent section of my city, I learned, to my utter amazement, how entirely against any form of video surveillance my local neighborhood and neighbors were/are. I live amidst doctors, lawyers, computer builders/servicers, and law enforcement/prison personnel. All adamantly opposed to security surveillance - and here it comes - by ANYONE other than the 'local three letter' professionals. Within a matter of weeks, everything connected to my state of the art Cisco manufactured modem (three personal computers, three NEW mobile devices and the Lorex system) were compromised. This would be the third attempt at identity theft my family's experienced in five years. Replacing the Xfinity modem TWICE did nothing: rehacked. I also forgot to mention: I am, to the great irritation of my entire family, incredibly 'anal' about password security, physical security etc., to the extent someone with zero formal training can be, given the mostly sponsored information available. Some may laugh, but this is one area YouTube has been of great benefit to us, albeit after exhaustive searching for truly licensed professionals putting out the latest up to code information and how to info for DIYers, which, unfortunately, ends at the beginning of anything having to do with security surveillance, which is all, in my opinion, sponsored crap. And still, not once, did IPVM show up as an option for information.

Oh, the time and stress that would have been saved had even just one of the 'professional' sites I pored over put up a link, or even a hint, that an entity like IPVM existed. In the last month, without a membership, unable to access the plethora of rock solid 'Pro only' info, I was able to discern if not the who, the very definite 'what' of my system's exploitable access points, including non brand specifics such as the basic practices for IP/NVR networks. It was at this point that I came across and article/discussion with a link to the Lorex/FLIR 'white paper' release. Needless to say, I was appalled just short of outrage that this fundamental notification was never sent to me, not even a link to the page, even though I'd just paid at the time what I thought was a steal, a bit over $800.00 US for my new system. Even more appalling, I followed every jot and tittle of the install instructions, which were sparse to say the least, heading to the Lorex site and downloading every pertinent PDF I could that covered my system specifically, and 'best practices' for IP systems in general... which very clearly instructed me to port forward... even though I also downloaded their 'cloud client' which esteems to eliminate that need (and nowhere, at the time, instructed against it). I don't want to bore you with how user UNfriendly this system is; I'm certain the majority of you know what hell it would be were you a know-nothing like myself. Utter chaos, to be certain.

So much for shortening the text wall. Apologies. I feel at this point, I'm simply venting, so I'll end with a statement and a question for all of the real pros who made it this far.

IPVM is the best thing to happen to this consumer in what seems an eternity. I only wish I'd found myself here 6 months ago. For someone like myself, in this situation, there is no better source of information at this level of integrity. Professional or not, I'm signing up for the February 2018 camera course. The investment is a quarter the cost of my current IP system and worth 10 times that, in my experience. Thanks, to all of you that contribute and to IPVM for being available to this greenhorn.

Finally, let's pretend I never found this incredible resource. What/where/when/who would you (collectively) suggest consumers in my position, the adamant cheapasses that stupidly won't compromise on the DIY angle, go to for bleeding edge information that even holds a candle to what's provided by the IPVM staff and members?

My sincere thanks to those who made it this far, even more so to those willing to share some advice/guidance.

(1)
JH
John Honovich
Dec 30, 2017
IPVM

What/where/when/who would you (collectively) suggest consumers in my position, the adamant cheapasses that stupidly won't compromise on the DIY angle, go to for bleeding edge information that even holds a candle to what's provided by the IPVM staff and members?

The biggest IP camera DIY site is IPCamTalk. They have smart people there and they focus on helping/working with the various challenges of buying and supporting unauthorized products.

You're probably asking why I did not opt for the BEST installation option, i.e., professional. First, and if you'll excuse the expletive, I am a cheapass, preferring to do 'it' myself (and taking a bit of pride in the successful installs around the house) and secondly, there are, for the size of my town and in my opinion, far too many 'security/alarm' installation businesses. One outfit, known nationally (three letters make up its name; can you guess?) has no less than SEVEN 'authorized' dealers/installers in a small city of just under 200k citizens. And that's JUST for that business name. There are over 25 professionals in this business in my city. Plus my cable/internet provider on my back about how they can do it 'best'. Something about this doesn't feel right; seems like a racket to this paranoid consumer.

I, unfortunately, believe that. There are a lot of weak installers, especially those who are willing to serve the residential market (see: Should I Sell Camera Systems To The Residential Market?). However, there can be some good ones but they are hard to find, since they don't have the marketing resources of the three letter nationals. Btw, you might look at our Integrator Finder Map and see if there any smaller local companies in your area that might be worth contacting.

(1)
U
Undisclosed #1
Dec 30, 2017
IPVMU Certified

I learned, to my utter amazement, how entirely against any form of video surveillance my local neighborhood and neighbors were/are. I live amidst doctors, lawyers, computer builders/servicers, and law enforcement/prison personnel. All adamantly opposed to security surveillance - and here it comes - by ANYONE other than the 'local three letter' professionals.

Maybe that’s a fluke, my neighbors are generally apathetic, and think of ADI as an alarm only company.

Many of them have DIYed various Costco specials with various levels of success.  Making a cellphone video at night driving down your street is a good way to count cameras and quality, based on the IR coverage.

Within a matter of weeks, everything connected to my state of the art Cisco manufactured modem (three personal computers, three NEW mobile devices and the Lorex system) were compromised. This would be the third attempt at identity theft my family's experienced in five years.

Are you saying you suspect your neighbors? Why do you think it was an attempt at identity theft?

It was harrowing to attempt putting a finger on which vector the exploit began.

Well, if it was a port-forwarded Dahua backdoor camera, that’s all you need for penetration.

For someone who doesn’t have as much time and resources to devote to video surveillance, an ADI install might not have been such a bad choice, yes/no?

MM
Michael Miller
Dec 30, 2017

Needless to say, I was appalled just short of outrage that this fundamental notification was never sent to me, not even a link to the page, even though I'd just paid at the time what I thought was a steal, a bit over $800.00 US for my new system

You purchased your system from Costo so how is FLIR going to send you a notice if they don't know you have one of their systems? 

(2)
UI
Undisclosed Integrator #2
Dec 31, 2017

For some reason I thought IPVM was geared toward integrator's, not end-users.

(2)
U
Undisclosed #1
Dec 31, 2017
IPVMU Certified

DIY got you down, U2?

UI
Undisclosed Integrator #2
Jan 01, 2018

No, I just think there certain things should be kept to its professional users, this forum being one.  Otherwise, it gets polluted with questions that are repeated over and over again from end-users seeking a quick answer.  When that starts to happen this forum loses its streamline approach to the professionals that use it.  There are other open forums for non-professional end-users.

U
Undisclosed #1
Jan 01, 2018
IPVMU Certified

Otherwise, it gets polluted with questions that are repeated over and over again from end-users seeking a quick answer.

Fair enough, though the initial cost needed to ask that question on IPVM is typically incompatible with the DIY ethos, thereby limiting the communal dilution substantially, IMHO.

(1)
UI
Undisclosed Integrator #2
Jan 01, 2018

I concur. Lets hope that's the case here.

Avatar
Sean Nelson
Jan 02, 2018
Nelly's Security

i agree, if they pay, I think they are welcomed with open arms and provide a valuable insight.

There are enough free DIY forums to keep the "free info" seekers away

(1)
JH
John Honovich
Dec 31, 2017
IPVM

IPVM was geared toward integrator's, not end-users.

IPVM is focused on integrators but there are many end-users, typically larger ones, that are IPVM members. DIY end-users are atypical on IPVM.

(1)
RI
Righteous Indignation
Jan 03, 2018

Were I a professional of your caliber and longstanding member, I would feel exactly as you do. I did quite a mental battle for a few days arguing with myself, your statement/question, almost verbatim, resounding through my skull many times before finally deciding to post my rant question. Please understand that I know from a professional standpoint (within my own profession, wholly outside of security surveillance installation and management) that no matter how secluded the 'water' is, 'mud' of any sort or amount is still mud in the end and all of you have worked hard and long in your professions and deserve an 'oasis' of the purest venue. As to that, all of you here have my sincere apology for the amatuer distraction, and I sincerely appreciate you bringing this up as it will keep me in check in the future.

My ONLY caveat at avoiding self-reprisal is, as has been alluded to in a few other replies  regarding professional installation, identity theft and what am I even doing here, is threefold: First is that after our first burglary, a long time renter (our home is enormous and we rent rooms out to a select few who undergo extensive background checks), and here comes an embarrassing 'real world' experience, had $36,000.00 U.S. in cash, 'liquid' paper money, an inheritance check from his mother's untimely death he literally cashed, stolen from a 'hidey hole' deep in the closet of the room he rents; the burglar(s) made their way to the middle of the large dwelling and removed, from my mother's unlocked filing cabinet, original and remodeling plans of the property, personal checks and various other personal financial documents that went unnoticed by her, and unreported. The responding officer, ironically the Lieutenant of the department's Burglary Division, was incredibly unhelpful, refusing any investigatory measures as our PD's policy on burglary/larceny/vandalism is that all cases be treated as "cold", even though I placed my call approximately 15-30 minutes after the incident. They don't even 'dust' for prints any more as a policy. It did not matter that the burglar(s) had to know the schedules of my family, my mother, and our two renters at the time down to a "T" as well as that of our surrounding neighbors to be able to shatter a small glass pane close to the door handle lever while standing on our front porch, have prior knowledge regarding the renter's cash stash and where it was hidden and the location of my mother's filing cabinet in a room of the big place completely unconnected to the renter's room and steal documents although unnoticed at the time, gave the thieves (or whomever they sold the info to) more than enough information on how to easily perform repeat thefts, best times to do that and surefire way to steal not just my personal signature, but my social security number and access to my credit card number and mobile device, the number of which was purchased from my carrier by the FCC for pursuit of the criminal(s) and as evidence in their prosecution. Because I was napping that evening in the back connected apartment of the property (remember, old college housing), meaning I was on site when this occurred, the officer actually implicated ME as the most likely suspect in this at the same time he was disclosing our home was one of seven in a five block radius burglarized within a week's time. Two weeks later another large home literally a half-block from ours was burglarized in broad daylight as their neighbor watched the thieves open the home's alley gate access, carefully back a moving truck to the garage and proceed to load all the PC's, electronics, refrigerator and box freezer, stereos, televisions, outdoor pool and barbeque accessories and luggage, filled with the family's entire wardrobes, seal it up and even close the gate when leaving; when the neighbor was interviewed they said that due to the relaxed nature of the crooks and their apparent knowledge of where to go and how to go about it led him to believe these shits were relatives or very close friends, "... lending a hand..."

Anyone with a modicum of intelligence would rightfully be labeling myself, my neighbors, the PD and probably the whole city as a gathering of complete and total idiots. I fully agree. For the three decades plus that I've lived here, knowing all neighbors on a first name basis, comfortably able to leave doors and windows unlocked day or night, everyone willing to look out for 'suspicious' activity and report it, allowed what's referred locally as "The Golden Triangle" that is our neighborhood, to live the Andy Griffith life, which in turn, made us probably the easiest pickins for crime on the entire West Coast of the U.S. That title comes with more than its share of utter embarrassment, dismay and disbelief. It's a tough thing when one's utopia is shattered and laid bare before a snickering world who laughs and shakes its head. Especially when one doesn't simply 'come from' money and has earned every last cent through drudgery and hard work. Death feels more appropriate than living with the hindsight regarding how careless one has become. Being self sufficient, and then becoming a fool created a drive in me to repair the damage. Hiring others to do so, under the circumstances seems even more expensive because it's hard to place a value on trust, both in others to do more than I thought was ever necessary, and in oneself to even make an accurate judgement on the caliber of those being hired to safeguard what I was unable to.

Not simply knowing how to repair that damage created within me a further drive to gain that knowledge. I know of NO college/university, local or otherwise, that offers instruction on home security hardening, surveillance practices. I didn't even know those terms existed then. Learning these skills and implementing them myself with money I'd earned would, in my mind, help repair an ego that had been what might feel like being raped and then publicly ridiculed for being a victim. Who would anyone trust after that, especially, keeping on track of what I actually was a victim of, learning that crimes of the caliber our neighborhood experienced were not often perpetrated by some junkie needing a fix and heisting the first affluent looking place they come across. I learned that at this level, it's far more likely and often that what we, I was dealing with was not just foreknowledge, but an innate knowledge of how to surveil, security practices and spotting weaknesses, how to work 'nice' people for specific pertinent information that would financially benefit those of this ilk (social engineering; basically the premise of how I earned my living and afforded the amenities for my family, making the embarrassment go even deeper than many can imagine) very often perpetrated by individuals in the security industry, retired high level law enforcement, ex-military and those with professional backgrounds in the exploding computer industry; this list includes the professions of every one of my neighbors in that five block radius. That leaves pretty much only oneself as the best person to trust for the job. In learning that the amount of knowledge you honest pros have acquired, as well as what the dishonest ones have and then how to implement the former and combat  the latter showed me I had a mountain of research on my hands. For better or worse, that's lead me on a personally financed journey from absorbing, let alone discerning the 'fruit' from the 'fertilizer', the information available 'out there'. Add to that realizing that having the ability to case homes of this nature on this level meant that it was highly likely the culprits lived close by, maybe even in my home. Even more terrifying, it might be (as has, after five years of investigation on my own has just short of proven, to me any way) a close relative or even worse than that: an immediate family member with an axe to grind. Where would you go for info when you value your time and where you invest your hard earned money? Enter IPVM. There simply is NO other entity in this industry with your level of integrity and knowledge. NONE. And the club you belong to is private, reserved only for those in the know, and at this point, it's too late to change professions, get experience and invest in membership. And so I came to the only place I've found in five years of search queries, having nothing but advertisements and ill advice offered by the different search engines I've employed in that time, where at long last exists the information I seek, from the very folks, the truly honest ones, backed by cumulatively hundreds of years of real world experience, shared in an up front forum. Anyone in my position would be a fool not to engage this community, even with "stupid" (my adjective to describe my presence) questions.

I hope that the above is taken seriously and with some compassion and most of all with as much respect for my challenges as I have for the professionals in this forum. If it weren't for all of you and IPVM, I wouldn't have a thing to learn in the first place, especially and in my case most importantly, that investing in experienced professional installation by reputable pros supplied from reputable manufacturers will always be, in the financial long run, far less expensive than working around my own ego. My sincere thanks and best wishes to you all. Cheers!

U
Undisclosed #1
Jan 03, 2018
IPVMU Certified

A truly cautionary tale, supremely underscoring the dangers of running outdated firmware.  

Hopefully once you install this latest file, things will start to turn around for you :)

RS
Robert Shih
Jan 02, 2018
Independent

What is your NVR model number again? What you posted doesn't match anything on their site. Cameras are probably Themis chipset from what I see. The recorder might be just a 4 series.

There is updated stock firmware from Dahua, but you might be better served by updates from Lorex itself that will patch things up for you. I didn't find anything relevant on their website for your models, for all of their fancy web design. That's what happens when you go DIY. Sales volume rules all and post-sales is an afterthought to them.

U
Undisclosed #1
Jan 03, 2018
IPVMU Certified

What is your NVR model number again?

Like this, I believe, though only 9 cameras.

RI
Righteous Indignation
Jan 03, 2018

To the both of you who inquired/assisted in the answer:

LNR 416S (like the one pictured above)

six LNB3163B 70 degree FOV bullet cams

three LNE3162B 100 degree FOV turret cams, both styles 3MP.

A month after purchasing, through Costco online from an offer that came as wholesale online only package through Costco only, I got zero matching search results when using the Lorex search engine at their official site. I had to wade through the sites bottom of the page small print links only to find a PDF complete user manual, which still didn't even cover things like how to change each IP cams password and why I couldn't when I tried (before the hack), or what the window for the 'switch' is, or even what a switch IS, and why my system wouldn't work if I chose not to check the box... even though I don't have a switch.

After reading through the manual twice, all cams hardwire connected to the back of the NVR, why they all show up as 'remote' or why it's necessary to even use that when they are, to my best notion, all locally connected. The FLIR cloud client is even more extraneous as the interface is wholly different from that of the NVR itself, having extra stuff the NVR doesn't include and that impact the system and cameras to a great degree, and recommend port forwarding and activating UPnP, as well as using completely different descriptors of setting than the NVR. Neither interface is DIY end user friendly, even though both Costco and Lorex advertise literally EVERY item they sell as 'easy, DIY and user friendly to set up'. Hell, I thought that their inventory was manufactured by THEM in the good ol' U.S. of A. There's no disclosure, from anyone selling these things anywhere to my knowledge, disclosing OEM practices. Had I known that, I'd have sacked the whole idea of surveillance equipment altogether and simply purchased three digit priced locks for all entries and windows.

Funny thing about the hack is it didn't happen until after I posted about just how user unfriendly the system was, how it was marketed and what little help I received after numerous inquiries to both Costco and Lorex, on www.ripoffreport.com. I was warned by that site before posting that reprisals are common when consumers choose to disclose shoddy business practices on their forum. Indeed.

Thanks sincerely for your help.

RS
Robert Shih
Jan 03, 2018
Independent

In your original giant wall of text you had a typo in the model number.

Before I get to the potential stock Dahua firmware, I have some life advice:

I've been accused of being verbose in the past, but I have learned to generally adhere to a concept called "word economy" which can prove to be a better indicator of strong communication skills than colorful elaboration. As they say colloquially, "keep it short and sweet". Even investors need you to capture their attention quickly BEFORE you even get the chance to elaborate.

My preferred version of ConfigTool

Suspected NVR Firmware (if it doesn't work, there's other possibilities)

Highly suspected camera firmware

Them's the links and in true DIY fashion, I'm throwing you the tools and that's the best support I can give ya with this since you aren't one of my dealers or their customers. Only other follow up is if the firmware doesn't work I'll give you a few other possibilities to try on my FTP, but everything is as new as it gets (some crazy new even compared to the International or US website) on there (give or take a few files I have to take my entire NAS down to update, but nothing that is remotely in the price range of what you bought).

Let this be a giant cautionary tale for End Users here. Retail OEMs are NOT the way to go if you actually want to be on top of getting any sort of real support from the channel. Even someone like myself who has a record with my dealers for guessing from other distributors' model numbers will have to roll the dice with what you got here.

There may also be the possibility that FLIR/Lorex locked their specific models out from receiving stock updates. In which case, you're SOL when it comes to my help. You can at least get the 3 strikes method with me here. Otherwise, my line will be "allow me to refer you to one of my valuable trusted dealers!"

UI
Undisclosed Integrator #2
Jan 03, 2018

Certainly if I were the "villain" in this story, I might also want to learn everything I could about video surveillance systems in order to circumvent them. Sorry but your story sounds odd and suspicious.  That's just my two cents.

(1)
New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions