Encrypting Video By Tunneling Rtsp/Rtp Inside Https

In the discussion Ocean 11 Camera Hack Real World?, there was some question about whether https enabled cameras actually will encrypt video data, or just the commands and config communication between the camera and VMS.

This simple test shows its possible to encrypt the transmission between an Axis M3006, running in HTTPS only mode, and Milestone Xprotect (Corporate), with HTTPS enabled.

Having said that, it is not enough, in this case to merely enable HTTPS in Milestone and Axis, equally important is to set the streaming mode to tunnel RTSP over HTTP.

Highlights from the video:

  • Start Wirehark unfiltered capture 0:07
  • Start Milestone recording/management server 0:13
  • Show encrypted TLS packets in Wireshark 0:18
  • Open Axis m3006 webpage 0:22
  • Show HTTPS only setting 0:33
  • Open Milestone management server 0:46
  • Show Milestone setting of HTTPS enable for Axis camera 1:46
  • Show rtsp over http streaming mode setting 1:49
  • Change streaming mode to rtsp/rtp, no tunnel 1:51
  • Show unencrypted rtp packets in Wireshark 2:06
  • Change streaming mode back to rtsp over http 2:34
  • Show encrypted TLS packets in Wireshark again 2:41

Hopefully this shows enough for someone to replicate the behavior, if not let me know what else might be helpful...

Login to read this IPVM discussion.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

***** ********* **** **** ********* ******* **? ***** *** *** you ****** ** *** ******? *** ***/****/****/*** ******?

*** ***/****/****/*** ****** ****** ** *** ******.

*** ***/****/*** ****** ** *** *******. ***** ** *** ******* by ******* ** *********.

**** *** ****** ***** ** *********, ****, ** ** **** a ********* ** ******* *** **** *** *** ** ** port ***. *** ** *** *** ***** ****/***/*** ** **** streaming ******, **** **** ******* ***********. ** ** ***** ******* everything ****** **** *****, ** ******* ********** **** *********.

***, *** ****** **** ********* ***/**** **** **** ** *** the ******* ** *******, ********** *****, ** ***** **** ********** to ** *** ************ *** ************* ** *** *******.

****, ***** *** ***** ******* ****** (****) *** ** ** serialized **** *** ***** ******* (***), **** ***** *** ****** less ********** ** ***** ********, ** ***** ** ** **** OOB (***-**-****) *********.

** *** ***** ****, *'* **** ******** **** ***** ********** is, ** * *** *** **** *** ************* ********* *** necessity ** ***** ***** *** ********* ******** *** *** ** end **********.