Hacker News Reader

Comment by joshstrange | Hacker News Reader

Reolink + Reolink NVR. Completely locally, you don't have to touch the cloud. I can access it from anywhere (after punching holes in my router for specific ports or just VPN). I ran ZoneMinder with IPCams for years before just getting the Reolink NVR (I already had mostly Reolink Cameras) and I'm still kicking myself for not doing it sooner. I have spent a grand total of zero minutes of maintenance on this NVR, I spent untold hours babysitting ZoneMinder. Also the NVR has RTSP (or is it RTMP?) feeds I can pull into HomeAssistant and use for display/processing.

So many times I'd go to pull up a feed in ZoneMinder and realize the system was down, locked up, having some other odd issue. With my Reolink NVR "It just works", it was worth every penny and it wasn't even that expensive.

View on HN

Reolink has hardcoded backdoor creds.

https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-...

Correct me if I’m wrong but that appears to apply to the cameras themselves which are not on my network. They plug directly into the NVR (which provides PoE) and are not exposed to the network at large.

Why do you assume the NVR is free from hardcoded creds?

Because it’s not listed in the list of affected devices. Also if that’s a concern then don’t expose the NVR. Use something like tailscale or a VPN to access it remotely (or don’t access it remotely).

Yeah but now everyone in your wifi range with commonly available hardware has access to your NVR and by extension your cameras.

And actually if any of your network machines or devices are breached, the attackers now have NVR/cam access.

? My cameras aren't wifi, they are ethernet and the NVR isn't wifi-based either.

Your wifi network probably isn't VLAN'd away from your hardwired network. It's all the same IP space.

You can check your NVR from your phone on wifi right?

Ok but first people have to break into my wifi network. It'd be easier to break into my house unless it's a nation state actor which is not a threat risk I'm prepared to sacrifice enough to defend against. Also, my cameras are not on my main network, they are plugged directly into the NVR via long ethernet runs, they don't touch my main network. You are guessing that the NVR might have hardcoded credentials (which hasn't been proven).

At a certain point you are being overly paranoid and I think we crossed that line a while back.

Wifi is really trivial to break into and doesn't leave meaningful traces unless you really do some enterprise monitoring stuff.

Unlike breaking into your window, you are unlikely to get the cops to do anything if someone breaches your network. There's also direct and indirect financial incentive.

So now your entire livestreaming security setup depends on the security of your wifi network, which can be broken with $20 of dedicated hardware.

And yeah, if someone puts hardcoded creds into their cameras.. they probably do it for all their firmware. It doesn't even have to be malicious, it's just a lazy way to test and debug software.

Reply on news.ycombinator.com