Remote intrusion on my Vu+ Solo2 - tuner B - security - password

[juanca2000]

hello All
I have noted that the icon in the front pannel display for tuner B was on several times while no recording or none of my devices was using it locally or remotely.
I have usually rebooted device to interrump that connection but it will come back later on. Now I am quite convinced that someone has managed to find my device and is using it.
As I first step and as I have also very limited knowledge of linus/network I have changed the password of the rooter and wifi, changed the port in the rooter that is used to find my box in the network but the intrusion is still happening.
I have no idea how they could find me and my box and what to do to avoid them to enter and use the box.

Is there a step by step procedure for newbies on how to secure the box and avoid not autorised use of it?
I have not been able to change password of the box and one breach is that I am still using the default password.

I think it will be usefull to all if someone could build a step by step procedure on how to secure your device even for remote use (I am using the new app recently published on google play, should I not?)

Thanks to all of you for your input/links or any information that could help me to blocks those accessing my box.

[pembo]

go into your router and delete any forwarded ports to your box.
Setup a VPN server, add this to your mobile device, and use this to get into your home network.

If you don't remove the forwarded ports, you will be hacked again and again...

[Rob van der Does]

go into your router and delete any forwarded ports to your box.
Setup a VPN server, add this to your mobile device, and use this to get into your home network.

If you don't remove the forwarded ports, you will be hacked again and again...
I couldn't agree more :thumbsup:

[juanca2000]

Thanks a lot ! Not really sure on how to do it but i will start with disabling port forwarding for them and unfortunately for me too. I guess it is safer untill i find out how to set vpn for all devices...
It think it would still be usefull to have if not existing a step by step procedures to make solo2 safer with installation tips and tricks like password protection and other tips for newbies...
I ll give some news once i manage to progress
Thanks again

[pembo]

if you want to do vpn, the most simple way is to buy a router with VPN server enabled in it.
Some of the ASUS ones support VPN server setup, as do netgear and Linksys.

I have an ASUS one that supports PPTP and OpenVPN servers.

In some respects it's better to have the VPN at the router as if it's anywhere else in the network, then they're already in the front door...

[imish]

If you use OpenWebif to remotely stream (even within the house) then sometimes the VU Solo does NOT gracefully release the tuner once the remote stream is shut - giving the impression that someone is still using the tuner.

I havent managed to find a fix to this other than to reboot the box.

[Rob van der Does]

You're right; that does indeed happen, though not always.
In my experience it depends on the box and on the device asking for the stream.

When this happens, it is bound to ruin recordings, so it is a very nasty issue.

[imish]

Some weird gremlins with the code - would be great if they were fixed to make the box robust.


Sent from my iPhone using Tapatalk

[pembo]

imish, whats your stream client you're using?

[duoduo]

I have an ASUS one that supports PPTP and OpenVPN servers.

Please can I ask the model details of your router Pembo and do you know if they do a version for cable?

[pembo]

I have this one

https://www.asus.com/Networking/RTAC68U/

Running a slightly tweaked firmware

http://www.lostrealm.ca/tower/node/79

It's a cable/fibre router, not a DSL one.

[DaMacFunkin]

Hi pembo, do you use PPTP or openVPN on your asus router, Thanks.

[pembo]

either works and I've used both but I tend to stick with openvpn.

I use the tweaked firmware as It adds a few more useful features such as DNS filtering per client, also it has TOR routing which I've not tried yet!

[imish]

imish, whats your stream client you're using?

VLC for MAC

[iwg]

Hi Juanca2000
obviously all the advice given is good but earlier in the post you said you did not know much Linux incl how to change default password. You need to telnet to the box (from a laptop or PC, start DOS CMD and run telnet 192.168.0.NNN) where that is the address of your VU box. Then login as "root" - no password - which I think is part of the issue. At the # prompt, type "passwd root" and enter a private password that you can remember. It should not be a dictionary word, birthday, proper name and should include a mixture of lower/upper case letters, numbers and punctuation chars to hinder hacking tools. You will have to enter it twice for verification. Start another DOS CMD window and login again to confirm it works before logging out of the first one (CTRL-D or type exit).

[pembo]

telnet doesn't exist by default in windows 7/8. You can add it in, but i'd always recommend putty.

Changing the root password here would help but still won't stop you from being compromised on the openwebif and streaming ports if you map these into your router. I also wouldn't recommend mapping the telnet port through, as this would then without doubt be a target of brute force attacks from script kiddies.

If you wanted to do this, really you'd want to map through SSH with public/private key auth, and still, even then, you'll be the target of script kiddies, so you'll need to put on something like deny hosts to try and avoid a constant hit from IPs resulting in the equivalent of a DOS attack.

[Flyingpig]

What about it the only ports forwarded are 12000 for listening? Is it possible the box can still be hacked?

Thanks,

FP.

[sigpark]

You're right; that does indeed happen, though not always.
In my experience it depends on the box and on the device asking for the stream.

When this happens, it is bound to ruin recordings, so it is a very nasty issue.

Just a small observation along this line with Hades 5 and Vu+Solo2 and YouViX Blue skin: I have noticed when the webif client is in use the recording symbol is flashing on the 1st info bar screen - Just an FYI, I hadn't noticed this with the Apollo series.

[Rob van der Does]

Just a small observation along this line with Hades 5 and Vu+Solo2 and YouViX Blue skin: I have noticed when the webif client is in use the recording symbol is flashing on the 1st info bar screen - Just an FYI, I hadn't noticed this with the Apollo series.
That's perfectly normal and has always been the case. The reason is that the box handles a stream the same way as a recording.

[ash888]

iv been having the same issue lately, i thought i was just loosing the plot but it appears people have managed to gain access to my box.

telnet showed an unrecognised ip connected a few times when i noticed both tuners were in use and i could not watch any other channels as the tuners were both in use.

i added a password which worked for transcoding but not for webif streaming. so i then removed port forwarding...will see if works.

[pembo]

What about it the only ports forwarded are 12000 for listening? Is it possible the box can still be hacked?

Thanks,

FP.

Port 12000 listening to/forwarded to what on the E2 box?

[Flyingpig]

Port 12000 listening to/forwarded to what on the E2 box?

Yeah,,, the only port I have forwarded is 12000 and is for listening for cccam..... Can that be hacked ?? Really worried after reading the bits on this thread....

[pembo]

I assume you're talking about a connection outbound from your box to somewhere on address:12000 rather than inbound. If so, then you wouldn't need the port forwarded anyway. Forwarded ports from a router are for inbound connections initiated externally.

[Flyingpig]

Yeah, the port is forwarded from the router to the sat box for external devices......

[pembo]

OK - I understand. Conversation is on slightly dodgy grounds, so I'll not comment further other than to say, if port 12000 is open without any security for whatever purpose, it will be discovered by people running portscans, and then you'd become a target for any vulnerabilities to compromise your network, therefore if I needed this open, I would want to lock down the connection to certain destinations, or secure it somehow.

[juanca2000]

Thanks to all for your input.

I have read on the net that ccam 2.3 could have a backdoor that some are using to gain access to the boxes. unfortunately VIX images do not run well with ccam 2.1 and force us to use the 2.3 ccam if you want to be able to use both tuners... so quite sad.... please vix team could you fix this ?

I have for now followed most of your advices.. I have deleted portforwarding and i am using vpn connection to have access to my box. Unfortunately due my configuration this has reduced a bit the speed of connection. Therefore some channel are now difficult to stream (HD) but ok the rest is working fine and more secure apparently. I will consider bying a router with vpn integrated so that speed should not be an issue anymore.

I will also try the password change suggested a few post ago (Thanks a lot !) this will probably increase the box security.

any other suggestion or experience is wellcomed.

Thanks again

PS: by the way if you could also help ot pass the message about the issue of ccam 2.1 (2.x.x) to the dark forces. May be this will also avoid to use a version with potential backdoor (not 100% if confirmed by anyone but...)

[judge]

I have read on the net that ccam 2.3 could have a backdoor that some are using to gain access to the boxes.
That's nonsense.

PS: by the way if you could also help ot pass the message about the issue of ccam 2.1 (2.x.x) to the dark forces. May be this will also avoid to use a version with potential backdoor (not 100% if confirmed by anyone but...)
Time to donate that tin hat to someone else.

[Rob van der Does]

No point in using the old 2.1 version (it even doesn't decrypt multiple channels anymore).
Simply use 2.3 or even better: Oscam.