Foscam cameras trying to contact linode?

A place for discussion of topics that are not specific to ZoneMinder. This could include Linux, Video4Linux, CCTV cameras or any other topic.
Post Reply
therealjrd
Posts: 4
Joined: Thu Jan 31, 2013 11:34 am

Foscam cameras trying to contact linode?

Post by therealjrd »

Unclear this is the right place to ask this, but I couldn't see a better one.

I've recently put together a ZM system with a half a dozen Foscam cameras. I discovered last night that I'm seeing periodic network traffic from the cams addressed to s/:/./g li160-191 : members : linode : com port 8082. The cams are sending datagrams with sizes ~100 octets every few minutes.

I tcpdumped the packets, and it's not obvious what the content represents.

I firewalled this traffic, but I find it concerning. Is this some builtin spyware in the camera firmware? Is it something innocuous which is fooling me?

Thanks in advance for any info.
wocketfast
Posts: 17
Joined: Fri Feb 22, 2013 1:27 pm

Re: Foscam cameras trying to contact linode?

Post by wocketfast »

I've noticed a lot of the cheaper cams seem to register themselves for DynamicDNS so its probably that.

While this helps the non technical user view it remotely I cant help wonder why they use a propriety service other than for some dodgy reason. for one make the url uses the mac addresss, so you can just increment it and see if you can find any cameras out there.

Therefore my cameras are all behind a firewall.
They are not allowed to talk to the internet AT ALL
therealjrd
Posts: 4
Joined: Thu Jan 31, 2013 11:34 am

Re: Foscam cameras trying to contact linode?

Post by therealjrd »

Agreed about keeping all that stuff firewalled. I've rechecked my iptables rules to make sure none of that traffic is getting out. I also did some longer packet captures to see if there was any other unexpected traffic happening, nothing so far.

I suspect you're right, this is probably the cams doing something "helpful" a la dyndns. That setting is turned off in the cam configs, but there might be something else. And if whatever service they're trying to interface to is hosting part of itself on linode, that would explain it.

But I still find it alarming and annoying to discover the devices spontaneously reaching out like that.

I tried posting this question on one of the foscam support forums, but haven't gotten anything back yet.

Thanks...
tkalfaoglu
Posts: 65
Joined: Wed Nov 22, 2006 6:19 am

Re: Foscam cameras trying to contact linode?

Post by tkalfaoglu »

That name is apparently registered to myfoscam.org:

Myfoscam.org | Myfoscam IP Lookup (IP: 66.175.220.161)
Hostname: myfoscam.org
IP Address: 66.175.220.161
Host of this IP: li515-161.members.linode.com
Organization: Hurricane Electric
ISP: Linode
City: Absecon
Country: United States
State: New Jersey
Postal Code: 08205
Timezone: America/New_York
Local Time: 15.09.2013 00:46:46
tkalfaoglu
Posts: 65
Joined: Wed Nov 22, 2006 6:19 am

Re: Foscam cameras trying to contact linode?

Post by tkalfaoglu »

Thanks for letting us know, I enabled "parential controls" of my modem and blocked the camera from going to the internet.. Ah, child cameras! -t

PS: I'd get a new firmware if I were you..
Post Reply