Remote Access Allows Hacking

Channels DVR Server Troubleshooting
#1

Hi All,
Found the following in my DVR log:
2021/06/27 04:38:38.120417 http: TLS handshake error from 71.6.135.131:47046: EOF
2021/06/27 04:38:38.282586 http: TLS handshake error from 71.6.135.131:47142: EOF
2021/06/27 04:38:38.460161 http: TLS handshake error from 71.6.135.131:47206: EOF
2021/06/27 04:38:38.630771 http: TLS handshake error from 71.6.135.131:47322: EOF
2021/06/27 04:38:38.832981 http: TLS handshake error from 71.6.135.131:47638: EOF
2021/06/27 04:38:38.922126 http: TLS handshake error from 71.6.135.131:47820: tls: client offered only unsupported versions: [302 301]
2021/06/27 04:38:39.151159 http: TLS handshake error from 71.6.135.131:47930: EOF
2021/06/27 04:38:39.304420 http: TLS handshake error from 71.6.135.131:48106: EOF
2021/06/27 04:38:39.500772 http: TLS handshake error from 71.6.135.131:48210: EOF
2021/06/27 04:38:39.661693 http: TLS handshake error from 71.6.135.131:48326: EOF
2021/06/27 04:38:39.792944 http: TLS handshake error from 71.6.135.131:48440: tls: client offered only unsupported versions: [301]
2021/06/27 04:38:45.691794 http: TLS handshake error from 71.6.135.131:53608: tls: client offered only unsupported versions: []
2021/06/27 04:38:45.927769 http: TLS handshake error from 71.6.135.131:53752: tls: client offered only unsupported versions: [302 301]
2021/06/27 04:38:54.448040 http: TLS handshake error from 71.6.135.131:60976: tls: no cipher suite supported by both client and server
2021/06/27 04:38:54.674270 http: TLS handshake error from 71.6.135.131:32912: tls: no cipher suite supported by both client and server

IP 71.6.135.131 is a known hacker address, located in Nevada. After these hacking messages, all my Recording passes ceased working. Airings that were queued were marked as Recorded, preventing recording when the show(s) aired.

Port 8089 is the only port open for incoming traffic. So it appears hackers have devised a method to bypass the authorization code required when attempting to establish a connection on port 8089.

Some insight into what is happening would be appreciated.

Thanks

#2

Those messages represent rejected connections. The remote side is trying to use insecure TLS configuration which is being blocked, hence the "handshake error".

Authentication happens after the connection is established, which is not even happening in this case.

2 Likes
#3

This is equivalent to someone checking the door to see if it’s locked. Creepy but probably just a robot looking for vulnerable sites to exploit. I’m not a cyber expert but have seen this “door rattling” activity with every server I’ve ever exposed to the internet. Keep your server and firewall updated and don’t store anything sensitive on your server. There’s all kinds of other deep stuff you can do, but it should keep you safe if you’re not a super juicy target. If you’re one of those, get professional help.

3 Likes