Cameras are trying to connect to unknown IP addresses

[rajko_341391850524816]

I recently acquired two rlc-410 cameras and am in the testing phase of software and hardware.
I noticed on my firewall that the cameras are constantly trying to connect to 51.103.5.186; 51.103.5.159; 35.180.210.74 without me asking for it anywhere!?!?
What is it about? Do you have a built-in backdoor or what?

Why don't I have the ability to disable that traffic on the camera ??

[Cynthia_124785627824270]

Please believe that as a security company, we place importance on privacy and security to our customers. Your privacy and security are protected and we do not have a built-in backdoor.
Could you please contact our support team at support@reolink.com to have a check? They will provide you with professional support and help you solve the problem as soon as possible.

[bits_67665092824]

What do these resolve to in your region?:
apis.reolink.com
p2p.reolink.com


Do you have the UID feature enabled?

[Crimp On_62210811129]

I think the UID feature is the key question. UID is what sets up the information in the Reolink "cloud" for the iPhone and Android apps to connect to cameras remotely. Every "Internet of Things" device that I own does the same thing. (The device opens a connection to the cloud for the app to be able to reach the device.)

If remote access will NEVER be used, try turning off UID.

[NotVeryHandy5_215957390160086]

Required reading for Reolink owners.

Very important considering how many of their cameras will never be patched/fixed for this.

Google the advisory for:
US CERT ICSA-12-019-02 Reolink P2p Cameras
As well as:

CVE-2020-25169 Use of Hard Coded Cryptographic Key

and

CVE-2020-25173 Cleartext transmission of Sensitive Information

[rajko_341391850524816]

Thanks,
I figured out myself the reason of cameras wild behaviour and disabled UID, blocked reolink IP addressess in my firewall, and so on.
What I am realy pissed off is that the freakin' UID feature is enabled by default and there is no capital letters notice about it... and there should be..
I understand that this is a simplest way for most of the users to access their cameras, but at the same time it is ahuge security breach.

So, make it possible but warn the users about it and hide enable button deep in the setup.
It realy annulled all my excitement about the good sides of this product.

dissapointed

[Cynthia_124785627824270]

So sorry about the issue.

We will forward the issue to our engineer and we will try our best to improve the products.