8mp HD analog camera better then loads of other IP 8MP cameras

[Revo2Maxx]

So I had a friend come over tonight and ask what the difference was between his 8mp IP camera and my Analog HD 8MP camera. He said that mine was a better image and picture in the dark was better with just the 2 IRs it has.. Camera in question was AMC4KDM36-W and his camera is IP8M-2779EW-AI. So I thought I would mention it here as well..

First all 8MP cameras are not made equal. When it comes to the Analog camera it has a 1/1.8 sensor and the 2799EW-AI has a 1/2.8 sensor. Second the Analog camera has slightly closer in lens at 3.6mm where the IP camera has a 2.8mm lens so it is wider then the analog camera. Next issue is the analog camera has 2 high power IR leds and can see at distance it says of over 150feet with the IRs I don't personally think it is that good but still better then some of the 8mp IP cameras I have seen.. This IP camera is dual led with IR of 15m or just under 50 feet.. and does offer white led for color night images.. Sure the Analog camera can be setup to work in color as long as it has enough light in the cameras view to light the way..

So while he does still have his older 8mp DVR the 8m8 he never put any 8mp cameras on it before he upgraded to the 4108E-A2 NVR and bought a few POE IP cameras I told him before he upgraded that the DVRs can be just as good as NVRs.. Because of all the Hype of Ip cameras starting long ago saying that DVRs are the way of the past and to buy NVRs and IP cameras now seeing the 8mp camera on my 5108-E1 DVR he knows DVRs are still just as good in some cases as NVRs.. It all comes down to the type of camera you buy. Buy a cheap camera or lower cost camera anyway comes with its drawbacks..

Don't get me wrong the IP8M-2779EW-AI is a nice camera with the f1.4 it helps open the ability to see at night. Only down side is sensor size when you compare it to a higher dollar Ip camera in most cases you do really get what you paid for.. I mean a 400 8MP AI camera full color at night and with many options of AI and a great sensor and f1.0 there is no case against most 8MP analog cameras.. Even better yet and little less money.. the IP8M-T2883EW-AI in a turret camera will be hard to beat and with 1/1.2 sensor and f1.0 great night time camera as well as day time..

[sdDave]

Some Ip camera's embedded system on chip are not as good as some analog DVRs. That is why typically frame rates are better on IP cameras when you drop resolution. Some datasheets even say they have higher frame rates at lower resolutions.

[Revo2Maxx]

Not sure how that relates but there are a few things that come in to play when you drop the resolution on an Security Camera. In this topic it was related to a 8mp camera that was on a DVR that only support 7fps on a 8mp camera. His camera also 8 mp has high frame rate because it was built into the camera it self. The Analog camera can do higher frame rates but the current DVR it was installed on only supports 7fps. The issue was sensor size and f-stop. Ip camera had smaller sensor size and not as good as f-stop for the lens.

Higher frame rates require more processing power and bandwidth, so reducing the resolution balances the cameras resources allowing it to increase the frame rate..

Off topic, the other reply was removed but I tried to run that script and came back with an error
SyntaxError: Missing parentheses in call to 'print'

[sdDave]

Not sure how that relates but there are a few things that come in to play when you drop the resolution on an Security Camera. In this topic it was related to a 8mp camera that was on a DVR that only support 7fps on a 8mp camera. His camera also 8 mp has high frame rate because it was built into the camera it self. The Analog camera can do higher frame rates but the current DVR it was installed on only supports 7fps. The issue was sensor size and f-stop. Ip camera had smaller sensor size and not as good as f-stop for the lens.

Higher frame rates require more processing power and bandwidth, so reducing the resolution balances the cameras resources allowing it to increase the frame rate..

Off topic, the other reply was removed but I tried to run that script and came back with an error
SyntaxError: Missing parentheses in call to 'print'

I agree, the lense technology does make a difference.

lol, I must have missed a character in the python code. I'll have to look up the exploit test online instead of trying to write one on the fly.

[Revo2Maxx]

Anyway rewrote the script to work with python3 and after running it the camera returned Failed to receive the challenge and this means that it in fact is safe from that type of trolling..

I have spent a long time messing with different scripts and tested on all devices that I own and so far everything comes back that my devices are secure from all the different pen testing I have done on them.

Trust me if there was something I would have found I would have reported it to Amcrest for review and repair.. I have pointed out a few different things that I have found as something I call a Flaw.

[Revo2Maxx]

rewrote it again so I could see the data in and out. Done other testing in the past it and failed. Only cameras that did anything besides failing and was a while ago so would have to dig them out and try again, Was some older JUNK brand with good outdoor housings. I bought them for the housings so I could change some indoor cameras to outdoor use.. Either they would reject the injection or the device will reboot. Even an old Dahua with very old FW on it rejects it and reboots.

ScreenshotToday.png (32.24 KiB) Viewed 6269 times

[Revo2Maxx]

@sdDave So I rewrote the scrip again, While most of it is same code I added in a few different things that I thought might change. I have tested this on older and newer Amcrest cameras and all with mostly the same results. Because I wasn't getting any debug info back I added in different ways to data to be returned. Because I don't want someone to decode this I did cross out some of the info as before..

Also wanted to clear something up that others keep saying, that isn't true. I said it was not true before, However here is proof that it isn't true. Even trying to access the Port37777 it has been stated that you won't get locked out well here is proof that you will

first part here is from normal running with correct password.

[+] Attempting connection to 10.0.0.237:37777
[+] Connected!
Received empty challenge
Header: b'\xb0\x00\x00x\x00\x00\x00\x00\x01\x00\x01\x003\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\xf1\x00\x00\x00\x00\x02'

picture is being locked out of the camera..

Screenshot from 2024-10-13 01-16-54.png (74.46 KiB) Viewed 6195 times

[Revo2Maxx]

Also wrote a few other scripts that I have used on some other camera that I won't buy or use lol. When trying to run the script on my Amcrest cameras I get locked out, Running on Dahua cameras I get data back on a couple of them with errors in the scripts on the camera. Not all of them. Some are locked out even when using the right passwords others give back errors. These types are different and have some extras installed in my Linux machine for running them and even that isn't enough to gain access..

Detailed Information
Time:2024-10-13 01:11:14
User Name:admin
Type:Event Occur
Content:
Address: 10.0.0.22
Channel NO.: 1
Event Type: Illegal Access
Type: Protocal Configuration
Username: admin

So while so many people trash Amcrest and Dahua along with some others that are within the same line. All the cameras I have tested seem to be secure and is one reason that I have in the past tested out a Direct connection to the internet. I don't do it for long most times under a month and I keep track of all traffic while doing so.

What is funny is even though that lock out was shown after running the script it did say that the lock out time was 0 and I was able to log in using my Browser. The other script I ran did lock me out for 300 seconds. AKA 5min for those following along..

[Revo2Maxx]

Just so you don't think I can't get something to return lol. Here is a script that I ran on one of my Amcrest 8mp and 2 of my Dahua 4mp cameras. So I know I have the ability to talk with them and get data returned. I have tried some Brute Force attacks on my devices as well as I have said before all getting locked out before anything came up. I will admit that watching someone that the IP address came back from a IP that is well known for offering a Free VPN tried to crack my password for 2 days straight before I got tired of watching them. I know it was VPN because the method they used returned less then 4 min after I banned the IP in my firewall from another IP same provider. Setting up the script to try 1 login every 30min is something that someone would use to try and keep the alarms from going off. Seeing I use a couple different formats of logging and one of them is setup to alert me when an IP used is from outside of my LAN..

revo2maxx@Rmaxxi7:~/Desktop$ python3 Amcrest_test.py -i 10.0.0.237 -u admin --password passwordremoved
Connected to camera at 10.0.0.237
Device Information:
Manufacturer: Amcrest
Model: IP8M-TD2685E-AI
Firmware Version: 2.800.00AC001.0.R, Build Date 2022-07-15
Serial Number: AMC089EDXXXXXXXXXX
Hardware ID: 1.00
revo2maxx@Rmaxxi7:~/Desktop$ python3 Amcrest_test.py -i 10.0.0.236 -u admin --password passwordremoved
Connected to camera at 10.0.0.236
Device Information:
Manufacturer: Dahua
Model: N45EFN2
Firmware Version: 2.840.0000000.18.R, Build Date 2022-06-29
Serial Number: 7L012XXXXXXXXXX
Hardware ID: 1.00
revo2maxx@Rmaxxi7:~/Desktop$ python3 Amcrest_test.py -i 10.0.0.36 -u admin --password passwordremoved
Connected to camera at 10.0.0.36
Device Information:
Manufacturer: Dahua
Model: N43AN52
Firmware Version: 2.800.0000000.43.R, Build Date 2023-08-29
Serial Number: 7E034XXXXXXXXXX
Hardware ID: 1.00

[sdDave]

So while so many people trash Amcrest and Dahua along with some others that are within the same line. All the cameras I have tested seem to be secure and is one reason that I have in the past tested out a Direct connection to the internet. I don't do it for long most times under a month and I keep track of all traffic while doing so.

What is funny is even though that lock out was shown after running the script it did say that the lock out time was 0 and I was able to log in using my Browser. The other script I ran did lock me out for 300 seconds. AKA 5min for those following along..

Its the reason why a lot of them fail the security tests. Dahua/Amcrest (same manufacturer) have different bugs than others, but at least they try and make patches. The buffer attack is one they patched in most of their cameras. Hikvision has a few they never patched. The one camera I refuse to purchase is Vikylin cameras because they have been known to be taken over by hacking botnet to hack other sites. Their security flaw is the user input is not sanitized, so if you know the code injection for pearl/cgi you can bypass the web software in the camera and load your own program to attack other computers.

Amcrest's patch isn't perfect because the attacker disrupts operation. So did Epstein really hang himself? The world will never know because a hacker disrupted the security camera system.