Network scan found a security camera

[u/Bravsma]

I had my weekly Avast network scan today and it detected a new security camera. I live just one other person (family member) who I have a strained relationship with.

I have tried accessing the IP address of the camera directly but it shows a grey screen. MAC address shown in apparently one of those randomised ones.

Pictures attached to these post to show what I have described above.

How do I find out the location of the camera or what it is streaming/capturing?

Thanks in advance.

[u/SpagNMeatball]

It is very unlikely that a camera would use a randomized MAC, the tool is probably just guessing. SNMP Does show as an available service, try an SNMPwalk tool to get more info.

[u/Muppetz3 → u/SpagNMeatball]

Do you have a media server or anything in the network? The random Mac is weird. You can try blocking it and see if anyone says anything

[u/ReceptiveBedtime → u/SpagNMeatball]

snmpwalk might timeout if it's got default creds disabled, but worth a shot before assuming it's a dead end yk.

[u/PriceyLigament]

Try blocking the IP on your router and see if your family member complains. That'll confirm if they put it there or if it's something else entirely.

[u/LupercaniusAB → u/PriceyLigament]

Wouldn’t they just get around that by renewing the DHCP lease and getting a new local IP?

[u/Dmelvin → u/LupercaniusAB]

Unless the MAC address changes, the DHCP server is going to keep giving the device the same IP address unless it's offline long enough that the DHCP timer expires.

[u/LupercaniusAB → u/Dmelvin]

Oh yeah, thank you.

[u/IUsedToLikeLimericks]

It's a Huawei product.  Phone I'd guess. 

[u/spitfireonly]

Snmp walk that bitch. See what you get. Some times the mac address OUI can be misleading. And also scan all ports on that IP using nmap.
See if you get any regular rtsp streams etc.

[u/Wonderful_Tap_6991]

from cmd/terminal:

telnet 192.168.0.198 80

GET / HTTP/1.1 <enter>
Host: <enter>

<enter><enter>

hit ENTER twice afeter type .

It should give you some information, such as the web server version.

Or press F12 in your browser and look for the headers in the HTTP response.

[u/Living_Fig_6386]

Does someone in the household (or a recent visitor have an Android phone, tablet, laptop, or tablet made by Huawei (or Honor)?

[u/Bravsma]

Thanks everyone. I can confirm no Huawei phones or products in the household (at least none that I am aware of). 

I will try all your suggestions and let you know what I find.

[u/icehot54321 → u/Bravsma]

I don't know that you can know it's a security camera .. but who knows.

I would find some tools to try and man in the middle the connection via arp spoofing and try and see what it is doing .. or just block it / change your password, etc.

[u/MemeLordAscendant]

Ping it rapidly and use a deep metal pot around the router. It should give you a direction to go in.

[u/GeneralM1 → u/MemeLordAscendant]

What?

[u/vequalsir_]

Does anyone in the household use a managed laptop from work? Mine identifies as a camera. This is because of the security software on the computer. ZScaler might be culprit.

[u/wallly58]

Do you have a wife or husband trying to catch you up?

[u/bobdvb]

Given it says unknown name and unknown model, plus it hasn't shown you an ONVIF port, I don't think it's certain that it is a camera.

Avast is probably presuming it's a camera based on the MAC prefix. If the MAC is changing randomly then it could be that MAC prefix isn't relevant to the device.

90% this is another users phone or laptop which is set to randomise it's MAC.

[u/W1SPY_WITH_A_ONE]

Walk around with an RF scanning tool.

[u/bustedghost]

I'd see if I can view get to the image:

Run VLC

Media > Open Network Stream

rtsp://192.168.0.198/

Play

[u/hyunjunaka0228]

I recommend you to scan all ports of that camera using NMAP in order to check whether there is a way to see where it is installed.

[u/Acrobatic_Fee7057]

Wireshark yo

[u/IntentionQuirky9957 → u/[deleted]]

"Local network" isn't a physical measure, it's a logical one.