Note: Updates to this review have been moved to the end.
Overall this is a good camera for the price point with one glaring flaw:
The camera ALWAYS attempts to make an outbound connection to a server in China (IP: 58.61.155.158). There is no way to disable this "feature". When I contacted Loftek support, here was the reply:
-------
Thanks for your message and suport on our product. Please don't worry , 58.61.155.158 is our server ip address . All of our camera ,if you ping its DDNS ,it will resolve to 58.61.155.158 . It is set up for your remote view. It is safe and have no influence to your network. If you still wanna disable it . please close the port forwarding for your camera and disable UPNP in your router. Thanks.
Any question , feel free to let me know.
Thanks for your time.
Best Regards.
-------
So what they suggest is that I modify my firewall to fix a problem in their product. I have suggested that they change the firmware to make this an option that is turned off by default.
Note: Given the way the firmware is designed you can't turn off this feature. It would be easy to make this an "option" so the customer could disable it. The camera will ALWAYS attempt to make an outbound connection to the server mentioned above every time it is turned on. Don't know about you but I am not comfortable with a server in China knowing the externally visible IP address of my camera.
Update (28 November 2011): I have received numerous emails from Loftek asking me to "Fix" my review. I have asked them to stop emailing me with these requests, yet they persist. My review is not broken or inaccurate in any way. The emails claim that they have a way to remove the "hard coded" DDNS server address and to prevent the camera from making an unauthorized outbound connection to their DDNS server. Yet they have not provided me with the information as to "how" to accomplish this. I will continue to update this review. Should they actually provide a way to disable this outbound connection from within their product, I will update this review with that information.
Update (30 November 2011): Last night I received another email from Loftek support. Rather than ranting I will post the email and my response below. At this point I feel I have given Loftek every opportunity to fix the security flaw - to no avail. I have purchased another (non-Loftek) camera. I will post my review once it arrives and I have a chance to test it. Here is the email and response:
-------
>Dear Terrence R. Bayne,
>Thanks for your message. As for your problem , we can delete the DDNS compeletly from your camera. Would you mind tell me if your camera >available for remote view now ? if it is ok , please sent me a Administrator account and password, so that our tech can access your camera >to destroy the DDNS. Please advise.
-- My response --
Let me be sure I understand what you are asking....
1. You want me to provide admin access to a device inside my firewall.
2. You want me to do this so your technician can modify my camera to
remove the DDNS information.
Is this correct?
If so my answer is "No". You will not get access to ANYTHING inside
my firewall. Not even temporarily.
This request clearly shows that you folks really don't have any idea
about network security, or security in general.
Why is it you won't provide the information so I can disable this
functionality myself? Obviously there is a way to do it, so provide
the information to the public so everyone can benefit (and can vet the
process as well).
Note that I will be adding portions of this email conversation to the
review on Amazon.
If you are NOT willing to provide the information on how to disable
the DDNS within the camera DO NOT CONTACT me further.
-------
Update (01 December 2011): Another round of emails with Loftek support. This shows how truly clueless they are. They seem to think it's ok to access a device inside my firewall (they assumed that I thought they wanted to access my PC and that I shouldn't be upset that they want to access the camera). And they feel that the "fix" is some sort of a trade secret. Here is their email and my reply:
Dear Terrence R. Bayne'
Thanks for your message. Acctually we just wanna access your camera not your PC. So sorry we can't offer the information to you to delete the DDNS because it involve our product brand. Hope you can understand. Anyway , if it is not available for us access your camera , we can sent you a replcement camera without given ddns.
Thanks for your time.
Best Regards
My Reply:
Good Morning,
Really? The automatic DDNS entry is some sort of "trade secret"? And
the method for removing it is also secret? Really? Wow, I think you
folks need a few lessons in computer security.
Finally, I am fully aware that you wanted to access the camera, not my
PC. You are aware that ANY device behind a firewall that has a CPU
and network access (and yes the camera has a CPU and network access)
is a potential security hole? Giving you access to ANY device inside
my firewall is an unreasonable request. Just so we are clear, the
camera is a device inside my firewall.
A few points:
1. Security through obscurity doesn't work - this means that hiding
your flaws/weaknesses doesn't make them disappear.
2. Providing customers with a way to fix a security hole in YOUR
product is just good business.
3. No customer who is concerned about network security is going to
give you access to a device inside their firewall. This is NOT a
reasonable request.
4. Your companies resistance to doing the right thing (in this case
the right thing is to admit to the fault, and provide existing
customers with a way to fix it) is becoming harder and harder to
understand. You have read the comments to my review from other
customers on Amazon right?
It is obvious that you have no intention of really fixing the issue,
or providing existing customers with a way of securing their own
cameras. This is a shame really, because other than this one serious
flaw, yours is a nice product. I am guessing that the reason you
don't provide a fix is that you don't have anyone in the company
qualified to update the camera's firmware to remove the issue. It is
unfortunate you have taken this stance on what is a simple firmware
issue. Your sales on Amazon for this product will likely fall, not
just because of the security issue with your camera, but because of
the way you have tried to handle the issue:
1. Denying it is an issue
2. Telling me not to worry, that I can trust you and your server.
3. Wanting access inside my firewall to provide me with a fix.
None of these inspire confidence with your company or your brand. And
I am guessing other potential buyers will feel the same.
Because sending me a "fixed" product doesn't fix the security issue
for potential customers, the review on Amazon will stay the way it is.
If you want to send me a camera, with the automatic DDNS connection
disabled, I am ok with that since it solves my issue. Once the new
camera arrives I will gladly send the other one back to any US address
you specify (note that I am unwilling to pay for shipping outside the
US).
-------------------------------------------------------------------------
Update (December 14 2011):
On the 1st of December Loftek offered to send me a camera with the outbound hardcoded DDNS
connection disabled. Two weeks later I have not received the replacement camera, nor have I
heard back from Loftek.
I guess they didn't like the fact that I wouldn't change my review until they make the "fix"
available for all customers.