Dropbox-resistant wired IP camera system

Move the camera.

No, really: if the location you want to put the camera isn't acceptable from a security standpoint, move the camera to one that is - possibly with an additional camera to maintain the desired coverage.

Select a location (or set of locations) where the cable can run inside for the entire run. This often means putting the camera directly on the eaves, with the cable running through the attic and through the wall there.

If you're worried about Mallory getting into the house - or to the base of the camera - to tamper with the network, well, surely Mallory has better things to do once they've gotten into your house, right?

Beyond that:

• Choose cameras that encrypt the feed data in flight, such that Mallory's dropbox can't see the feed.
• Choose a camera system that works by having the cameras' controlling software establish the network connections to the camera (rather than the cameras trying to connect to the server): in conjunction with a managed switch, that lets you limit - if not prevent entirely - the ability of devices on that port to establish network connections.
• With a managed switch, prevent any devices on that port from communicating with any devices other than the camera system's control server. Even if you can't pick cameras that encrypt the video feed in flight, that at least reduces the feed data that Mallory can see to a view that's outside - ie., somewhere where Mallory might be able to put a camera of their own - while still blocking any internal feeds.
• Use fiber instead of copper to wire the camera to the network. While this doesn't wholly prevent dropboxes, it does meaningfully raise the bar to splicing the cable to install the box.

As with any security question, one must determine what they're actually defending against, and how much risk they're willing to accept.

These are the issues I'd consider, in (gut-feeling) order of their likelihood of being exploited. A bad actor might:

1. Disable the camera entirely, whether by cutting its power supply and/or data connection, or physically destroying the camera or otherwise rendering it inoperable (eg paint over the lens).
2. Tap in to the ethernet line in order to gain internet access.
3. Tap in to the ethernet line in order to gain LAN access.
4. Tap in to the ethernet line in order to reconfigure it and/or view the video feed.
5. MITM the camera in order to alter the video stream (eg the "replace live video with a recorded loop" trick).

#1 is an almost entirely a physical security problem. Long runs of outdoor conduit offer more opportunity for someone to find a place to discreetly cut the line. If the camera is to be mounted on the side of your building, I'd ensure that the wires to the camera go in to the wall as close as possible to the camera itself, which itself might be placed in a tamper-resistant enclosure. Otherwise, look to reduce the amount of wiring exposed in places that are easy-to-access and/or hard-to-notice when compromised.

I'd also look to have multiple cameras covering a given area such that someone cannot tamper with one camera without being seen by another.

The only technical thing to do here is to set up alerting so that you're notified as soon as a camera goes offline or black.

The rest are technical problems. Treat the camera port as untrusted. This means using a managed (ie higher-end) switch to isolate the ethernet line that goes outside from the rest of your network. It should have no route to the internet (solving #2) and only allow traffic to your NVR server (solving #3). The details will depend on your exact setup, but this can be accomplished with VLANs per-camera and/or firewall rules. I wouldn't even have DHCP available, and configure IP statically.

Problem #4 is unlikely in this scenario. Viewing the feed of a camera pointed at the street isn't particularly useful. Reconfiguring the camera in order to disable it might be a risk, but it's far simpler to just cut the line instead of tapping it and trying to attack digitally. I'd ensure that the camera admin UI has a strong password, keep the firmware updated (to avoid software vulnerabilities), and if paranoid, investigate whether the stream between the camera and NVR can be encrypted.

Problem #5 is extraordinarily unlikely unless you're housing art worth millions (or whatever) and have to worry about professionals. It would take a pretty extreme level of sophistication to physically tap your ethernet line, devise an attack against the video stream, and execute the attack without you noticing.

But if I was ultra-paranoid about my Picasso, I'd:

• Want mutual authentication between the camera and NVR. I'd find (or build) an IP camera that transmits everything over a WireGuard VPN, and has everything else firewalled off.
• At the switch, lock down the camera's ethernet port to allow only WireGuard traffic between the camera and the VPN endpoint (which may be the NVR itself or a separate server).
• Set up alerting for both the camera feed on the NVR, and on the network level for unusual activity: eg if the switch detects that the ethernet was unplugged, or especially if there's any traffic that's not from your camera.

With this in place, even if someone taps the camera's ethernet line:

• They can't access anything else (internet or LAN) because the switch will drop the traffic (#2 and #3).
• They can't reconfigure the camera because it won't respond to any traffic sent directly to it (which also significantly reduces the firmware vulnerability attack surface), and they can't view the stream because it's encrypted; sniffing packets will only reveal UDP packets that are indistinguishable from random data. (#4)
• They can't alter the stream (#5) because WireGuard is encrypted and mutually authenticated with key pairs known only to the camera and the NVR. Attempting to MITM the camera and NVR simply won't work; the attacker can't pretend to be either the camera or the NVR to the other device.
• Alerting will warn you if someone has attempted to tamper with the camera.

…but again, as a practical matter, this is all overkill for an average residential setting. Simply locking down the ethernet port for the line that goes outside solves your concerns almost entirely.

If you're worried about someone getting into your home network, there's an option to not expose your ethernet or IP network onto untrusted wires.

The solution is to attach a USB camera (or over a similar non-network cable) to a machine that runs at a secure location. This way even if Mallory cuts the wires, they'll only be able to install another USB device, which you can easily configure the OS to reject.

As with any network that might be physically accessed by untrusted individuals, there are a few options:

• Place the untrusted device behind a DMZ that prevents traffic flow to unauthorised network segments (like the other cameras) and only allows traffic from the camera to the recording server
• Network Access Control that only allows authenticated devices on the network (this should block the dropbox or a switch)

You wanted technical suggestions only, but I would be remiss if I did not suggest this:

• Physical intrusion detection measures that would alert you to the fact that the conduit was damaged/accessed (conduits that shatter when cut, light sensors in the conduit, etc.)
• A camera covering this one untrusted camera location to detect interaction with it

But it sounds like the cheapest, straightforward approach (assuming your concern is just this one physical location):

• Use wifi for this one camera and place it in its own segmented network and ensure authenticated wifi protocols are used.

You say that wifi is not secure, but it is more secure if you can't restrict access to the physical cable.

Use a multi-layered approach.

For example, higher-end switches support Private VLANs which allow traffic to a single uplink but not between private ports. In your case, you want the IP cameras to deliver their video data to a firewall-protected network video recorder (NVR) but not be able to communicate with any other host (including each other). The firewall should ensure that no host behind a camera port can pull video data from the NVR.

The NVR should require authentication for any kind of access and ideally have different roles for sending and receiving video data. If possible, use end-to-end encryption between the cameras and the NVR. The cameras themselves should also be password-protected, so that an attacker cannot simply read the NVR credentials from a configuration UI of the camera.

Not a complete recipe, but a few suggestions:

1. Use POE powered cameras. This limits the variety of dropboxes an attacker can use.

2. Use a POE power source that can measure the power consumption of the camera and can be scripted to alert about the changes. The dropbox has to be powered somehow and hiding it in the camera power variations is quite a high spec.

3. Segment the network even more so that each camera runs in its own segment and only legitimate connections between the camera and the nvr are allowed.

Devices that can do both 2 and 3 are quite affordable these days, see e.g. Mikrotik.

4. Use NVR and cameras that can use encryption and mutual authentication. Well, it is 2026 so most of them probably can, but be sure to enable both.

The wireguard suggestion in one of the answers is about the same idea but may be an overkill, depending on how much IT capable you are.

The other suggestion to use a wifi camera boils down to the same - encryption and mutual authentication between the camera and the access point, assuming that the connection between the access point and the NVR can be secured by other means. Modern wifi protocols are quite secure, but the reliability of the connection is still a consideration - wifi can be remotely jammed, cables are safe in this regard.

5. Be sure to use NVR and cameras that can work acceptably without a cloud connection and that the optional cloud connection is disabled for good. After all, most CCTV leaks happen from the camera vendor cloud or directly from a remotely accessible cameras.

With all of the above, the worst an attacker with a dropbox can do is to remotely disable your camera - assuming that the dropbox is self-powered somehow, capable of POE passtru and has a separate control channel.