AXIS OS Forensics Guide

The purpose of this guide is to help you conduct a forensic analysis and cleanup of an Axis network device in the event of a cyberattack on its associated network.

Specifically, we cover how to detect whether the device has been compromised, how to collect evidence, and how to restore the device to a clean and secure state.

This guide applies to all AXIS OS-based products running AXIS OS LTS or active track software.

In simplified terms, the forensic process consists of three steps:

1. Detection

2. Evidence collection

3. Cleanup

The first step is to detect any signs that an Axis network device has been affected by a cyberattack. Such signs are commonly referred to as indicators of compromise (IoC). Consult the table below for the most common IoCs related to Axis devices.

For information about how to detect IoCs, see Checklists.

If you have detected one or several IoCs on an Axis device, the next step is to collect evidence about the device’s current status. Avoid making any modifications to the device, such as turning it off or installing additional tools. Tampering with the device could destroy evidence.

For information on how to collect evidence about the device’s status, see Investigative tools.

The final step in the forensic process is to restore the device to a secure state. For Axis devices, the most efficient way to do this is to perform a factory default.

• For devices without signed OS and secure boot, you should download the latest supported AXIS OS version from axis.com and install it on the device after you perform a factory default. Make sure to monitor the device for some time afterwards before you reintroduce it into the operational system.

• For devices with signed OS and secure boot, a factory default returns them to a guaranteed non-compromised state.

Consult your device’s user manual for instructions about how to perform a factory default.

You can find more information about signed OS and secure boot at axis.com/solutions/edge-vault.

Use the web interface of your Axis device to review the device configuration whenever possible. Consult your device’s user manual for instructions about how to open the device’s web interface.

Visit the web interface to view the device server report. Server reports contain current and historical data about health monitoring, system information, configuration details, and log files.

You can also download a .zip file of the server report. This file contains all the data related to your device configuration and should be used as your primary resource for forensic investigation.

AXIS Server Report Viewer is a web-based, graphical user interface designed to facilitate the upload and visualization of server report data. Developed by Axis, this tool is the most efficient way to analyze server report data. To use AXIS Server Report Viewer, visit axisserverreportviewer.axis.com/about and log in with your MyAxis account.

If you suspect your Axis device may have been compromised, use the investigative tools to go through each of the checklists in this section. If you detect any indicators of compromise, proceed to collect evidence and clean the device.

• Analyze network traffic and login attempts to identify unauthorized network activity.

• Consider a factory reset as a last resort to clean the configuration, but be aware it might not remove all traces of malware.

You don’t need to verify software integrity for devices with signed OS and secure boot, as these features prevent compromised software installation. For more information about signed OS and secure boot, see axis.com/solutions/edge-vault.

1. Confirm the validity and integrity of certificates used for services like HTTPS, MQTT, IEEE802.1x, and remote syslog.

2. Verify that the correct client-server and CA certificates are uploaded on the Axis device. Note that several authorized and well-known CA certificates are pre-loaded on the Axis device.

3. Specifically inspect user-uploaded client-server and CA certificates and verify the accuracy of certificate details such as:

4. • common name

   • country

   • key encryption

   • time validation

1. Use the web interface to check whether it’s still possible to log in with the configured user accounts and associated passwords.

2. Verify that each user account still belongs to the correct access group.

3. Verify that no new accounts have been added.

4. Verify that Allow anonymous viewers is turned off.

• If you use remote syslog: Check the central monitoring system for user management configuration changes. For recommendations on how to configure remote syslog, see AXIS OS Hardening Guide.

• If you don’t use remote syslog: Download a server report and review logs using AXIS Server Report Viewer. Note that Axis devices may apply log rotation where old log files are deleted after some time.

In AXIS OS 10.9 and later, user configuration changes are saved in the system log, which means they can be sent to a remote syslog server. In AXIS OS, VAPIX, and ONVIF, user accounts are separated into their own management interfaces and access rights. Consult the table below for what log messages to expect in the event of user management configuration changes.

• Check which access protocols, such as HTTP(S) and RTSP, are enabled on the device.

• Check whether there are any unauthorized user accounts in the Axis device's web interface. If you find any, remove them and update authorized users' passwords.

• Trace any dubious IP addresses or user accounts across the network to determine their origin.

• Review both successful and unsuccessful login attempt logs in the Combined Logs section of AXIS Server Report Viewer or a central monitoring system. For examples of successful and unsuccessful login attempts, see the sample log messages below.

1. Requires that Access log has been enabled through Plain Config > System.
2. Only login attempts with the correct username are logged. These log messages only appear in devices with AXIS 10.4 and later versions.

1. Can be enabled through the device web interface. This will only log unsuccessful login attempts and IP addresses that have been blocked due to such attempts.

• Use AXIS Server Report Viewer to check whether any changes have been made to network protocols and ports.

• Note

  Familiarize yourself with common network protocols and ports used by the Axis device. Some protocols are pre-configured, while others depend on the device setup. For more information, see AXIS OS Knowledge base.

• Use AXIS Server Report Viewer to check whether the device is being accessed or has been accessed by any unknown or unauthorized IP addresses:

• • Connection list: Provides a simple overview of current active network connections from the Axis device to other network hosts.

  • Network connections: Provides more detailed information about current and previous network connections.

You can also obtain vital port configurations from the web interface of the Axis device, such as HTTP (80) and HTTPS (443), as well as UPnP (49152) and Bonjour (5353).

1. Examine the Network connections list in AXIS Server Report Viewer to identify any unfamiliar or unauthorized IP addresses connected to your Axis device.

2. Document and investigate unknown IP addresses to determine their presence and purpose within your network.

Review the current network access control settings on your device or your network infrastructure and verify that no changes have occurred.

Use Axis Server Report Viewer to review logs of unsuccessful network access attempts in Combined Logs and Kernel Logs. In the tables below, you can see examples of how failed network attempts are logged.

1. IP filtering in Axis devices is a network layer-2 Linux Kernel functionality that blocks network packages depending on the configured rules. No authentication will be performed if an unsuited source IP address is trying to access the Axis device, since the network transmission is blocked right at the layer-2 network while authentication is performed on higher level application layers. Corresponding logs of the IP filtering can be created when the VAPIX parameter is enabled in Plain Config > Network > IP Filtering.

1. PreventDosAttack can be enabled from Plain Config > System and will only log unsuccessful login attempts and correspondingly log when a source IP address is blocked.

The Axis device server report contains a list of video and audio streams delivered to network hosts. Caching Streams are the unique encoded video streams of an Axis device. Outgoing Streams shows which clients these video streams are delivered to. You can find out more in AXIS OS Knowledge base.

1. Cross-reference the list of IP addresses that are supposed to access the Axis device with the metrics from the Outgoing Streams section.

2. Identify and investigate unknown IP addresses that are accessing video and audio streams. Track them throughout the network to understand their purpose and whether they should have access to this data.

• Review login attempts using the Axis Server Report Viewer, focusing on the Combined Logs section, or through a central monitoring system if the Axis device is configured to stream its logs.

• Look for log messages indicating successful and unsuccessful login attempts related to HTTP(S) and RTSP protocols, which are used to deliver video and audio streams.

• Investigate suspicious IP addresses and/or users, tracking them throughout the network to understand the source of these requests.

• Check the Axis device's web interface for unknown user accounts and delete them. Consider changing the passwords of authorized user accounts as an added precaution.

For examples of log messages that indicate successful and unsuccessful login attempts, see the tables below.

RTSP protocol

HTTP(S) protocol

1. Requires that Access log has been enabled through the device web interface
2. Only login attempts using the correct username are logged.

Both the web interface and the server report of the Axis device can be used to verify installed applications and their current running status. To learn more about secure use of applications on your device, see AXIS OS Hardening Guide.