Hello everyone.
I'm running 2 web servers, one is running on my Arduino and another is running on and old android phone using the app "IP Webcam".
I have forwarded 2 ports to access these web servers, they are both HTTP servers.
How safe are they? As one of them is an IP Camera, should I be worried about being watched by someone else?!
What safety precausions have You taken?
Railroader:
What safety precausions have You taken?
The IP Webcam has a basic HTTP AUTH username and password.
Another web server on Arduino doesn't have any passwords yet but in example projects I saw these examples that I will take a closer look later:
HelloServerBearSSL
HelloServerSecure
HttpAdvancedAuth
HttpBasicAuth
HttpHashCredAuth
SimpleAuthentication
Unfortunately my information in networking, hosting, etc is so low so I don't have a clear understanding of these. And my biggest concern is about the IP Cam webserver on my old phone not the one on Arduino.
Good. You are aware of security questions. To be sure You are private, regarding the camera, throw a tovel over it! I'm joking. My skills end here, unfortunately. Hopefully more knowing helpers will finish their sleep and read Your post. Good luck!
Railroader:
Good. You are aware of security questions. To be sure You are private, regarding the camera, throw a tovel over it! I'm joking. My skills end here, unfortunately. Hopefully more knowing helpers will finish their sleep and read Your post. Good luck!
I think that's absolutely the best idea 
Thank you so much for your attention and replys. Have a nice time
How safe are they?
Wrong question, the correct question is 'how much at risk are they?'
As one of them is an IP Camera, should I be worried about being watched by someone else?!
Yes, but that's not all you should worry about.
You can be certain that out on the internet there are port scanners searching for ports that are forwarded to something interesting. Sooner or later they will find yours. You can also be sure that for any mass market device, such an an Android phone running web cam software, there will be people looking for security flaws to exploit. The issues is not just that they might be able to view your camera, the issue is that they might be able to get their own firmware on to the device and use it as a gateway into the rest of your network and whatever you have on it. Good passwords are a partial barrier to this, but not a complete one. The thing you cannot know is whether someone knows how to get past a good password and take control of the device. I have read of a security camera that could be forced in to factory reset by uploading a very large file to it. Once the factory reset was done it was possible to log in using the factory default credentials. Once that was done then the firmware could be changed, making it into a gateway into the rest of the network it was on. The only protection against this kind of thing is not to forward ports in the first place. I certainly would not use any of the low cost internet connected door cameras or any 'internet of things' device that accesses the public internet. These devices are an open invitation to hackers and the more popular they are the more incentive there is for someone to find and exploit security flaws. I guess you could use a decent router and create a separate subnet for the internet connected devices, which would give some protection from access to the rest of your network.
If you build your own devices that offers some protection as the software will be your own design and, while it will have security flaws, the security flaws will most likely be unique and of little interest to a hacker. The problem with that approach is you will most likely use publicly available libraries, which will have security flaws and which someone might be trying to exploit. The way round that, of course, is to write your own code down to the level of driving the hardware.
Something I am thinking of trying, but never get around to, is setting up a simple web page with a username and password that don't actually go anywhere and just count the attempts at logging in.
I have a simple rule. If I want to keep something private I don't put it on the internet.
...R
PerryBebbington:
Something I am thinking of trying, but never get around to, is setting up a simple web page with a username and password that don't actually go anywhere and just count the attempts at logging in.
Called a "honeypot". 
I used to look at my Apache logs and most of the random interactions from the internet were from various forms of site scraping bots like google. If you want your servers accessible from the internet so you can connect to them, then keep them private. If you want to show it off to the outside world, then that is something you did. A hacker would probably care less about an arduino or cell phone, but the hacker might be interested in what else is inside your network that might be of interest. Posting public stuff can be done on off site web services if needed.
PerryBebbington:
Wrong question, the correct question is 'how much at risk are they?'
Yes, but that's not all you should worry about.
Robin2:
I have a simple rule. If I want to keep something private I don't put it on the internet....R
Thank you so much for your reply, Now I BELIEVED that unfortunately Internet is not as safe as I like -_-
zoomkat:
I used to look at my Apache logs and most of the random interactions from the internet were from various forms of site scraping bots like google. If you want your servers accessible from the internet so you can connect to them, then keep them private. If you want to show it off to the outside world, then that is something you did. A hacker would probably care less about an arduino or cell phone, but the hacker might be interested in what else is inside your network that might be of interest. Posting public stuff can be done on off site web services if needed.
Well, If I don't show it off, will I be at lower risk? I have dynamic IP adress and I use Noip website and have a dedicated DNS address which updates every 30 mins.
I thought there are some people just checking ports on random IPs, but if I don't show it to anyone and try not to give my IP to anyone, I will be at lower risk of getting hacked?
I was thinking of running these 2 web servers 24/7 but as I noticed it won't be secure enough, what about running them for 2 days a week, with a dynamic IP, and not telling anyone about it?
I thought there are some people just checking ports on random IPs, but if I don't show it to anyone and try not to give my IP to anyone, I will be at lower risk of getting hacked?
People all over the world use port scanners looking for things they think are interesting. If you have ports forwarded to interesting things someone will find them. Telling or not telling people what you have counts for nothing. Of course, what counts as 'interesting' is also unknown, who knows what interests these people? As for being at 'lower risk' define 'risk', define 'lower' and define the level of risk you think is acceptable.
Robin's advice is best. I have a variation on the same theme, which is that I assume that everything I put on the internet will be seen by anyone and everyone everywhere.
What about running them for 2 days a week?
2 people I have the greatest respect for with regards to their knowledge of computers, servers, internet security and all that stuff set up a server between them. They did it on a Friday. For some reason, despite their combined knowledge, they left it with a weak password. By Monday someone had put malware on the server and stopped the owner from using it. Luckily, one of the two liked a challenge and by the end of the day had removed all the malware and restored all the file and got the server working. He left it with a very strong password.
Robin2:
I have a simple rule. If I want to keep something private I don't put it on the internet....R
I more than fully agree with You!
erfan_m14:
I think that's absolutely the best idea
Thank you so much for your attention and replys. Have a nice time
Thanks! I wish the same for You.
Presumably one way of ensuring security is to run the webserver in complete isolation from all your other PCs. Then if someone hacks into it nothing else gets damaged.
...R
"I thought there are some people just checking ports on random IPs, but if I don't show it to anyone and try not to give my IP to anyone, I will be at lower risk of getting hacked?"
Not showing it to anyone should reduce the probability that someone might sniff your IP address, but would not be protection from systematic IP address pinging looking for a response. A serious hacker would probably be interested in taking control of a computer on your network and use it for a DOS bot and similar. The wanna-be hacker is probably just interested your IP cam and similar. Passwords are effective as they will block the typical passerby. They might try "admin" and "password", and then move on when those don't work.
PerryBebbington:
Wrong question, the correct question is 'how much at risk are they?'
Yes, but that's not all you should worry about.
You’re right, now I actually believed that internet is not as safe as I like, at least until I have enough knowledge to make it somehow safe for myself.
Robin2:
Presumably one way of ensuring security is to run the webserver in complete isolation from all your other PCs. Then if someone hacks into it nothing else gets damaged....R
Good idea. Maybe it can be done by using another router right? But can I somewhat isolate these devices by creating a “subnet” in my router settings? Or what about creating another wlan network as my router can have up to 4 separate WiFi networks like most routers. Does any of these 2 ideas have any affect that lowers the risk?
zoomkat:
Not showing it to anyone should reduce the probability that someone might sniff your IP address, but would not be protection from systematic IP address pinging looking for a response. A serious hacker would probably be interested in taking control of a computer on your network and use it for a DOS bot and similar. The wanna-be hacker is probably just interested your IP cam and similar. Passwords are effective as they will block the typical passerby. They might try "admin" and "password", and then move on when those don't work.
Sounds interesting to me, thank you for this information.
Every time I decide to give up on putting my web servers on the internet, I find a new idea which may help me a bit.
Now I’m thinking for a way to open the ports only when I need to access them, and how to open the ports when I don’t have any access to my router, well I was thinking about creating a macro on my android phone which is always in my home and connected to my router and the macro would go to the port forwarding page in my router settings and enable the forwarded port, and again when I don’t need them, disable the ports. Or maybe by running a JavaScript on my phone, for example when I send sms to my phone, “open” it runs a script which enables the forwarded ports and when I send another sms “disable”, it disables the ports.
Can anyone help me with this or I’d better to post my question in an android forum? Please tell me if there is a good way to do this or suggest me a good android forum.
Here is a photo of my router settings, I mean I want somehow click on the “enable” buttons.
Good idea. Maybe it can be done by using another router right? But can I somewhat isolate these devices by creating a "subnet" in my router settings
No, not another router, you can't put 2 routers on one broadband connection.
You create a separate subnet, which you physically present on its own port on the router. You make sure that the router configuration is not accessible from the separate sub net.