IP Camera Passwords - Axis, Dahua, Samsung

Published Oct 15, 2014 04:00 AM

IP cameras are famous / infamous for weak default passwords that can lead to major problems. See our IP Cameras Default Passwords Directory for examples.

However, in the last few years that is starting to change.

In this note, we look at password procedures for Axis, Dahua and Samsung, explaining why and which are strong, moderate or weak.

Strong: *******

** ***** **** ****** ******** *******, Samsung *** **** *** ****** ** improve ******** ********:

  • *****, ***** **** ****** * ******** when *** ****** ** ***** ****** or ******** ** ** ******* *********. There ** ** ******* ********.
  • ******, *** ***** ******** **** ** at ***** * ********** *** ****** two ******* *****, ** **** ** the ***** *****. ***** ***** ** not ***** *******'* ******* ******* ******** ("4321") ** ** ****.

********* **** ***** *** **** ***** rules ******* *** **** *** ***** password ********* ** ********, *** **** is *** **** ****** **** ****** defaulting ** "****."

Moderate: ****

**** ******* *** ***** *** **** to ****** * ******** **** ***** login. *******, "****" ** ***** ********, and ***** ********* ** * ******* password, **** ***** **** ** ******* to *** ****** ****** *** ******** creation ***** ** ********. **** ***** it **** ****** **** **** ***** simply ***** "****" ******* *******, *** do *** ****** ** *****.

Bosch: ********

******** ** *.** ********, ***** ******* users ** *** * ********, **** this ***** ********* **** ********** ** the ******'* *** *********. **** **** no ******** ** *** ** ******* and **** ** ********, ****** ******* or *********, ***** ***** ***** ** set ***.

******** ** ***** ***** ** *** password ***** ****, **** * ***** showing ******** "********." **** **** *** password ** **** ******* *** * characters **** *** ******** ********* *** lowercase *******, *******, *** * ******* character, *** *** ***** **** ******** as "******." ****** ********* ******* ** characters *** * *** ** ***** types.

****:***** (*** *********)

************ ******* ** *****/*****, **** ******** in ******, *** ************* *** ** all ******** ***** ** *******. ** previous ********, ***** ******* (*** ****) included *** ******** ***** ***** *** be *******, *****  ****** (**** ***** ******) *** ****** (view ****). *******, ** ***** ******** (Q2/Q3 ****), ***** ******** ** ****** exist, **** ***** *** **** ******* by *******.

***** **** *** **** ***** ** change *** ******** ****** *** ***** login, *** ******** ******** ******** ***************, seen *****. *******, ********* *** **** contain ******* *** ********, ** ******* characters, ******* ***** ** ******** ****** to ****** * ****** ********.

************, ***** ******* **** ** ****** ** notify ***** ** ******** ****** ***** attempts *** ****, **** *****. **** is ******** ** ** *******, **** very *** ****** ** ******** ********. This ** ***** ******** **** ******** against ******** ******, ******** ********* ** not **** *** ******* *********.


******

*** **** ******** ** ************* ***** use ******* ********* ******* ******* ***** to ****** **** ** *****, *** none **** ** **** **** ******* ******* rules ** ******* ****. *** **** common *********** ******* *****/*****.

***** *** **** * *** ******** of ************ *** *********** ** ******** security **'** **** ** *** ****** tests. *******, **** **** ** *** others ** *** ******** *****.

****

**** ** ***** ******** ***** ******* ******* ********* *********, ****** **% ** ***** **** **** at ***** ********* *** ******* ********* in * ********** **********:

**** **** ** ****, **** ** you ***** ************* ****** ** (** anything) ** **** ** ****** ********* more ******?

Comments (19)
JH
John Honovich
Oct 15, 2014
IPVM

Regarding Dahua's 6 and 8 passwords, those numbers are considered especially lucky in Chinese. It's a lucky password....

(1)
Avatar
Ethan Ace
Oct 15, 2014

I'll be sure to let the Costco and Sam's Club crowd know that.

(1)
Avatar
Ethan Ace
Oct 15, 2014

Just as an addendum here, I added one point to Dahua: they do allow for notification if someone attempts to login in one or more times with the wrong password:

That's moderately useful for basic intrusion detection (assuming you've changed the passwords from default, and intruders do not have them), and not a common feature in cameras.

PC
Paul Covey
Oct 16, 2014

I do not agree with Samsung's complex rules for passwords. I understand the concept of creating a difficult to hack pass word but having to create a complex, hard to remember additional password for Samung is somewhat of a problem.

I agree more with the track taken by Axis, forcing users to create a password but letting you set your own desired level of complexity. Cameras do not store credit card numbers or other financial data which must be protected. The worst thing that can happen is that a hacker would change your camera settings.

You cannot pay most people to simply view surviellance video, so why would a hacker want to just log in and look at the live view ?

The level of complexity should be in line with the value of what you are protecting.

I am aware of the problems with some inexpensivee systems which have default passwords and I agree that all systems should require a new password with initial login to protect the unwary. But Samsung goes overboard requiring a level of difficulty which is not warranted by the downside to someone hacking your password. By the way, why on earth would a hacker put in the effort to crack even a simple password to gain access to a video camera ? If you feel your video is so valuable to need high level of protection then you should be able to implement it but is should not be required.

I have used Samsung cameras and found the password a real pain since all my other cameras used something simpler.

(4)
Avatar
Ethan Ace
Oct 16, 2014

On the flip side, though, look at it from a manufacturer's perspective: There are sites out there dedicated to showing open IP cameras on the internet, and a search engine that lets you easily find them.

If there is even a small chance that an unskilled user will drop one of these in a private area and leave it open to the internet (and that's a realistic scenario), there's also a chance someone will find it and view it. The fallout from these events can be a PR nightmare and a waste of resources. Forcing users to create a password and not using a default one can likely avoid the vast majority of these issues, as most won't go through the trouble of hacking it. They'll just try passwords and when they fail, move on to the next sucker.

Even in typical commercial install scenarios, why is having a complex admin password necessarily a bad thing? How often do users need to access the camera via that password? It seems like as long as it's documented, it should not be a problem.

JH
John Honovich
Oct 16, 2014
IPVM

All IPVM Samsung camera's passwords are now "dereK1scool!"

To play devil's advocate, sure, assuming its documented and assuming one can instantly get to that document, which is often not the case.

Rv
Rogier van der Heide
Oct 17, 2014

Forcing people to create their own password on a device is good. There are far too many 'open' devices on the internet because people couldn't bother to change the password.

I once hijacked a printer at my old school because they couldn't be bothered to change the default password.

However, telling me that my standard password isn't up to their standards, is just nonesense. I already hate those damn websites who tell you how your password should look like with all those capitols/symbols etc. Let me choose my own level of protection!

Also, obligatory XKCD

(2)
(1)
HL
Horace Lasell
Oct 17, 2014

Foscam has a 12-character limit which precludes correcthorsebatterystaple.

I see many applications with password length limits that will virtually assure many insecure passwords among their users.

I'm going to go out on a limb and suggest that allowing arbitrary password lengths would probably do a great deal more for device security than enforcing bizzare and unmemorable contortions within artificially restricted password lengths.

A typical response to wacky and unmemorable rules is to standardize on some formula that is used across multiple applications.

This is great until passwords from multiple hacked sites are available to someone who cares to attempt pattern analysis. Also, data mining capabilities are becoming increasingly sophisticated, bringing such analysis within the reach of script kiddies even when they don't care to apply that much effort.

All told, I just wish applications would give me enough room to make a memorable and secure password. <-- (that sentence would be a decent password)

HL
Horace Lasell
Oct 16, 2014

This Black Hat 2013 presentation suggests that remote code execution on a compromised camera could lead to a compromise of the network. Many surveillance cameras are not isolated from a facility's data networks. I agree; the level of complexity should be in line with the value of what you are protecting.

On a separate but related note, some systems severely limit the number of characters allowed in a password. As noted in an earlier IPVM discussion, longer passwords can be more easily remembered while still being secure. Cameras which store and stream high volumes of data are clearly capable of managing reasonably long passwords; could anyone suggest another possible motivation for password length restrictions?

Avatar
Kyle Folger
Oct 16, 2014
IPVMU Certified

I'm not sure about their new offerings, but Dahua is known for having a backdoor password by the day and a telnet password I believe that cannot be changed. I was able to login using root:vizxv and reboot the camera as that was the only command I knew.

I believe that the camera should never be allowed to be directly accessed but only through a VMS or access through a secure channel into the server. They should also be on a VLAN isolated from the rest of the network. It would be good if the physical network were also secured.

On a positive note, the latest Dahua cameras received allowed one to change the passwords for Onvif. On prior firmware/models, this was not possible and any computer on the network could access the feeds using Onvif.

UI
Undisclosed Integrator #1
Oct 22, 2014

Hi

Coming from a relative newcmer to the field of security Cameras (IP integrator is our other/main hat). When you are dealing with 200 cameras how do you go about the 200 different cameras passwords you would have? You now must finda way to manage those 200 passwords... and that securely.

I believe that security shoud lstart from the network itself. That is not an easy thing to accomplish but this seems to be the way IMO to deal with the Device Management / Device Security conflicting requirements.

JH
John Honovich
Oct 22, 2014
IPVM

A, I added a new discussion on this here - How Do You Handle Password Assignment Of 200 Cameras?

Avatar
Ethan Ace
Sep 24, 2015

Update: Dahua now asks users (but doesn't force them) to change password on first login, and gives password strength recommendations.

They've also removed the 888888 and 666666 backdoor accounts from cameras.

We've confirmed this on multiple cameras, but don't have a new DVR to check with. We'll update if we do.

Avatar
Kyle Folger
Sep 25, 2015
IPVMU Certified

Thanks for the update. I haven't seen this in the IP cameras but I have seen the password request in the CVI DVRs. It asked me to change the password and I noticed I could have a password longer than 6 characters. The 6 and 8 accounts were still there, but I removed them which I know you used to not be able to on the IP cameras which makes it take longer to set passwords.

Have you tested if the Onvif password could be changed? I know that I could change the passwords on the cameras, but then simply use Onvif manager to completely alter settings without a password or using admin admin.

Avatar
Ethan Ace
Sep 25, 2015

I didn't check the ONVIF password. I'll check it out tomorrow. I do recall seeing a checkbox for ONVIF authentication I don't recall being there, but I didn't try it out.

Avatar
Kyle Folger
Sep 25, 2015
IPVMU Certified

Yes, I noticed that too when it first got added. I thought, wow this is great. That was until I changed the passwords on the camera and it didn't change the ONVIF password. It was still admin/admin with authentication turned on (no password turned off). I tried to change the password with ONVIF manager, but that didn't work which is why I'm hoping newer firmware addresses this issue.

Avatar
Kyle Folger
Apr 30, 2016
IPVMU Certified

Here is an update to Dahua and Onvif security. So the latest Dahua firmware (one that has admin with no other accounts) has the ability to change the Onvif password. However, Onvif authentication must be on and you can't change the password from the web browser. You must change the Onvif admin password using Onvif Device Manager.

In addition to that, almost all Dahua cameras have newer firmware that can be installed on all existing cameras. All the ones we updated had auto zoom/focus. The upgrade reset the zoom/focus back to default and then made it out of focus. After the firmware update, we could delete the 8's and 6's accounts and then login to Onfiv Device Manager and change all the passwords. No more admin/admin Onfif backdoor.

U
Undisclosed #2
Apr 30, 2016
IPVMU Certified

No more admin/admin Onfif backdoor.

Good work, Kyle!

Jon D. owes you a beer. ;)

Avatar
Ethan Ace
Feb 18, 2016

Update: we added a section on Bosch, who famously included no password by default. In new firmwares, they prompt the user to create a password, but don't require a strong one.

They also turned of SSH and telnet by default, which used to be on, and with no password required, either.