Cyber Security For Video Surveillance Study 2016

IT
IPVM Team
•Published Apr 27, 2016 15:09 PM

This study provides the foundations for video surveillance professionals to understand the importance of cybersecurity, what is being done to enhance cybersecurity and what providers are viewed as the best and worst at cybersecurity.

100 integrators answered the following 5 open-ended questions on cyber security:

  • How important is cyber security in your customers' decision making process?
  • What type of customers are most concerned about cyber security? Why?
  • What steps do you take to ensure cyber security for your customers video surveillance systems?
  • Which security manufacturers do you feel are strongest in terms of cyber security? What do they do that makes you feel this way?
  • Which security manufacturers do you feel are weakest in terms of cyber security? What do they do that makes you feel this way?

They provided detailed color commentary on each point, so you can understand their mindset and approach.

Summary

The key trends revealed in the study:

  • Overall, cyber security is not very important for customer's decision making process.
  • The 4 segments showing highest cybersecurity concern were government, banking, education and healthcare
  • Steps taken to secure systems were generally basic. While various techniques were mentioned, changing default password was the most common.
  • Western video surveillance manufacturers were viewed as the strongest in cyber security.
  • Chinese, and specifically Hikvision, was selected as the weakest in cyber security.

Full details, integrator explanations and our analysis is shared inside.

Low **********

**** ********* **** ***** ******** ** low ********** ** ***** ******** ****** process. ****** **** ** *** ********* indicated ****:

******** ************ *** ***** ***** ** the ****** *** *** ********:

  • "** ** *** ********* ** ***"
  • "** ********* ****** ******* * ******* over ************* ** ***** ******** ****** process."
  • "*** *** ******* **** ***'* **** the *****"
  • "* ******** ** *** ********* **** we **** ********** **** ***'* ****** care ***** ***** ******** ******* ** the ************ *******."
  • "******** *** ********** ******** ** *** issue, *** **** **** *** *** the ******* ** **** ****** **** back **** *** **** ***** *** shadows **** **** **** **** ****** to ***."

******* *********** ********* **** ******** *** to **** ********* **** ***** ** cyber ******** *****:

  • "** **** *** ** **** ******* worried ***** **** ***, *** ** try *** **** ** **** * case *** *** ** ** *******."
  • "*** **** **** *** ******** ***** this **** **** ****** **."
  • "** ** ***** ********** ***** ******* to ***** *********."
  • "*'* *** ****** ***********. *** **** time **** ******** * ****** ** when * ***** *** ***************."
  • "** **** ****, **** ****** ** not **** *** ******* *****, *** we *** ********** ******** ** ** to ***** *********."

**********, *******, *********, ********** - **** Cyber ******** *****

***** ********* *** ***** **** ********** requirements **** **** ****** ** **** higher ******** ****** ***** ********.

  • "******** *** *** ** ***** **** customers. ** ********* **** ****** ****** to *** ********* ** ****** *** potential ******. **** ****** ** ** and ***** ********* *** ***** ******."
  • "****** *********, ********* ** ************* ******* are **** **** *********"
  • "******* *** **** **** ********, ******* with *** ******** *********** & ******* with ********* ****** ********* ** **** whether **** ** ******** **** ** confidential ****."
  • "*** *** *********, **** **** *** Topic *** **** **** ** ** and ** **** *********."

*****, ********** ********, ******* *** ********** organizations ******** **** ** ** ********** that ** *********** *** ******* ********. These ************* **** **** ********* ** risk, ** ******** *********.

  • "********* *** ** ********* ** **** see *** ***** **** *****"
  • "****** ** ***** ********** *** ** either ********** ** ** **** ** management ***** **** ** ************* ** and *********** ** **** ******** *****."
  • "********** - **** ****** *** ** previous ********"
  • "*******, ******* **** **** ******* ********"
  • "********* ******, *** *****, **********. **** are ******* ***** ******* ****** **** their ******* *** ****** ** **** using *** ***** ************ ******, ** using *** ***** ************ ****** ** a ******** ** ***** *******."
  • "********** *** ***** *** **** ********* since **** **** ******** **** ** case *** ******** ******** ******* *** data ******* **** *********."
  • "*********, *******, *********. **** **** **** breached *** *** ******* *** ********* etc"
  • "*** **** ** *** ****** **** is *********, ** *** ******* ** obvious *** ******** ** *** *** documented ******. ** ** ****** ** those *****. **** ** *** ************* clients *** **** ** *********, *** they **** ********* ***** ** **** with **."

**** *** *********, ******* ********* ** not **** ***** ******** ** * primary ************* *** *** ****** ************* do. ******* ************* *** **** ****** to ** ****** *******, *** * data ****** ** **** ****** ** become ******** ****.

Methods *** ******** ********* ****

******** ******* ********* *** *** **** common **** ***** ** ******* ***** security.

***** **% ** ********* ********* **** were **** ** ******* ********.

********* ** ********** ******** **** ********** listed:

  • "********** ****** / ****** ******** ** at *** ******** (********* ** **********)"
  • "******** ******* ********"
  • "** ***** * ******** ******** ******* for *** ***** ****** ** *** VLANs."
  • "** ********** ******** *** ***** ************ network **** ***** ******** (********, ********* LAN ***.)"
  • "******* *** ***** ****** ** * separate ******* ** ****** **** ** possible"

********** ** ******* ***** ** **** used, ****** *** ** ************ ** might ** ********:

  • "*** ** ********** (*** ****** ***********, for ******** ************."
  • "** **** *** *******, ** *** 256 *** *** ********** ******* ******'* and ******."
  • "********* ******* * ***. ***** ******** and *********** ********* *** **** **** a *** ***** ****** *** *** virtual ****** *** **** ***; ** uses * ******* *********** *** ****** encryption *** *** ***, **** **, in ** *******, *** **** ****** solution ** *****."
  • "****** ********** *** ********* ** *****."
  • "****** **********(*****, ***) ** *********** **** cameras, ********** ** ***** ** **** drives, ***** ************ ** ******* ************ of *******, ***."
  • "*** ********* ********* ********** **** ***** wireless ****."

******* ******** *** ******** *******, *** deploying ****-***** ******** **** ******, *** not ** ********** ** *** ***** steps.

*********** *****, ** ******* ******* *******/************ was *** ******** *********.

******* ** *** ********* ** ********** to **** ************** *** ***** ******** was **** **********:

  • "** ******* ********* ****** ***** ******** equipment. ** **** ***** **** ** add *** ***** ********** ** ** up ** ****."
  • "*** ****** ********* *** **** **-***** IT ********* ** ******** ***** ***** IT ********* *** ** ****** ****** themselves."
  • "** **** **** ******* **** ***** IT *********** ** ******* ** ***** rules *** **************."
  • "***** ** ***** ** *******"
  • "** ***** ** ** ** ******'* IT *********** *** *** ******** *******"
  • "** ********* *** ****** *** ****** has *********** ******** ******** ** *** system *******."
  • "**** ****** ** *** - **'* my ********'* ********* ******** *** ** department **************"

**** ******** ***** *** **** *** a ***** ******** *** *** ** IT **********, *** ** *** **** of ****** ************* ** *** ** wise ** ***** *** ******** ** decide *** ***** ******** ******** ******* are ***** ** ** ******** ********, secured, ** ********* ** ***** ********.

Manufacturers ****** ** **** ******

****** ************* ******** * *** **** votes **** *** ********* ** ***** of ********* ********.

**** *** ** *** *** **** cited, **** ****** *** ***** ** responses:

  • "****. **** ***** *** ******* ** configure ***.** *** *** ** ***** through *** ****** ************* ***** *** they ******* ************* ****** ** **** of ***** *********** *** ********* ******."
  • "****, **** *** * **** ******* solution ********."
  • "**** **************. ****'** *** **** ************ we **** ** *** ******** ***** about *************"
  • "**** *** ***** *** ***** ** these ******** *** **** ******** *********** that ** ********* ** ****."
  • "**** *** *** * ***** ******** focus *** ***** **** ********* *********. Their ***** ********* ***** ** ****** solid, ****** ** ***'** *** *******, they *** ***** ** ***********"
  • "*** ****** *************, **** ****, ***** the *********** ** ********* *** ******* within ***** ********, **** ** *** fit. ***** *************, ***'* ***** ** to ****** ***** ******* ***** *** related *********."
  • "**** **** ** ** * ****** of ********."
  • "**** ***** ** **** ** **** don't **** ******* ********* ** ***** products, ****** *** *** *** **** installation."

**** **** *** ********** ********* ******** *************** *** ********* ******** for **** ********.

* *** *********** ********* ***** ****, with *** ****** *** **** ** adding ***** ***** **** ** **** cameras *** ******* **********:

"**** - ******* ** ***** ******* only .*** ******** *** ******** (**** Media ******* ******), ******** ** **** for ******* (****, ***), ******** ** Windows **** *** ******* ************* ** cameras (******** ***** *******, ***) *** 100% *******-**** *** (*** **** ** would *** ***** ***). ****, **** allow ***** ********* *** ***** ***** force ******* ******** **** ********* ******** guesses."

********:

  • "********'* *****-** **** ******** ******, ****** simple ******** *******, *** ******-******* ****** of *********/*********** ******* ***** **** **** high ** ** **** ** ****."
  • "******** **** *** ******** ******** ***** of **************, ******** ********** (******* ******* & ***, ******* ******* & *******)"
  • "******** - **** ** **** ** some ***** *******, *** ***** *** cameras **** ** **** * ****** encryption ******* ***** ********."

*****:

  • "***** - ********** ******** *** ***** transport ********"
  • "***** *******, ******** ************ *** ********* securely."
  • "***** ** ***** ***'* ** *** their ** ******* **** *** ****** of * *** ***** *** ****'* used ** *** *** *** ***** agencies ****** *** ********** **** ****** takes ** ** *** **** ***** in ***** ** **** ***** ******** at *** ****."

***** **** *** ***** ******** *****.

*******:

  • "** *** ***** ******* *** ***** mostly, **** **** ******** ******** ********, stream **********, *** *******. ******** ******* they ******* ********** ******* ********* *** enterprise ********* *** **** ****** ************ regarding ** ********."
  • "******* ** ****** ***** ******* ** implement ********** *** ** ****** ********** to ******* ******."
  • "******* - **** *** **** ** an ** ******* *******"

******* ***** ********** ************** ** ***** ******* ******

*********:

  • "********* ** ****** **** - **** have **** *********** ******** ** ****** devices ***."
  • "********* - **** **** ** **** windows ******* *** **** ** ***** to *** ****** ****** ********. ******** - **** ** **** ** **** ONVIF *******, *** ***** *** ******* seem ** **** * ****** ********** between ***** ********."
  • "*********, ****, ***** - **** *** have **** * **** **** **** at ***** *** ********** *** ********, vulnerabilities, ******* ***** ****** ** **** practices *** *** ***** ******** ******* audits."

China / ********* ** ***** ******

*** *** ***** ****** ********, ********* was *** ************* ********* *****, ***** came ** **********, *** ******* ****** mentioned "******* *******" ** ******** *******.

  • "********* - **** ******* ** **** has **** ********."
  • "*********, ** ***** **** ******** ******** during *** ************** ** ***** ***. easy ** ** ******."
  • "*********, * ***** ****** ***** ******* government ****** ** ********* *** ********* DVRs *** ******'*."
  • "********* *** * *** **********, ***** and *****"
  • "********* *** *** ***** *************. **** either ***'* **** ** ***'* **** the ********* ** ****** ***** ******* are ******."
  • "********* - ******** ******** ********** *** Chinese ********** *********** **** *** *******."
  • "*********. **** ******* ***** ***** ** make *** ****** *** ******* ********* and ********* **** ***** ******* ******** versions *** * ***** ***'* ******** trust *** ******** ** *** ********."
  • "**** ****** ** **** **** **** some **** ** *****, *** ***** is ** *** *** *****. *********, Samsung/Hanwha/Techwin, *** ****** **** **** *** security ****** ***. ************, ***** ***** allows ***** ****** ***** ******* ***** and **** ****** ** ********. ********* has *** **** ***** *****, **** of ***** **** **** *****. ******* Wisenet ******* **** ******* **** * bug **** **** ****** **** *** web ********* ** *** ******, **** browser ********** ** ************* ******* **** could *** ** ****** *** **. You **** ****** ** ***** *** browser **** ** ***** ** *** out."
  • "*********, ** ***** **** **** *** trying ** ***** ********* **. * no ****** ***** ****. **** ***** cameras *** ***'* ***** ****. **'** looking *** * *** ********* ********."
  • "*********. ****** **** **** **** ************ after ***** ********** *****, **** **** did ** ** ******** ** ******* pressure. ***** ***** ** ** * culture ** ******** ** * ******* concern--not ** ************."
  • "********* *** * ******** ** *** communist ***** ****** ***** *******."
  • "*****. **** **** ***** **** **** passwords **** *** **** ** **** on *** ******** ** ** ****** how **** *** ******* *** ****** with * **** ******** ** *****, anyone **** *** ** ****** ** the ****** *** *** **."
  • "*** ***** ******* ******* *** *** worst... *'** ******* **** **** **** had **** ***** ***** **** *** even ****** ** * ******* ** the ********."

********* **** **** ********* ****** **** ** ***** *******, **** * **** ** ****** issues *** ****** ******** **** ********* *****.

Comments (3)
UM
Undisclosed Manufacturer #1
•Apr 28, 2016

Hacking a device 101.. Use Chrome web browser, login to your IP device, assume that there is a web browser. Which is most devices now days.

Now press F12 the developer console! ( don't be scared it's not that hard! )

Now locate the option on the ribbon called Network!! press refresh for the page. that's the little almost circle with arrow on it on the top left next to left-right browser navigation icons.

For at most you will discover a lot of things what is going on. the things to look for in weak or complete shit security is transfer of username / passwords in plain easy to read text. The interesting column is the initiator one, this show you all what is passed on the network at http traffic commands!

Now if you consider this someone with the most basic and free tools, like Wireshark, can capture network traffic and find all the passwords they could wish for.

Now one other item to select is select the ribbon item EditthisCookie

This will show you what the device is keeping in the browser. Again look for simple things like passwords, and such.

For the hard nuts, you might want take look at firmware update utilities, as they tend to offer some very dangerous commands, in case of Chinese products, typically, the Linux telnet the most hacked part of an OS uses plain text commands.

End of day security is only a weak as the more cleaver person wants to break in.

We all know nothing is secure, we hope at some basic level we can have some sanity in security devices. Just don't expect this day one from Chinese companies, at least for now.

(1)
(7)
UI
Undisclosed Integrator #2
•Apr 28, 2016

In contrast to the reports, I heard the Los Angeles Unified School District, one of the largest in the country, has standardized on HIKvision. One rep to another conversation.

(2)
(1)
UM
Undisclosed Manufacturer #3
•Apr 28, 2016

I know of a local install at a county office using Hikvision cameras. I'm waiting till it completes to send some "anonymous" tips to local news agencies about the security issues with Hikvision and see what happens. I'll post the results if it comes to anything.

(3)