Subscriber Discussion

Axis: Attacks "Result Of Cheap And Inferior IP Cameras And Dvrs"

Avatar
Brian Karas
Jan 12, 2017
IPVM

Axis' founder says

I think the key trend of 2017 in our industry is going to be cybersecurity. If we look at video surveillance cameras, they are now IP based and they are an intelligent network node. We’ve seen attacks that were initiated through network cameras that brought down some key services such as DNS and even brought down a whole country. This is a result of cheap and inferior IP cameras and DVRs. They were configured with a standard hard-coded root password and put on the open internet. If this was in the IT industry it’s an absolute no-no.  But we in the security industry, we unfortunately lag behind IT security. [emphasis IPVM]

One the one hand, Dahua and XiongMai cameras (involved in the Mirai attacks) are certainly less expensive than Axis. 

However, Axis has its own issues with security, for example Axis critical security vulnerability in 2016 that allowed root access without authentication.

Moreover, in our 10 Manufacturer Cyber Security Comparison report, Axis had cybersecurity limitations, for example no strong password enforcement, no account locks, and hardcoded accounts that 'cheap and inferior' products did not, as shown in the comparison table below.

What do you think, is cyber security attacks an issue of 'cheap and inferior' products?

 

(1)
(2)
(1)
U
Undisclosed #1
Jan 13, 2017

Vote: No.

(1)
(1)
UI
Undisclosed Integrator #2
Jan 13, 2017

Certainly "cheap and inferior" products lead the way. However, this is an industry wide issue as is pointed out.  If the industry doesn't take some major strides in correcting these issues on their own then the push will come from outside the industry and the requirements will much deeper and much more stringent. I mean, seriously, how hard is it to produce a device without hard coded user and password?  How hard is it to NOT include telnet in the devices? How hard is it to enforce strong passwords when every devices/website other than security have had the ability and implemented it years ago?

Avatar
John Bazyk
Jan 13, 2017
Command Corporation • IPVMU Certified

I am surprised these manufacturers arent all on the same page for what should be very basic security requirements for cameras.

(3)
U
Undisclosed #3
Jan 13, 2017

Don't throw rocks if you live in a glass house.

(1)
U
Undisclosed #4
Jan 13, 2017
IPVMU Certified

The best defense is a good offense.

(1)
Avatar
Don Kennedy
Jan 13, 2017

This has been going on for many years. One example that I reported years ago:

http://www.kb.cert.org/vuls/id/265532

The only way to solve this is for each IP Camera manufacturer to create a security audit team that does quality assurance for each and any firmware release. Otherwise these "Back Doors" and/or security vulnerabilities will continue from one firmware release to another.

Don

(1)
New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions